Infected Laptop

jpassinault Topic Starter

Post #1July 2, 2010, 12:50 AM UTC last edited July 2, 2010, 1:26 AM UTC

7-1-10
The first problem I noticed was not being able to connect to the l1slashkey.com server for the game Farmtown on Facebook a few days ago. This was just after a Firefox update which might be just a coincidence. Then I noticed that after using a search engine, when I would select something, the web page would either redirect to an advertising page or say that Explorer could not open the web page. Then I noticed that even the websites I normally use would not always connect to the website. I use Explorer and Firefox.
I have Kaspersky for my computer protection. Word documents work OK. I have all my website shortcuts and word documents backed up on a flash drive.

Thank you,
Jon

LDT
Email addy removed
Phone Number removed:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:20:07 PM, on 7/1/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Northern Michigan University\Emergency Broadcast System\nmuebs.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\System32\TPHDEXLG.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\WINDOWS\system32\TpShocks.exe
C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Lexmark 3300 Series\lxccmon.exe
C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\WINDOWS\system32\lxcccoms.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Intel\WRT\WRT Tray.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\kpassina\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.live.com/login.srf?wa=wsignin…5&mkt=en-US
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: NP Helper Class - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: (no name) - {5617ECA9-488D-4BA2-8562-9710B9AB78D2} - (no file)
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
O4 - HKLM\..\Run: [TPFNF7] C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [lxccmon.exe] "C:\Program Files\Lexmark 3300 Series\lxccmon.exe"
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [LPMailChecker] C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [Backup Reminder] C:\Program Files\Northern Michigan University\Backup Reminder\BackupReminder.exe -b
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKUS\S-1-5-21-2715232440-2902205811-3487645032-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-2715232440-2902205811-3487645032-1006\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (User '?')
O4 - HKUS\S-1-5-21-2715232440-2902205811-3487645032-1006\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (User '?')
O4 - HKUS\S-1-5-21-2715232440-2902205811-3487645032-1006\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup (User '?')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User '?')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Intel Wireless Reporting Tool.lnk = C:\Program Files\Intel\WRT\WRT Tray.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\ie_banner_deny.htm
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1200669642687
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1267071389750
O16 - DPF: {CAFECAFE-0013-0001-0026-ABCDEFABCDEF} (JInitiator 1.3.1.26) -
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1561EC62-DD61-4B6D-ACBD-F218042ADABF}: NameServer = 93.188.162.161,93.188.166.192
O17 - HKLM\System\CCS\Services\Tcpip\..\{23EBD12E-03E0-4EEE-A77D-60A1C36B3251}: NameServer = 93.188.162.161,93.188.166.192
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 93.188.162.161,93.188.166.192
O17 - HKLM\System\CS1\Services\Tcpip\..\{1561EC62-DD61-4B6D-ACBD-F218042ADABF}: NameServer = 93.188.162.161,93.188.166.192
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.161,93.188.166.192
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0FO\adialhk.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DisplayLink Service (DisplayLinkService) - DisplayLink Corp. - C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kaspersky Network Agent (klnagent) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - Unknown owner - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (file missing)
O23 - Service: NMU Emergency Broadcast System (nmuebs) - Northern Michigan University - C:\Program Files\Northern Michigan University\Emergency Broadcast System\nmuebs.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: System Profile Monitor (spm) - Northern Michigan University - C:\WINDOWS\spm.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exe
O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
O23 - Service: TVT Windows Update Monitor (TVT_UpdateMonitor) - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 16828 bytes

SweetTech

Post #2July 2, 2010, 2:15 AM UTC

Hello,

My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems.

If you have already received help elsewhere please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
Please make sure to carefully read any instruction that I give you.
Reading too lightly will cause you to miss important steps, which could have destructive effects.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
Because of this, you must reply within three days failure to reply will result in the topic being closed!
Please do not PM me directly for help. If you have any questions, post them in this topic. The only time you can and should PM me is when I have not been replying to you for several days (usually around 3 days) and you need an explanation. If that's the case, just send me a message on here.
Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

OTL Custom Scan

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

NEXT:

Scanning with GMER

Please download GMER from one of the following locations and save it to your desktop:

Main Mirror
This version will download a randomly named file (Recommended)
Zipped Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

[external image: Posted Image]
GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system…click NO.
Now click the Scan button. If you see a rootkit warning window, click OK.
When the scan is finished, click the Save… button to save the scan results to your Desktop. Save the file as gmer.log.
Click the Copy button and paste the results into your next reply.
Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

– If you encounter any problems, try running GMER in safe mode.
– If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.

NEXT:

Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. The logs that were produced after running the OTL scans. (OTL.txt & Extras.txt)
3. The log that was produced after running GMER
4. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

jpassinault

Post #3July 2, 2010, 2:41 AM UTC

OTL logfile created on: 7/1/2010 10:27:18 PM - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\kpassina\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 129.00 Mb Available Physical Memory | 13.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 64.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 30.36 Gb Free Space | 40.73% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: kpassina-Y3PF08
Current User Name: jpassinault
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/07/01 22:26:53 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\kpassina\Desktop\OTL.exe
PRC - [2010/06/26 17:02:59 | 000,039,408 | —- | M] (Google Inc.) – C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2010/05/26 11:03:40 | 002,346,192 | —- | M] (IObit) – C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
PRC - [2009/04/10 23:30:18 | 000,231,952 | —- | M] (Kaspersky Lab) – C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/06/11 14:20:07 | 000,022,528 | —- | M] (Northern Michigan University) – C:\Program Files\Northern Michigan University\Emergency Broadcast System\nmuebs.exe
PRC - [2008/03/17 18:19:56 | 000,094,608 | —- | M] (Kaspersky Lab) – C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe
PRC - [2008/03/12 17:08:10 | 000,451,944 | —- | M] (DisplayLink Corp.) – C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
PRC - [2008/03/12 17:08:08 | 004,359,528 | —- | M] (DisplayLink Corp.) – C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
PRC - [2008/03/12 17:08:08 | 000,439,656 | —- | M] (DisplayLink Corp.) – C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe
PRC - [2008/02/28 09:59:48 | 000,266,240 | —- | M] (Intel Corporation) – C:\Program Files\Intel\WRT\WRT Tray.exe
PRC - [2008/01/25 14:06:08 | 000,111,904 | —- | M] (Lenovo Group Limited) – C:\Program Files\Lenovo\ZOOM\TpScrex.exe
PRC - [2008/01/24 10:21:58 | 000,066,928 | —- | M] (Lenovo Group Limited) – C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
PRC - [2008/01/11 02:21:00 | 000,144,728 | —- | M] (Lenovo Group Limited) – C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE
PRC - [2008/01/11 02:21:00 | 000,124,248 | —- | M] (Lenovo Group Limited) – C:\Program Files\ThinkVantage\PrdCtr\LPMLCHK.EXE
PRC - [2007/12/20 04:04:10 | 000,060,704 | —- | M] (Lenovo Group Limited) – C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe
PRC - [2007/12/05 17:32:06 | 000,487,424 | —- | M] (Lenovo Group Limited) – C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
PRC - [2007/12/05 17:31:58 | 001,122,304 | —- | M] (Lenovo Group Limited) – C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
PRC - [2007/12/05 17:17:14 | 000,520,192 | —- | M] () – C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
PRC - [2007/12/05 17:09:48 | 000,022,016 | —- | M] () – C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
PRC - [2007/12/05 17:01:24 | 000,644,408 | —- | M] (Lenovo Group Limited) – C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
PRC - [2007/12/05 16:14:34 | 000,122,880 | —- | M] (Synaptics, Inc.) – C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2007/11/22 15:09:26 | 000,181,536 | —- | M] (Lenovo.) – C:\WINDOWS\system32\TpShocks.exe
PRC - [2007/11/21 18:38:38 | 000,075,040 | —- | M] (Lenovo Group Limited) – C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
PRC - [2007/11/02 15:51:02 | 000,036,136 | —- | M] (Lenovo) – C:\WINDOWS\system32\ibmpmsvc.exe
PRC - [2007/10/16 18:33:00 | 000,037,424 | —- | M] (Lenovo.) – C:\WINDOWS\system32\TPHDEXLG.exe
PRC - [2007/10/08 14:27:02 | 000,794,624 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
PRC - [2007/10/08 14:18:04 | 000,995,328 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
PRC - [2007/10/08 14:13:36 | 001,101,824 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
PRC - [2007/10/08 14:09:26 | 000,659,456 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
PRC - [2007/10/08 14:06:44 | 001,183,744 | —- | M] (Intel Corporation ) – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
PRC - [2007/10/08 14:01:54 | 000,483,328 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
PRC - [2007/06/13 06:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/04/27 03:33:00 | 000,243,248 | —- | M] (Lenovo Group Ltd.) – C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE
PRC - [2007/01/04 19:48:52 | 000,112,152 | R— | M] (InterVideo) – C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
PRC - [2006/11/03 18:20:12 | 000,866,584 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2006/11/03 18:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2006/11/03 18:02:14 | 000,050,688 | —- | M] (Avanquest Software ) – C:\Program Files\Digital Line Detect\DLG.exe
PRC - [2005/05/20 10:11:06 | 000,925,696 | —- | M] (Analog Devices, Inc.) – C:\Program Files\Analog Devices\Core\smax4pnp.exe
PRC - [2005/02/25 12:42:46 | 000,466,944 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\lxcccoms.exe
PRC - [2005/02/21 07:21:18 | 000,192,512 | —- | M] (Lexmark International, Inc.) – C:\Program Files\Lexmark 3300 Series\lxccmon.exe

========== Modules (SafeList) ==========

MOD - [2010/07/01 22:26:53 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\kpassina\Desktop\OTL.exe
MOD - [2007/12/05 16:14:30 | 000,065,536 | —- | M] (Synaptics, Inc.) – C:\WINDOWS\system32\SynTPFcs.dll
MOD - [2006/08/25 11:45:55 | 001,054,208 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
MOD - [2004/08/03 23:01:18 | 000,102,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - File not found [Unknown | Stopped] – – (McComponentHostService)
SRV - [2010/03/29 08:51:54 | 000,068,000 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files\NOS\bin\getPlus_Helper.dll – (getPlusHelper) getPlus®
SRV - [2009/04/10 23:30:18 | 000,231,952 | —- | M] (Kaspersky Lab) [Auto | Running] – C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe – (AVP)
SRV - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
SRV - [2008/10/09 17:05:16 | 000,360,448 | —- | M] (Lenovo Group Limited) [Auto | Stopped] – C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe – (TVT_UpdateMonitor)
SRV - [2008/06/11 14:20:07 | 000,022,528 | —- | M] (Northern Michigan University) [Auto | Running] – C:\Program Files\Northern Michigan University\Emergency Broadcast System\nmuebs.exe – (nmuebs)
SRV - [2008/03/17 18:19:56 | 000,094,608 | —- | M] (Kaspersky Lab) [Auto | Running] – C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe – (klnagent)
SRV - [2008/03/12 17:08:08 | 000,439,656 | —- | M] (DisplayLink Corp.) [Auto | Running] – C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe – (DisplayLinkService)
SRV - [2007/12/05 17:31:58 | 001,122,304 | —- | M] (Lenovo Group Limited) [Auto | Running] – C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe – (TVT Scheduler)
SRV - [2007/12/05 17:21:32 | 000,950,272 | —- | M] (Lenovo Group Limited) [Auto | Stopped] – C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe – (TVT Backup Service)
SRV - [2007/12/05 17:17:14 | 000,520,192 | —- | M] () [Auto | Running] – C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe – (TVT Backup Protection Service)
SRV - [2007/12/05 17:01:24 | 000,644,408 | —- | M] (Lenovo Group Limited) [Auto | Running] – C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe – (ThinkVantage Registry Monitor Service)
SRV - [2007/11/02 15:51:02 | 000,036,136 | —- | M] (Lenovo) [Auto | Running] – C:\WINDOWS\system32\ibmpmsvc.exe – (IBMPMSVC)
SRV - [2007/10/16 18:33:00 | 000,037,424 | —- | M] (Lenovo.) [Auto | Running] – C:\WINDOWS\system32\TPHDEXLG.exe – (TPHDEXLGSVC)
SRV - [2007/10/08 14:27:02 | 000,794,624 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe – (EvtEng) Intel®
SRV - [2007/10/08 14:06:44 | 001,183,744 | —- | M] (Intel Corporation ) [Auto | Running] – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe – (S24EventMonitor) Intel®
SRV - [2007/10/08 14:01:54 | 000,483,328 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe – (RegSrvc) Intel®
SRV - [2007/07/02 10:49:02 | 000,040,960 | -H– | M] (Northern Michigan University) [Auto | Stopped] – C:\WINDOWS\spm.exe – (spm)
SRV - [2007/01/04 19:48:52 | 000,112,152 | R— | M] (InterVideo) [Auto | Running] – C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe – (IviRegMgr)
SRV - [2006/11/03 18:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MsMpEng.exe – (WinDefend)
SRV - [2005/02/25 12:42:46 | 000,466,944 | —- | M] (Lexmark International, Inc.) [On_Demand | Running] – C:\WINDOWS\System32\lxcccoms.exe – (lxcc_device)

========== Driver Services (SafeList) ==========

DRV - [2010/01/13 20:16:14 | 000,005,760 | —- | M] (Lenovo) [Kernel | On_Demand | Stopped] – C:\Program Files\Lenovo\Rescue and Recovery\WAM.sys – (WAM)
DRV - [2009/04/10 23:30:18 | 000,201,504 | —- | M] (Kaspersky Lab) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\klif.sys – (klif)
DRV - [2008/07/11 10:48:00 | 000,046,144 | —- | M] (Lenovo) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\tvtumon.sys – (tvtumon)
DRV - [2008/07/01 14:15:30 | 000,112,144 | —- | M] (Kaspersky Lab) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\kl1.sys – (kl1)
DRV - [2008/05/13 19:08:04 | 000,049,904 | R— | M] (Avanquest Software) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BVRPMPR5.SYS – (BVRPMPR5)
DRV - [2008/03/10 14:03:45 | 000,033,536 | —- | M] (Lenovo) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\tvtfilter.sys – (tvtfilter)
DRV - [2008/03/10 14:03:16 | 000,021,376 | —- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\psadd.sys – (psadd)
DRV - [2008/03/10 14:03:12 | 000,007,012 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\pmemnt.sys – (pmem)
DRV - [2008/01/11 01:30:00 | 000,004,442 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\drivers\TPPWRIF.SYS – (TPPWRIF)
DRV - [2007/12/26 04:04:02 | 000,007,168 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\drivers\TSMAPIP.SYS – (TSMAPIP)
DRV - [2007/11/26 11:21:08 | 000,020,992 | —- | M] (http://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\DisplayLinkUsbPort.sys – (DisplayLinkUsbPort)
DRV - [2007/11/15 10:18:06 | 000,017,845 | —- | M] (Lenovo Group Limited) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\TPHKDRV.sys – (TPHKDRV)
DRV - [2007/11/02 15:50:30 | 000,021,808 | —- | M] (Lenovo.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ibmpmdrv.sys – (IBMPMDRV)
DRV - [2007/11/01 16:26:36 | 000,989,696 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_DPV.sys – (HSF_DPV)
DRV - [2007/11/01 16:25:32 | 000,211,456 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSFHWAZL.sys – (HSFHWAZL)
DRV - [2007/11/01 16:25:22 | 000,731,520 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2007/10/19 11:29:00 | 000,161,792 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\b57xp32.sys – (b57w2k)
DRV - [2007/10/16 18:33:00 | 000,103,472 | —- | M] (Lenovo.) [Kernel | Boot | Running] – C:\WINDOWS\System32\DRIVERS\Apsx86.sys – (Shockprf)
DRV - [2007/10/16 18:32:00 | 000,019,504 | —- | M] (Lenovo.) [Kernel | Boot | Running] – C:\WINDOWS\System32\DRIVERS\ApsHM86.sys – (TPDIGIMN)
DRV - [2007/09/30 00:03:12 | 000,308,248 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\WINDOWS\System32\Drivers\iaStor.sys – (iastor)
DRV - [2007/09/26 06:01:32 | 002,236,032 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\NETw4x32.sys – (NETw4x32) Intel®
DRV - [2007/08/27 11:10:36 | 000,012,288 | —- | M] (Intel Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\s24trans.sys – (s24trans)
DRV - [2007/08/10 19:25:28 | 000,177,664 | —- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SynTP.sys – (SynTP)
DRV - [2007/08/09 11:28:50 | 005,765,056 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\igxpmp32.sys – (ialm)
DRV - [2007/05/30 17:49:06 | 000,024,344 | —- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\klim5.sys – (klim5)
DRV - [2007/05/22 14:59:38 | 000,030,336 | —- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tvti2c.sys – (TVTI2C)
DRV - [2007/04/18 12:55:48 | 000,026,137 | —- | M] (Nortel Networks) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\eacfilt.sys – (Eacfilt)
DRV - [2007/04/18 12:55:30 | 000,155,152 | —- | M] (Nortel Networks NA, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ipsecw2k.sys – (IPSECSHM)
DRV - [2007/04/18 12:55:30 | 000,155,152 | —- | M] (Nortel Networks NA, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ipsecw2k.sys – (IPSECEXT)
DRV - [2007/03/09 12:16:36 | 000,023,400 | —- | M] (DisplayLink Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\DisplayLinkmirrorport.sys – (DisplayLinkmirror)
DRV - [2007/03/09 12:09:08 | 000,025,704 | —- | M] (DisplayLink Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\DisplayLinkGAport.sys – (DisplayLinkGA)
DRV - [2006/10/02 02:55:00 | 000,014,848 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\SMAPINT.SYS – (Smapint)
DRV - [2006/10/02 02:55:00 | 000,009,343 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\drivers\TDSMAPI.SYS – (TDSMAPI)
DRV - [2006/06/20 12:56:48 | 000,178,688 | —- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ADIHdAud.sys – (ADIHdAudAddService)
DRV - [2005/05/17 11:20:06 | 000,015,872 | —- | M] (Atmel, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\atmeltpm.sys – (atmeltpm)
DRV - [2005/01/07 17:07:18 | 000,138,752 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Hdaudbus.sys – (HDAudBus)
DRV - [2004/08/03 23:07:56 | 000,059,264 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\USBAUDIO.sys – (usbaudio) USB Audio Driver (WDM)
DRV - [2004/08/03 23:07:44 | 000,043,008 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\amdagp.sys – (amdagp)
DRV - [2004/08/03 23:07:44 | 000,041,088 | —- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\sisagp.sys – (sisagp)
DRV - [2001/08/17 14:07:44 | 000,019,072 | —- | M] (Adaptec, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\sparrow.sys – (Sparrow)
DRV - [2001/08/17 14:07:42 | 000,030,688 | —- | M] (LSI Logic) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\sym_u3.sys – (sym_u3)
DRV - [2001/08/17 14:07:40 | 000,028,384 | —- | M] (LSI Logic) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\sym_hi.sys – (sym_hi)
DRV - [2001/08/17 14:07:36 | 000,032,640 | —- | M] (LSI Logic) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\symc8xx.sys – (symc8xx)
DRV - [2001/08/17 14:07:34 | 000,016,256 | —- | M] (Symbios Logic Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\symc810.sys – (symc810)
DRV - [2001/08/17 13:52:22 | 000,036,736 | —- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\ultra.sys – (ultra)
DRV - [2001/08/17 13:52:20 | 000,045,312 | —- | M] (QLogic Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\ql12160.sys – (ql12160)
DRV - [2001/08/17 13:52:20 | 000,040,320 | —- | M] (QLogic Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\ql1080.sys – (ql1080)
DRV - [2001/08/17 13:52:18 | 000,049,024 | —- | M] (QLogic Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\ql1280.sys – (ql1280)
DRV - [2001/08/17 13:52:16 | 000,179,584 | —- | M] (Mylex Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys – (dac2w2k)
DRV - [2001/08/17 13:52:12 | 000,017,280 | —- | M] (American Megatrends Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\mraid35x.sys – (mraid35x)
DRV - [2001/08/17 13:52:00 | 000,026,496 | —- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\asc.sys – (asc)
DRV - [2001/08/17 13:51:58 | 000,014,848 | —- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\asc3550.sys – (asc3550)
DRV - [2001/08/17 13:51:56 | 000,005,248 | —- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\aliide.sys – (AliIde)
DRV - [2001/08/17 13:51:54 | 000,006,656 | —- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\cmdide.sys – (CmdIde)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://login.live.com/login.srf?wa=wsignin…5&mkt=en-US
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.acs.nmu.edu/home"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {2224E955-00E9-4613-A844-CE69FCCAAE91}:3.4.0.4340
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.63
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{2224E955-00E9-4613-A844-CE69FCCAAE91}: C:\Program Files\Internet Saving Optimizer\3.4.0.4340\FF [2009/07/29 23:09:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/27 13:14:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/06/27 13:14:09 | 000,000,000 | —D | M]

[2008/07/01 14:30:42 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\Mozilla\Extensions
[2010/07/01 00:16:05 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\Mozilla\Firefox\Profiles\4ycsm45b.default\extensions
[2010/05/08 11:36:03 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\kpassina\Application Data\Mozilla\Firefox\Profiles\4ycsm45b.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/25 23:29:41 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\kpassina\Application Data\Mozilla\Firefox\Profiles\4ycsm45b.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/07/01 00:15:59 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/04/21 19:01:14 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2006/05/16 04:50:00 | 000,053,355 | —- | M] (Oracle Corporation) – C:\Program Files\Mozilla Firefox\plugins\NPJinit13126.dll

O1 HOSTS File: ([2001/08/23 08:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (no name) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - No CLSID value found.
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [Backup Reminder] C:\Program Files\Northern Michigan University\Backup Reminder\BackupReminder.exe (Northern Michigan University)
O4 - HKLM..\Run: [BLOG] C:\Program Files\ThinkPad\Utilities\BATLOGEX.DLL ()
O4 - HKLM..\Run: [EZEJMNAP] C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE (Lenovo Group Ltd.)
O4 - HKLM..\Run: [FaxCenterServer] C:\Program Files\Lexmark Fax Solutions\fm3032.exe ()
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [LPMailChecker] C:\Program Files\ThinkVantage\PrdCtr\LPMLCHK.EXE (Lenovo Group Limited)
O4 - HKLM..\Run: [LPManager] C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE (Lenovo Group Limited)
O4 - HKLM..\Run: [LXCCCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.DLL ()
O4 - HKLM..\Run: [lxccmon.exe] C:\Program Files\Lexmark 3300 Series\lxccmon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [PWRMGRTR] C:\Program Files\ThinkPad\Utilities\PWRMGRTR.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TPFNF7] C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TpShocks] C:\WINDOWS\System32\TpShocks.exe (Lenovo.)
O4 - HKLM..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Advanced SystemCare 3] C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe (IObit)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software )
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Intel Wireless Reporting Tool.lnk = C:\Program Files\Intel\WRT\WRT Tray.exe (Intel Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogOff = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\ie_banner_deny.htm ()
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.)
O9 - Extra Button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\SCIEPlgn.dll (Kaspersky Lab)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: nmu.edu ([cognosbi] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([download] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([ftp] ftp in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([my] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([my] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([myuser] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([myuser] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([schedule] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([webct] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([webct] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([www] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([www.acs] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([www.acs] https in Local intranet)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1200669642687 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1267071389750 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFECAFE-0013-0001-0026-ABCDEFABCDEF} Reg Error: Value error. (JInitiator 1.3.1.26)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.161,93.188.166.192
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1.0FO\adialhk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\adialhk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O20 - Winlogon\Notify\tpfnf2: DllName - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll ()
O20 - Winlogon\Notify\tphotkey: DllName - C:\Program Files\Lenovo\HOTKEY\tphklock.dll - C:\Program Files\Lenovo\HOTKEY\tphklock.dll (Lenovo Group Limited)
O24 - Desktop WallPaper: C:\Documents and Settings\kpassina\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\kpassina\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/01/17 15:41:14 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{4a0db8ed-26bd-11de-be56-444553544200}\Shell\AutoRun\command - "" = E:\JDSecure\Windows\JDSecure20.exe – File not found
O33 - MountPoints2\{ca310748-289e-11de-be58-444553544200}\Shell\AutoRun\command - "" = E:\.\EncryptionTool\MaxtorEncryption.exe – File not found
O33 - MountPoints2\{d04c59aa-d7a2-11de-bf6c-444553544200}\Shell - "" = AutoRun
O33 - MountPoints2\{d04c59aa-d7a2-11de-bf6c-444553544200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d04c59aa-d7a2-11de-bf6c-444553544200}\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found
O33 - MountPoints2\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\Shell - "" = AutoRun
O33 - MountPoints2\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/07/01 22:26:27 | 000,574,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\kpassina\Desktop\OTL.exe
[2010/07/01 18:19:17 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\kpassina\Desktop\HiJackThis.exe
[2010/06/28 23:05:46 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Desktop\Misc. WORD
[2010/06/28 22:00:42 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Application Data\IObit
[2010/06/28 22:00:41 | 000,000,000 | —D | C] – C:\Program Files\IObit
[2010/06/28 21:59:02 | 000,000,000 | RH-D | C] – C:\Documents and Settings\kpassina\Recent
[2010/06/28 21:53:49 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/06/28 21:53:35 | 001,154,616 | —- | C] (Piriform Ltd) – C:\Documents and Settings\kpassina\Desktop\ccsetup233_slim.exe
[2010/06/28 21:53:07 | 007,505,152 | —- | C] (IObit ) – C:\Documents and Settings\kpassina\Desktop\asc-setup-mj.exe
[2010/06/26 17:02:21 | 000,000,000 | —D | C] – C:\Program Files\Google
[2010/06/26 17:02:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Google
[2010/06/26 13:05:11 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2010/06/26 00:35:15 | 000,000,000 | —D | C] – C:\Program Files\NOS
[2010/06/25 22:34:08 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Local Settings\Application Data\Temp
[2010/06/25 22:33:14 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Local Settings\Application Data\Deployment
[2010/06/09 22:07:39 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010/06/06 19:10:10 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Desktop\You Tube
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/01 22:26:53 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\kpassina\Desktop\OTL.exe
[2010/07/01 22:26:31 | 003,662,880 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox2.dat
[2010/07/01 22:25:24 | 073,627,936 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox.dat
[2010/07/01 22:16:50 | 000,000,152 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Munising Weather.URL
[2010/07/01 21:19:38 | 000,004,767 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Bing.url
[2010/07/01 20:39:28 | 000,010,965 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\7-1-10 Computer Problem Outline.docx
[2010/07/01 20:38:30 | 000,002,533 | —- | M] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007 (2).lnk
[2010/07/01 20:15:45 | 000,000,260 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Ask.com.url
[2010/07/01 19:05:21 | 000,000,497 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Hotmail.url
[2010/07/01 19:03:36 | 000,000,286 | -H– | M] () – C:\WINDOWS\tasks\f94934ba.job
[2010/07/01 19:03:03 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/07/01 19:01:08 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/01 18:59:33 | 000,000,316 | —- | M] () – C:\WINDOWS\tasks\PMTask.job
[2010/07/01 18:58:40 | 000,044,544 | —- | M] () – C:\WINDOWS\System32\ernel32.dll
[2010/07/01 18:58:16 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/01 18:58:14 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/01 18:58:11 | 1063,702,528 | -HS- | M] () – C:\hiberfil.sys
[2010/07/01 18:56:41 | 004,718,592 | -H– | M] () – C:\Documents and Settings\kpassina\NTUSER.DAT
[2010/07/01 18:56:41 | 000,986,840 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox.idx
[2010/07/01 18:56:41 | 000,346,076 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox2.idx
[2010/07/01 18:56:14 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\kpassina\ntuser.ini
[2010/07/01 18:55:48 | 012,822,738 | -H– | M] () – C:\Documents and Settings\kpassina\Local Settings\Application Data\IconCache.db
[2010/07/01 18:19:25 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\kpassina\Desktop\HiJackThis.exe
[2010/07/01 17:42:58 | 000,002,465 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\MSNBC.com.url
[2010/06/30 19:15:01 | 000,000,211 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Google.url
[2010/06/30 15:31:59 | 000,000,575 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\YouTube.url
[2010/06/30 15:08:39 | 000,000,100 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\CNN News.URL
[2010/06/30 14:56:15 | 000,000,231 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\NASCAR.url
[2010/06/29 11:57:25 | 000,000,143 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Login Facebook.URL
[2010/06/28 22:26:38 | 000,000,660 | —- | M] () – C:\WINDOWS\win.ini
[2010/06/28 22:26:38 | 000,000,235 | RHS- | M] () – C:\boot.ini
[2010/06/28 22:26:38 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/06/28 22:14:03 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/06/28 22:00:51 | 000,000,892 | —- | M] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced SystemCare.lnk
[2010/06/28 22:00:51 | 000,000,874 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Advanced SystemCare.lnk
[2010/06/28 22:00:51 | 000,000,156 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\IObit Freeware.url
[2010/06/28 21:46:44 | 001,154,616 | —- | M] (Piriform Ltd) – C:\Documents and Settings\kpassina\Desktop\ccsetup233_slim.exe
[2010/06/28 21:45:46 | 007,505,152 | —- | M] (IObit ) – C:\Documents and Settings\kpassina\Desktop\asc-setup-mj.exe
[2010/06/27 18:14:49 | 000,000,134 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\TV6.URL
[2010/06/27 13:14:20 | 000,001,620 | —- | M] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/06/27 13:14:20 | 000,001,602 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/06/26 14:52:19 | 000,000,342 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Munising Radar.url
[2010/06/24 17:05:23 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/23 19:02:58 | 000,000,223 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\TIME.url
[2010/06/23 19:02:50 | 000,493,082 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/23 19:02:50 | 000,435,828 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/23 19:02:50 | 000,068,558 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\Documents and Settings\kpassina\Application Data\f94934ba.exe
[2010/06/16 11:35:48 | 000,000,298 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Plover Weather.url
[2010/06/10 12:00:50 | 000,266,208 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/01 18:14:37 | 000,010,965 | —- | C] () – C:\Documents and Settings\kpassina\Desktop\7-1-10 Computer Problem Outline.docx
[2010/06/30 18:44:37 | 000,000,211 | —- | C] () – C:\Documents and Settings\kpassina\Desktop\Google.url
[2010/06/28 22:26:32 | 000,001,618 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
[2010/06/28 22:26:32 | 000,000,737 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Intel Wireless Reporting Tool.lnk
[2010/06/28 22:21:44 | 000,044,544 | —- | C] () – C:\WINDOWS\System32\ernel32.dll
[2010/06/28 22:00:51 | 000,000,892 | —- | C] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced SystemCare.lnk
[2010/06/28 22:00:51 | 000,000,874 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Advanced SystemCare.lnk
[2010/06/28 22:00:51 | 000,000,156 | —- | C] () – C:\Documents and Settings\kpassina\Desktop\IObit Freeware.url
[2010/06/26 18:48:29 | 000,001,620 | —- | C] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/06/26 18:48:29 | 000,001,602 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/06/24 17:05:23 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/21 19:51:36 | 000,000,286 | -H– | C] () – C:\WINDOWS\tasks\f94934ba.job
[2010/06/21 19:51:34 | 000,044,544 | —- | C] () – C:\Documents and Settings\kpassina\Application Data\f94934ba.exe
[2009/06/26 23:43:11 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\LXPRMON.DLL
[2009/06/26 23:43:11 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\LXPMONUI.DLL
[2009/06/26 23:39:42 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxccvs.dll
[2008/07/16 09:52:04 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2008/07/01 13:31:37 | 000,000,026 | —- | C] () – C:\WINDOWS\Lidbeep.ini
[2008/03/26 14:52:57 | 000,000,059 | —- | C] () – C:\WINDOWS\WININIT.INI
[2008/03/11 10:45:13 | 000,036,962 | —- | C] () – C:\WINDOWS\System32\ActPanel.dll
[2008/03/11 10:06:08 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2008/03/11 10:06:08 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2008/03/11 10:06:08 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2008/03/11 10:06:08 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2008/03/11 10:06:08 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2008/03/11 10:06:08 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2008/03/10 13:50:34 | 000,009,343 | —- | C] () – C:\WINDOWS\System32\drivers\TDSMAPI.SYS
[2008/03/10 13:47:14 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\drivers\TSMAPIP.SYS
[2008/03/10 13:42:36 | 000,004,442 | —- | C] () – C:\WINDOWS\System32\drivers\TPPWRIF.SYS
[2008/03/10 13:37:26 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\SynTPCoI.dll
[2008/03/10 12:31:12 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4860.dll
[2007/12/14 16:12:14 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\DEVMAN.DLL
[2006/01/26 15:42:26 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/04 00:56:44 | 000,755,200 | —- | C] () – C:\WINDOWS\System32\ir50_32.dll
[2004/08/04 00:56:44 | 000,338,432 | —- | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2004/08/04 00:56:44 | 000,200,192 | —- | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2004/08/04 00:56:44 | 000,183,808 | —- | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2004/08/04 00:56:44 | 000,120,320 | —- | C] () – C:\WINDOWS\System32\ir41_qc.dll

========== LOP Check ==========

[2008/03/26 14:46:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Lenovo
[2009/04/14 15:32:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Seagate
[2009/04/14 00:30:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/09/16 13:51:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/11 14:47:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/04/14 00:28:21 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\3M
[2009/04/14 00:27:44 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\GetRightToGo
[2008/03/11 10:06:52 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\InterVideo
[2010/06/28 22:00:42 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\IObit
[2008/03/26 14:48:04 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\Lenovo
[2009/12/12 18:17:01 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\Opera
[2008/03/11 11:16:59 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\QcWizard
[2010/05/13 22:11:00 | 000,000,442 | —- | M] () – C:\WINDOWS\Tasks\EasyShare Registration Task.job
[2010/07/01 19:03:36 | 000,000,286 | -H– | M] () – C:\WINDOWS\Tasks\f94934ba.job
[2010/07/01 19:03:03 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/07/01 18:59:33 | 000,000,316 | —- | M] () – C:\WINDOWS\Tasks\PMTask.job

========== Purity Check ==========

========== Custom Scans ==========

< netsvcs >

< drivers32 /all >
Invalid Switch: all

< %SYSTEMDRIVE%\*.* >
[2010/05/06 12:59:10 | 000,001,024 | —- | M] () – C:\.rnd
[2008/01/17 15:41:14 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/06/28 22:26:38 | 000,000,235 | RHS- | M] () – C:\boot.ini
[2008/01/17 15:41:14 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/07/01 18:58:11 | 1063,702,528 | -HS- | M] () – C:\hiberfil.sys
[2008/01/17 15:41:14 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/05/01 16:32:49 | 000,002,556 | —- | M] () – C:\logfile
[2010/07/01 19:00:26 | 000,000,528 | —- | M] () – C:\lxcc.log
[2009/04/11 15:36:19 | 000,000,000 | —- | M] () – C:\lxccfire.000
[2009/06/26 23:39:12 | 000,000,000 | —- | M] () – C:\lxccfire.csv
[2009/04/11 15:37:27 | 000,000,291 | —- | M] () – C:\LXCCINST.000
[2009/06/26 23:40:05 | 000,000,291 | —- | M] () – C:\LXCCINST.csv
[2010/07/01 21:46:31 | 000,005,670 | —- | M] () – C:\lxccscan.log
[2009/05/23 22:38:29 | 001,061,910 | —- | M] () – C:\lxccUNST.csv
[2008/01/17 15:41:14 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2009/11/03 17:38:14 | 000,002,854 | —- | M] () – C:\nagent_log.txt
[2004/08/04 07:00:00 | 000,047,564 | RHS- | M] () – C:\ntdetect.com
[2004/08/03 22:59:34 | 000,250,032 | RHS- | M] () – C:\ntldr
[2010/07/01 18:58:09 | 1598,029,824 | -HS- | M] () – C:\pagefile.sys
[2004/08/04 07:00:00 | 000,260,272 | RHS- | M] () – C:\peldr
[2010/07/01 19:07:47 | 000,451,981 | —- | M] () – C:\sysiclog.txt
[2004/08/04 07:00:00 | 000,000,010 | —- | M] () – C:\WIN51
[2004/08/04 07:00:00 | 000,000,010 | —- | M] () – C:\WIN51IP
[2004/08/04 07:00:00 | 000,000,010 | —- | M] () – C:\WIN51IP.SP2

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\A1kUO1oC.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\C5s5e.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\cE555.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\e55k5.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\E79kU7.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\E93kUOC.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\eIQ9w179.dll
[2008/07/06 08:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\G3iQ9wSK9.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\G93a79e.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\gM7g3179.dll
[2007/02/13 20:22:00 | 000,286,208 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp4wm.DLL
[2007/03/02 18:23:38 | 000,235,520 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp5in.DLL
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\IQG793kUO.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\iQGM3179.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\iQGMY.dll
[2005/01/04 17:22:28 | 000,073,728 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\lxccPP5C.DLL
[2006/10/26 19:58:12 | 000,030,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\mY9317.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\O17mY17o.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\O1o93mYW.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\o79mY7.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\O9oC7sK.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\oCE7931sK.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\QG3i7qG.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\SK793179.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\sKU7m3g79.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\u55i5.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\Y7cE1a.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\yWSKUO1oC.dll

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\*. /mp /s >

< CREATERESTOREPOINT >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/03/08 04:31:44 | 000,348,160 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtmsft.dll
[2009/03/08 04:31:38 | 000,216,064 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtrans.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008/01/17 10:28:48 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2008/01/17 10:28:48 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2008/01/17 10:28:48 | 000,892,928 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2007/03/08 11:36:28 | 000,577,536 | —- | M] (Microsoft Corporation) MD5=B409909F6E2E8A7067076ED748ABF1E7 – C:\WINDOWS\system32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2004/08/04 00:56:48 | 000,082,944 | —- | M] (Microsoft Corporation) MD5=2ED0B7F12A60F90092081C50FA0EC2B2 – C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2004/08/04 00:56:48 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=9BEACB911CA61E5881102188AB7FB431 – C:\WINDOWS\system32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"NoAutoUpdate" = 0
"AUOptions" = 4
"ScheduledInstallDay" = 0
"ScheduledInstallTime" = 18
"UseWUServer" = 1
"AutoInstallMinorUpdates" = 1
"DetectionFrequency" = 22
"DetectionFrequencyEnabled" = 0
"NoAutoRebootWithLoggedOnUsers" = 1
"RebootRelaunchTimeout" = 5
"RebootRelaunchTimeoutEnabled" = 0
"RebootWarningTimeout" = 5
"RebootWarningTimeoutEnabled" = 0
"RescheduleWaitTime" = 5
"RescheduleWaitTimeEnabled" = 1

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-06-29 15:59:46

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 843 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:35E5AF34

< End of report >

SweetTech

Post #4July 2, 2010, 2:57 AM UTC

jpassinault

Post #5July 2, 2010, 3:05 AM UTC

OTL logfile created on: 7/1/2010 10:27:18 PM - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\kpassina\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 129.00 Mb Available Physical Memory | 13.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 64.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 30.36 Gb Free Space | 40.73% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: kpassina-Y3PF08
Current User Name: jpassinault
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/07/01 22:26:53 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\kpassina\Desktop\OTL.exe
PRC - [2010/06/26 17:02:59 | 000,039,408 | —- | M] (Google Inc.) – C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2010/05/26 11:03:40 | 002,346,192 | —- | M] (IObit) – C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
PRC - [2009/04/10 23:30:18 | 000,231,952 | —- | M] (Kaspersky Lab) – C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/06/11 14:20:07 | 000,022,528 | —- | M] (Northern Michigan University) – C:\Program Files\Northern Michigan University\Emergency Broadcast System\nmuebs.exe
PRC - [2008/03/17 18:19:56 | 000,094,608 | —- | M] (Kaspersky Lab) – C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe
PRC - [2008/03/12 17:08:10 | 000,451,944 | —- | M] (DisplayLink Corp.) – C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
PRC - [2008/03/12 17:08:08 | 004,359,528 | —- | M] (DisplayLink Corp.) – C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
PRC - [2008/03/12 17:08:08 | 000,439,656 | —- | M] (DisplayLink Corp.) – C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe
PRC - [2008/02/28 09:59:48 | 000,266,240 | —- | M] (Intel Corporation) – C:\Program Files\Intel\WRT\WRT Tray.exe
PRC - [2008/01/25 14:06:08 | 000,111,904 | —- | M] (Lenovo Group Limited) – C:\Program Files\Lenovo\ZOOM\TpScrex.exe
PRC - [2008/01/24 10:21:58 | 000,066,928 | —- | M] (Lenovo Group Limited) – C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
PRC - [2008/01/11 02:21:00 | 000,144,728 | —- | M] (Lenovo Group Limited) – C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE
PRC - [2008/01/11 02:21:00 | 000,124,248 | —- | M] (Lenovo Group Limited) – C:\Program Files\ThinkVantage\PrdCtr\LPMLCHK.EXE
PRC - [2007/12/20 04:04:10 | 000,060,704 | —- | M] (Lenovo Group Limited) – C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe
PRC - [2007/12/05 17:32:06 | 000,487,424 | —- | M] (Lenovo Group Limited) – C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
PRC - [2007/12/05 17:31:58 | 001,122,304 | —- | M] (Lenovo Group Limited) – C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
PRC - [2007/12/05 17:17:14 | 000,520,192 | —- | M] () – C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
PRC - [2007/12/05 17:09:48 | 000,022,016 | —- | M] () – C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
PRC - [2007/12/05 17:01:24 | 000,644,408 | —- | M] (Lenovo Group Limited) – C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
PRC - [2007/12/05 16:14:34 | 000,122,880 | —- | M] (Synaptics, Inc.) – C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2007/11/22 15:09:26 | 000,181,536 | —- | M] (Lenovo.) – C:\WINDOWS\system32\TpShocks.exe
PRC - [2007/11/21 18:38:38 | 000,075,040 | —- | M] (Lenovo Group Limited) – C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
PRC - [2007/11/02 15:51:02 | 000,036,136 | —- | M] (Lenovo) – C:\WINDOWS\system32\ibmpmsvc.exe
PRC - [2007/10/16 18:33:00 | 000,037,424 | —- | M] (Lenovo.) – C:\WINDOWS\system32\TPHDEXLG.exe
PRC - [2007/10/08 14:27:02 | 000,794,624 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
PRC - [2007/10/08 14:18:04 | 000,995,328 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
PRC - [2007/10/08 14:13:36 | 001,101,824 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
PRC - [2007/10/08 14:09:26 | 000,659,456 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
PRC - [2007/10/08 14:06:44 | 001,183,744 | —- | M] (Intel Corporation ) – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
PRC - [2007/10/08 14:01:54 | 000,483,328 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
PRC - [2007/06/13 06:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/04/27 03:33:00 | 000,243,248 | —- | M] (Lenovo Group Ltd.) – C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE
PRC - [2007/01/04 19:48:52 | 000,112,152 | R— | M] (InterVideo) – C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
PRC - [2006/11/03 18:20:12 | 000,866,584 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2006/11/03 18:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2006/11/03 18:02:14 | 000,050,688 | —- | M] (Avanquest Software ) – C:\Program Files\Digital Line Detect\DLG.exe
PRC - [2005/05/20 10:11:06 | 000,925,696 | —- | M] (Analog Devices, Inc.) – C:\Program Files\Analog Devices\Core\smax4pnp.exe
PRC - [2005/02/25 12:42:46 | 000,466,944 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\lxcccoms.exe
PRC - [2005/02/21 07:21:18 | 000,192,512 | —- | M] (Lexmark International, Inc.) – C:\Program Files\Lexmark 3300 Series\lxccmon.exe

========== Modules (SafeList) ==========

MOD - [2010/07/01 22:26:53 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\kpassina\Desktop\OTL.exe
MOD - [2007/12/05 16:14:30 | 000,065,536 | —- | M] (Synaptics, Inc.) – C:\WINDOWS\system32\SynTPFcs.dll
MOD - [2006/08/25 11:45:55 | 001,054,208 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
MOD - [2004/08/03 23:01:18 | 000,102,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - File not found [Unknown | Stopped] – – (McComponentHostService)
SRV - [2010/03/29 08:51:54 | 000,068,000 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files\NOS\bin\getPlus_Helper.dll – (getPlusHelper) getPlus®
SRV - [2009/04/10 23:30:18 | 000,231,952 | —- | M] (Kaspersky Lab) [Auto | Running] – C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe – (AVP)
SRV - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
SRV - [2008/10/09 17:05:16 | 000,360,448 | —- | M] (Lenovo Group Limited) [Auto | Stopped] – C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe – (TVT_UpdateMonitor)
SRV - [2008/06/11 14:20:07 | 000,022,528 | —- | M] (Northern Michigan University) [Auto | Running] – C:\Program Files\Northern Michigan University\Emergency Broadcast System\nmuebs.exe – (nmuebs)
SRV - [2008/03/17 18:19:56 | 000,094,608 | —- | M] (Kaspersky Lab) [Auto | Running] – C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe – (klnagent)
SRV - [2008/03/12 17:08:08 | 000,439,656 | —- | M] (DisplayLink Corp.) [Auto | Running] – C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe – (DisplayLinkService)
SRV - [2007/12/05 17:31:58 | 001,122,304 | —- | M] (Lenovo Group Limited) [Auto | Running] – C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe – (TVT Scheduler)
SRV - [2007/12/05 17:21:32 | 000,950,272 | —- | M] (Lenovo Group Limited) [Auto | Stopped] – C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe – (TVT Backup Service)
SRV - [2007/12/05 17:17:14 | 000,520,192 | —- | M] () [Auto | Running] – C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe – (TVT Backup Protection Service)
SRV - [2007/12/05 17:01:24 | 000,644,408 | —- | M] (Lenovo Group Limited) [Auto | Running] – C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe – (ThinkVantage Registry Monitor Service)
SRV - [2007/11/02 15:51:02 | 000,036,136 | —- | M] (Lenovo) [Auto | Running] – C:\WINDOWS\system32\ibmpmsvc.exe – (IBMPMSVC)
SRV - [2007/10/16 18:33:00 | 000,037,424 | —- | M] (Lenovo.) [Auto | Running] – C:\WINDOWS\system32\TPHDEXLG.exe – (TPHDEXLGSVC)
SRV - [2007/10/08 14:27:02 | 000,794,624 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe – (EvtEng) Intel®
SRV - [2007/10/08 14:06:44 | 001,183,744 | —- | M] (Intel Corporation ) [Auto | Running] – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe – (S24EventMonitor) Intel®
SRV - [2007/10/08 14:01:54 | 000,483,328 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe – (RegSrvc) Intel®
SRV - [2007/07/02 10:49:02 | 000,040,960 | -H– | M] (Northern Michigan University) [Auto | Stopped] – C:\WINDOWS\spm.exe – (spm)
SRV - [2007/01/04 19:48:52 | 000,112,152 | R— | M] (InterVideo) [Auto | Running] – C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe – (IviRegMgr)
SRV - [2006/11/03 18:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MsMpEng.exe – (WinDefend)
SRV - [2005/02/25 12:42:46 | 000,466,944 | —- | M] (Lexmark International, Inc.) [On_Demand | Running] – C:\WINDOWS\System32\lxcccoms.exe – (lxcc_device)

========== Driver Services (SafeList) ==========

DRV - [2010/01/13 20:16:14 | 000,005,760 | —- | M] (Lenovo) [Kernel | On_Demand | Stopped] – C:\Program Files\Lenovo\Rescue and Recovery\WAM.sys – (WAM)
DRV - [2009/04/10 23:30:18 | 000,201,504 | —- | M] (Kaspersky Lab) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\klif.sys – (klif)
DRV - [2008/07/11 10:48:00 | 000,046,144 | —- | M] (Lenovo) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\tvtumon.sys – (tvtumon)
DRV - [2008/07/01 14:15:30 | 000,112,144 | —- | M] (Kaspersky Lab) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\kl1.sys – (kl1)
DRV - [2008/05/13 19:08:04 | 000,049,904 | R— | M] (Avanquest Software) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BVRPMPR5.SYS – (BVRPMPR5)
DRV - [2008/03/10 14:03:45 | 000,033,536 | —- | M] (Lenovo) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\tvtfilter.sys – (tvtfilter)
DRV - [2008/03/10 14:03:16 | 000,021,376 | —- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\psadd.sys – (psadd)
DRV - [2008/03/10 14:03:12 | 000,007,012 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\pmemnt.sys – (pmem)
DRV - [2008/01/11 01:30:00 | 000,004,442 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\drivers\TPPWRIF.SYS – (TPPWRIF)
DRV - [2007/12/26 04:04:02 | 000,007,168 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\drivers\TSMAPIP.SYS – (TSMAPIP)
DRV - [2007/11/26 11:21:08 | 000,020,992 | —- | M] (http://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\DisplayLinkUsbPort.sys – (DisplayLinkUsbPort)
DRV - [2007/11/15 10:18:06 | 000,017,845 | —- | M] (Lenovo Group Limited) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\TPHKDRV.sys – (TPHKDRV)
DRV - [2007/11/02 15:50:30 | 000,021,808 | —- | M] (Lenovo.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ibmpmdrv.sys – (IBMPMDRV)
DRV - [2007/11/01 16:26:36 | 000,989,696 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_DPV.sys – (HSF_DPV)
DRV - [2007/11/01 16:25:32 | 000,211,456 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSFHWAZL.sys – (HSFHWAZL)
DRV - [2007/11/01 16:25:22 | 000,731,520 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2007/10/19 11:29:00 | 000,161,792 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\b57xp32.sys – (b57w2k)
DRV - [2007/10/16 18:33:00 | 000,103,472 | —- | M] (Lenovo.) [Kernel | Boot | Running] – C:\WINDOWS\System32\DRIVERS\Apsx86.sys – (Shockprf)
DRV - [2007/10/16 18:32:00 | 000,019,504 | —- | M] (Lenovo.) [Kernel | Boot | Running] – C:\WINDOWS\System32\DRIVERS\ApsHM86.sys – (TPDIGIMN)
DRV - [2007/09/30 00:03:12 | 000,308,248 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\WINDOWS\System32\Drivers\iaStor.sys – (iastor)
DRV - [2007/09/26 06:01:32 | 002,236,032 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\NETw4x32.sys – (NETw4x32) Intel®
DRV - [2007/08/27 11:10:36 | 000,012,288 | —- | M] (Intel Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\s24trans.sys – (s24trans)
DRV - [2007/08/10 19:25:28 | 000,177,664 | —- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SynTP.sys – (SynTP)
DRV - [2007/08/09 11:28:50 | 005,765,056 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\igxpmp32.sys – (ialm)
DRV - [2007/05/30 17:49:06 | 000,024,344 | —- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\klim5.sys – (klim5)
DRV - [2007/05/22 14:59:38 | 000,030,336 | —- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tvti2c.sys – (TVTI2C)
DRV - [2007/04/18 12:55:48 | 000,026,137 | —- | M] (Nortel Networks) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\eacfilt.sys – (Eacfilt)
DRV - [2007/04/18 12:55:30 | 000,155,152 | —- | M] (Nortel Networks NA, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ipsecw2k.sys – (IPSECSHM)
DRV - [2007/04/18 12:55:30 | 000,155,152 | —- | M] (Nortel Networks NA, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ipsecw2k.sys – (IPSECEXT)
DRV - [2007/03/09 12:16:36 | 000,023,400 | —- | M] (DisplayLink Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\DisplayLinkmirrorport.sys – (DisplayLinkmirror)
DRV - [2007/03/09 12:09:08 | 000,025,704 | —- | M] (DisplayLink Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\DisplayLinkGAport.sys – (DisplayLinkGA)
DRV - [2006/10/02 02:55:00 | 000,014,848 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\SMAPINT.SYS – (Smapint)
DRV - [2006/10/02 02:55:00 | 000,009,343 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\drivers\TDSMAPI.SYS – (TDSMAPI)
DRV - [2006/06/20 12:56:48 | 000,178,688 | —- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ADIHdAud.sys – (ADIHdAudAddService)
DRV - [2005/05/17 11:20:06 | 000,015,872 | —- | M] (Atmel, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\atmeltpm.sys – (atmeltpm)
DRV - [2005/01/07 17:07:18 | 000,138,752 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Hdaudbus.sys – (HDAudBus)
DRV - [2004/08/03 23:07:56 | 000,059,264 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\USBAUDIO.sys – (usbaudio) USB Audio Driver (WDM)
DRV - [2004/08/03 23:07:44 | 000,043,008 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\amdagp.sys – (amdagp)
DRV - [2004/08/03 23:07:44 | 000,041,088 | —- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\sisagp.sys – (sisagp)
DRV - [2001/08/17 14:07:44 | 000,019,072 | —- | M] (Adaptec, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\sparrow.sys – (Sparrow)
DRV - [2001/08/17 14:07:42 | 000,030,688 | —- | M] (LSI Logic) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\sym_u3.sys – (sym_u3)
DRV - [2001/08/17 14:07:40 | 000,028,384 | —- | M] (LSI Logic) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\sym_hi.sys – (sym_hi)
DRV - [2001/08/17 14:07:36 | 000,032,640 | —- | M] (LSI Logic) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\symc8xx.sys – (symc8xx)
DRV - [2001/08/17 14:07:34 | 000,016,256 | —- | M] (Symbios Logic Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\symc810.sys – (symc810)
DRV - [2001/08/17 13:52:22 | 000,036,736 | —- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\ultra.sys – (ultra)
DRV - [2001/08/17 13:52:20 | 000,045,312 | —- | M] (QLogic Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\ql12160.sys – (ql12160)
DRV - [2001/08/17 13:52:20 | 000,040,320 | —- | M] (QLogic Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\ql1080.sys – (ql1080)
DRV - [2001/08/17 13:52:18 | 000,049,024 | —- | M] (QLogic Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\ql1280.sys – (ql1280)
DRV - [2001/08/17 13:52:16 | 000,179,584 | —- | M] (Mylex Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys – (dac2w2k)
DRV - [2001/08/17 13:52:12 | 000,017,280 | —- | M] (American Megatrends Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\mraid35x.sys – (mraid35x)
DRV - [2001/08/17 13:52:00 | 000,026,496 | —- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\asc.sys – (asc)
DRV - [2001/08/17 13:51:58 | 000,014,848 | —- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\asc3550.sys – (asc3550)
DRV - [2001/08/17 13:51:56 | 000,005,248 | —- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\aliide.sys – (AliIde)
DRV - [2001/08/17 13:51:54 | 000,006,656 | —- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\cmdide.sys – (CmdIde)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://login.live.com/login.srf?wa=wsignin…5&mkt=en-US
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.acs.nmu.edu/home"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {2224E955-00E9-4613-A844-CE69FCCAAE91}:3.4.0.4340
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.63
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{2224E955-00E9-4613-A844-CE69FCCAAE91}: C:\Program Files\Internet Saving Optimizer\3.4.0.4340\FF [2009/07/29 23:09:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/27 13:14:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/06/27 13:14:09 | 000,000,000 | —D | M]

[2008/07/01 14:30:42 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\Mozilla\Extensions
[2010/07/01 00:16:05 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\Mozilla\Firefox\Profiles\4ycsm45b.default\extensions
[2010/05/08 11:36:03 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\kpassina\Application Data\Mozilla\Firefox\Profiles\4ycsm45b.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/25 23:29:41 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\kpassina\Application Data\Mozilla\Firefox\Profiles\4ycsm45b.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/07/01 00:15:59 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/04/21 19:01:14 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2006/05/16 04:50:00 | 000,053,355 | —- | M] (Oracle Corporation) – C:\Program Files\Mozilla Firefox\plugins\NPJinit13126.dll

O1 HOSTS File: ([2001/08/23 08:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (no name) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - No CLSID value found.
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [Backup Reminder] C:\Program Files\Northern Michigan University\Backup Reminder\BackupReminder.exe (Northern Michigan University)
O4 - HKLM..\Run: [BLOG] C:\Program Files\ThinkPad\Utilities\BATLOGEX.DLL ()
O4 - HKLM..\Run: [EZEJMNAP] C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE (Lenovo Group Ltd.)
O4 - HKLM..\Run: [FaxCenterServer] C:\Program Files\Lexmark Fax Solutions\fm3032.exe ()
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [LPMailChecker] C:\Program Files\ThinkVantage\PrdCtr\LPMLCHK.EXE (Lenovo Group Limited)
O4 - HKLM..\Run: [LPManager] C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE (Lenovo Group Limited)
O4 - HKLM..\Run: [LXCCCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.DLL ()
O4 - HKLM..\Run: [lxccmon.exe] C:\Program Files\Lexmark 3300 Series\lxccmon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [PWRMGRTR] C:\Program Files\ThinkPad\Utilities\PWRMGRTR.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TPFNF7] C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TpShocks] C:\WINDOWS\System32\TpShocks.exe (Lenovo.)
O4 - HKLM..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Advanced SystemCare 3] C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe (IObit)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software )
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Intel Wireless Reporting Tool.lnk = C:\Program Files\Intel\WRT\WRT Tray.exe (Intel Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogOff = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\ie_banner_deny.htm ()
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.)
O9 - Extra Button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\SCIEPlgn.dll (Kaspersky Lab)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: nmu.edu ([cognosbi] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([download] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([ftp] ftp in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([my] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([my] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([myuser] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([myuser] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([schedule] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([webct] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([webct] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([www] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([www.acs] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([www.acs] https in Local intranet)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1200669642687 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1267071389750 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFECAFE-0013-0001-0026-ABCDEFABCDEF} Reg Error: Value error. (JInitiator 1.3.1.26)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.161,93.188.166.192
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1.0FO\adialhk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\adialhk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O20 - Winlogon\Notify\tpfnf2: DllName - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll ()
O20 - Winlogon\Notify\tphotkey: DllName - C:\Program Files\Lenovo\HOTKEY\tphklock.dll - C:\Program Files\Lenovo\HOTKEY\tphklock.dll (Lenovo Group Limited)
O24 - Desktop WallPaper: C:\Documents and Settings\kpassina\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\kpassina\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/01/17 15:41:14 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{4a0db8ed-26bd-11de-be56-444553544200}\Shell\AutoRun\command - "" = E:\JDSecure\Windows\JDSecure20.exe – File not found
O33 - MountPoints2\{ca310748-289e-11de-be58-444553544200}\Shell\AutoRun\command - "" = E:\.\EncryptionTool\MaxtorEncryption.exe – File not found
O33 - MountPoints2\{d04c59aa-d7a2-11de-bf6c-444553544200}\Shell - "" = AutoRun
O33 - MountPoints2\{d04c59aa-d7a2-11de-bf6c-444553544200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d04c59aa-d7a2-11de-bf6c-444553544200}\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found
O33 - MountPoints2\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\Shell - "" = AutoRun
O33 - MountPoints2\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/07/01 22:26:27 | 000,574,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\kpassina\Desktop\OTL.exe
[2010/07/01 18:19:17 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\kpassina\Desktop\HiJackThis.exe
[2010/06/28 23:05:46 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Desktop\Misc. WORD
[2010/06/28 22:00:42 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Application Data\IObit
[2010/06/28 22:00:41 | 000,000,000 | —D | C] – C:\Program Files\IObit
[2010/06/28 21:59:02 | 000,000,000 | RH-D | C] – C:\Documents and Settings\kpassina\Recent
[2010/06/28 21:53:49 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/06/28 21:53:35 | 001,154,616 | —- | C] (Piriform Ltd) – C:\Documents and Settings\kpassina\Desktop\ccsetup233_slim.exe
[2010/06/28 21:53:07 | 007,505,152 | —- | C] (IObit ) – C:\Documents and Settings\kpassina\Desktop\asc-setup-mj.exe
[2010/06/26 17:02:21 | 000,000,000 | —D | C] – C:\Program Files\Google
[2010/06/26 17:02:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Google
[2010/06/26 13:05:11 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2010/06/26 00:35:15 | 000,000,000 | —D | C] – C:\Program Files\NOS
[2010/06/25 22:34:08 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Local Settings\Application Data\Temp
[2010/06/25 22:33:14 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Local Settings\Application Data\Deployment
[2010/06/09 22:07:39 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010/06/06 19:10:10 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Desktop\You Tube
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/01 22:26:53 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\kpassina\Desktop\OTL.exe
[2010/07/01 22:26:31 | 003,662,880 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox2.dat
[2010/07/01 22:25:24 | 073,627,936 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox.dat
[2010/07/01 22:16:50 | 000,000,152 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Munising Weather.URL
[2010/07/01 21:19:38 | 000,004,767 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Bing.url
[2010/07/01 20:39:28 | 000,010,965 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\7-1-10 Computer Problem Outline.docx
[2010/07/01 20:38:30 | 000,002,533 | —- | M] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007 (2).lnk
[2010/07/01 20:15:45 | 000,000,260 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Ask.com.url
[2010/07/01 19:05:21 | 000,000,497 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Hotmail.url
[2010/07/01 19:03:36 | 000,000,286 | -H– | M] () – C:\WINDOWS\tasks\f94934ba.job
[2010/07/01 19:03:03 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/07/01 19:01:08 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/01 18:59:33 | 000,000,316 | —- | M] () – C:\WINDOWS\tasks\PMTask.job
[2010/07/01 18:58:40 | 000,044,544 | —- | M] () – C:\WINDOWS\System32\ernel32.dll
[2010/07/01 18:58:16 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/01 18:58:14 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/01 18:58:11 | 1063,702,528 | -HS- | M] () – C:\hiberfil.sys
[2010/07/01 18:56:41 | 004,718,592 | -H– | M] () – C:\Documents and Settings\kpassina\NTUSER.DAT
[2010/07/01 18:56:41 | 000,986,840 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox.idx
[2010/07/01 18:56:41 | 000,346,076 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox2.idx
[2010/07/01 18:56:14 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\kpassina\ntuser.ini
[2010/07/01 18:55:48 | 012,822,738 | -H– | M] () – C:\Documents and Settings\kpassina\Local Settings\Application Data\IconCache.db
[2010/07/01 18:19:25 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\kpassina\Desktop\HiJackThis.exe
[2010/07/01 17:42:58 | 000,002,465 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\MSNBC.com.url
[2010/06/30 19:15:01 | 000,000,211 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Google.url
[2010/06/30 15:31:59 | 000,000,575 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\YouTube.url
[2010/06/30 15:08:39 | 000,000,100 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\CNN News.URL
[2010/06/30 14:56:15 | 000,000,231 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\NASCAR.url
[2010/06/29 11:57:25 | 000,000,143 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Login Facebook.URL
[2010/06/28 22:26:38 | 000,000,660 | —- | M] () – C:\WINDOWS\win.ini
[2010/06/28 22:26:38 | 000,000,235 | RHS- | M] () – C:\boot.ini
[2010/06/28 22:26:38 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/06/28 22:14:03 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/06/28 22:00:51 | 000,000,892 | —- | M] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced SystemCare.lnk
[2010/06/28 22:00:51 | 000,000,874 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Advanced SystemCare.lnk
[2010/06/28 22:00:51 | 000,000,156 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\IObit Freeware.url
[2010/06/28 21:46:44 | 001,154,616 | —- | M] (Piriform Ltd) – C:\Documents and Settings\kpassina\Desktop\ccsetup233_slim.exe
[2010/06/28 21:45:46 | 007,505,152 | —- | M] (IObit ) – C:\Documents and Settings\kpassina\Desktop\asc-setup-mj.exe
[2010/06/27 18:14:49 | 000,000,134 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\TV6.URL
[2010/06/27 13:14:20 | 000,001,620 | —- | M] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/06/27 13:14:20 | 000,001,602 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/06/26 14:52:19 | 000,000,342 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Munising Radar.url
[2010/06/24 17:05:23 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/23 19:02:58 | 000,000,223 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\TIME.url
[2010/06/23 19:02:50 | 000,493,082 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/23 19:02:50 | 000,435,828 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/23 19:02:50 | 000,068,558 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\Documents and Settings\kpassina\Application Data\f94934ba.exe
[2010/06/16 11:35:48 | 000,000,298 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Plover Weather.url
[2010/06/10 12:00:50 | 000,266,208 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/01 18:14:37 | 000,010,965 | —- | C] () – C:\Documents and Settings\kpassina\Desktop\7-1-10 Computer Problem Outline.docx
[2010/06/30 18:44:37 | 000,000,211 | —- | C] () – C:\Documents and Settings\kpassina\Desktop\Google.url
[2010/06/28 22:26:32 | 000,001,618 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
[2010/06/28 22:26:32 | 000,000,737 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Intel Wireless Reporting Tool.lnk
[2010/06/28 22:21:44 | 000,044,544 | —- | C] () – C:\WINDOWS\System32\ernel32.dll
[2010/06/28 22:00:51 | 000,000,892 | —- | C] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced SystemCare.lnk
[2010/06/28 22:00:51 | 000,000,874 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Advanced SystemCare.lnk
[2010/06/28 22:00:51 | 000,000,156 | —- | C] () – C:\Documents and Settings\kpassina\Desktop\IObit Freeware.url
[2010/06/26 18:48:29 | 000,001,620 | —- | C] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/06/26 18:48:29 | 000,001,602 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/06/24 17:05:23 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/21 19:51:36 | 000,000,286 | -H– | C] () – C:\WINDOWS\tasks\f94934ba.job
[2010/06/21 19:51:34 | 000,044,544 | —- | C] () – C:\Documents and Settings\kpassina\Application Data\f94934ba.exe
[2009/06/26 23:43:11 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\LXPRMON.DLL
[2009/06/26 23:43:11 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\LXPMONUI.DLL
[2009/06/26 23:39:42 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxccvs.dll
[2008/07/16 09:52:04 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2008/07/01 13:31:37 | 000,000,026 | —- | C] () – C:\WINDOWS\Lidbeep.ini
[2008/03/26 14:52:57 | 000,000,059 | —- | C] () – C:\WINDOWS\WININIT.INI
[2008/03/11 10:45:13 | 000,036,962 | —- | C] () – C:\WINDOWS\System32\ActPanel.dll
[2008/03/11 10:06:08 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2008/03/11 10:06:08 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2008/03/11 10:06:08 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2008/03/11 10:06:08 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2008/03/11 10:06:08 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2008/03/11 10:06:08 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2008/03/10 13:50:34 | 000,009,343 | —- | C] () – C:\WINDOWS\System32\drivers\TDSMAPI.SYS
[2008/03/10 13:47:14 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\drivers\TSMAPIP.SYS
[2008/03/10 13:42:36 | 000,004,442 | —- | C] () – C:\WINDOWS\System32\drivers\TPPWRIF.SYS
[2008/03/10 13:37:26 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\SynTPCoI.dll
[2008/03/10 12:31:12 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4860.dll
[2007/12/14 16:12:14 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\DEVMAN.DLL
[2006/01/26 15:42:26 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/04 00:56:44 | 000,755,200 | —- | C] () – C:\WINDOWS\System32\ir50_32.dll
[2004/08/04 00:56:44 | 000,338,432 | —- | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2004/08/04 00:56:44 | 000,200,192 | —- | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2004/08/04 00:56:44 | 000,183,808 | —- | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2004/08/04 00:56:44 | 000,120,320 | —- | C] () – C:\WINDOWS\System32\ir41_qc.dll

========== LOP Check ==========

[2008/03/26 14:46:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Lenovo
[2009/04/14 15:32:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Seagate
[2009/04/14 00:30:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/09/16 13:51:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/11 14:47:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/04/14 00:28:21 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\3M
[2009/04/14 00:27:44 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\GetRightToGo
[2008/03/11 10:06:52 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\InterVideo
[2010/06/28 22:00:42 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\IObit
[2008/03/26 14:48:04 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\Lenovo
[2009/12/12 18:17:01 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\Opera
[2008/03/11 11:16:59 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\QcWizard
[2010/05/13 22:11:00 | 000,000,442 | —- | M] () – C:\WINDOWS\Tasks\EasyShare Registration Task.job
[2010/07/01 19:03:36 | 000,000,286 | -H– | M] () – C:\WINDOWS\Tasks\f94934ba.job
[2010/07/01 19:03:03 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/07/01 18:59:33 | 000,000,316 | —- | M] () – C:\WINDOWS\Tasks\PMTask.job

========== Purity Check ==========

========== Custom Scans ==========

< netsvcs >

< drivers32 /all >
Invalid Switch: all

< %SYSTEMDRIVE%\*.* >
[2010/05/06 12:59:10 | 000,001,024 | —- | M] () – C:\.rnd
[2008/01/17 15:41:14 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/06/28 22:26:38 | 000,000,235 | RHS- | M] () – C:\boot.ini
[2008/01/17 15:41:14 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/07/01 18:58:11 | 1063,702,528 | -HS- | M] () – C:\hiberfil.sys
[2008/01/17 15:41:14 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/05/01 16:32:49 | 000,002,556 | —- | M] () – C:\logfile
[2010/07/01 19:00:26 | 000,000,528 | —- | M] () – C:\lxcc.log
[2009/04/11 15:36:19 | 000,000,000 | —- | M] () – C:\lxccfire.000
[2009/06/26 23:39:12 | 000,000,000 | —- | M] () – C:\lxccfire.csv
[2009/04/11 15:37:27 | 000,000,291 | —- | M] () – C:\LXCCINST.000
[2009/06/26 23:40:05 | 000,000,291 | —- | M] () – C:\LXCCINST.csv
[2010/07/01 21:46:31 | 000,005,670 | —- | M] () – C:\lxccscan.log
[2009/05/23 22:38:29 | 001,061,910 | —- | M] () – C:\lxccUNST.csv
[2008/01/17 15:41:14 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2009/11/03 17:38:14 | 000,002,854 | —- | M] () – C:\nagent_log.txt
[2004/08/04 07:00:00 | 000,047,564 | RHS- | M] () – C:\ntdetect.com
[2004/08/03 22:59:34 | 000,250,032 | RHS- | M] () – C:\ntldr
[2010/07/01 18:58:09 | 1598,029,824 | -HS- | M] () – C:\pagefile.sys
[2004/08/04 07:00:00 | 000,260,272 | RHS- | M] () – C:\peldr
[2010/07/01 19:07:47 | 000,451,981 | —- | M] () – C:\sysiclog.txt
[2004/08/04 07:00:00 | 000,000,010 | —- | M] () – C:\WIN51
[2004/08/04 07:00:00 | 000,000,010 | —- | M] () – C:\WIN51IP
[2004/08/04 07:00:00 | 000,000,010 | —- | M] () – C:\WIN51IP.SP2

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\A1kUO1oC.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\C5s5e.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\cE555.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\e55k5.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\E79kU7.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\E93kUOC.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\eIQ9w179.dll
[2008/07/06 08:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\G3iQ9wSK9.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\G93a79e.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\gM7g3179.dll
[2007/02/13 20:22:00 | 000,286,208 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp4wm.DLL
[2007/03/02 18:23:38 | 000,235,520 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp5in.DLL
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\IQG793kUO.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\iQGM3179.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\iQGMY.dll
[2005/01/04 17:22:28 | 000,073,728 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\lxccPP5C.DLL
[2006/10/26 19:58:12 | 000,030,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\mY9317.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\O17mY17o.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\O1o93mYW.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\o79mY7.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\O9oC7sK.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\oCE7931sK.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\QG3i7qG.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\SK793179.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\sKU7m3g79.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\u55i5.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\Y7cE1a.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\yWSKUO1oC.dll

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\*. /mp /s >

< CREATERESTOREPOINT >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/03/08 04:31:44 | 000,348,160 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtmsft.dll
[2009/03/08 04:31:38 | 000,216,064 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtrans.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008/01/17 10:28:48 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2008/01/17 10:28:48 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2008/01/17 10:28:48 | 000,892,928 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2007/03/08 11:36:28 | 000,577,536 | —- | M] (Microsoft Corporation) MD5=B409909F6E2E8A7067076ED748ABF1E7 – C:\WINDOWS\system32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2004/08/04 00:56:48 | 000,082,944 | —- | M] (Microsoft Corporation) MD5=2ED0B7F12A60F90092081C50FA0EC2B2 – C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2004/08/04 00:56:48 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=9BEACB911CA61E5881102188AB7FB431 – C:\WINDOWS\system32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"NoAutoUpdate" = 0
"AUOptions" = 4
"ScheduledInstallDay" = 0
"ScheduledInstallTime" = 18
"UseWUServer" = 1
"AutoInstallMinorUpdates" = 1
"DetectionFrequency" = 22
"DetectionFrequencyEnabled" = 0
"NoAutoRebootWithLoggedOnUsers" = 1
"RebootRelaunchTimeout" = 5
"RebootRelaunchTimeoutEnabled" = 0
"RebootWarningTimeout" = 5
"RebootWarningTimeoutEnabled" = 0
"RescheduleWaitTime" = 5
"RescheduleWaitTimeEnabled" = 1

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-06-29 15:59:46

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 843 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:35E5AF34

< End of report >

SweetTech

Post #6July 2, 2010, 3:08 AM UTC

Do you have the GMER log?

jpassinault

Post #7July 2, 2010, 3:11 AM UTC

1. No new questions yet. 2. OTL scan was sent first. 3. Gmer scar was sent on second post. $. Still hard to manuever around the internet. I usually have to click an icon several times. Sometimes it loads and sometimes it doesn't. I really appreciate all your help Jon

SweetTech

Post #8July 2, 2010, 3:16 AM UTC

Okay. You posted the OTL log twice. Not too worry we will proceed on.

OTL Fix

We need to run an OTL Fix

Please reopen [external image: Posted Image] on your desktop.

Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

:Services
:OTL
SRV - File not found [Unknown | Stopped] – – (McComponentHostService)
O2 - BHO: (no name) - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - No CLSID value found.
O2 - BHO: (no name) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - No CLSID value found.
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.161,93.188.166.192
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O33 - MountPoints2\{4a0db8ed-26bd-11de-be56-444553544200}\Shell\AutoRun\command - "" = E:\JDSecure\Windows\JDSecure20.exe – File not found
O33 - MountPoints2\{ca310748-289e-11de-be58-444553544200}\Shell\AutoRun\command - "" = E:\.\EncryptionTool\MaxtorEncryption.exe – File not found
O33 - MountPoints2\{d04c59aa-d7a2-11de-bf6c-444553544200}\Shell - "" = AutoRun
O33 - MountPoints2\{d04c59aa-d7a2-11de-bf6c-444553544200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d04c59aa-d7a2-11de-bf6c-444553544200}\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found
O33 - MountPoints2\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\Shell - "" = AutoRun
O33 - MountPoints2\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found
[2010/07/01 19:03:36 | 000,000,286 | -H– | M] () – C:\WINDOWS\tasks\f94934ba.job
[2010/07/01 18:59:33 | 000,000,316 | —- | M] () – C:\WINDOWS\tasks\PMTask.job
[2010/07/01 18:58:40 | 000,044,544 | —- | M] () – C:\WINDOWS\System32\ernel32.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\Documents and Settings\kpassina\Application Data\f94934ba.exe
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\A1kUO1oC.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\C5s5e.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\cE555.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\e55k5.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\E79kU7.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\E93kUOC.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\eIQ9w179.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\G3iQ9wSK9.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\G93a79e.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\gM7g3179.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\IQG793kUO.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\iQGM3179.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\iQGMY.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\mY9317.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\O17mY17o.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\O1o93mYW.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\o79mY7.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\O9oC7sK.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\oCE7931sK.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\QG3i7qG.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\SK793179.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\sKU7m3g79.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\u55i5.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\Y7cE1a.dll
[2010/06/21 19:51:33 | 000,044,544 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\yWSKUO1oC.dll
@Alternate Data Stream - 843 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:35E5AF34
:Files
flushdns /c
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[start explorer]
[Reboot]

Push [external image: Posted Image]
OTL may ask to reboot the machine. Please do so if asked.
Click [external image: Posted Image].
A report will open. Copy and Paste that report in your next reply.
If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:

Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

NEXT:

Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. The log that is produced after running the OTL Fix.
3. The log that is produced after running the ComboFix scan.
4. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

jpassinault

Post #9July 2, 2010, 3:40 AM UTC

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Error: No service named McComponentHostService was found to stop!
Service\Driver key McComponentHostService not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35B8D58C-B0CB-46b0-BA64-05B3804E4E86}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35B8D58C-B0CB-46b0-BA64-05B3804E4E86}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\\NameServer| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype-ie-addon-data\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91774881-D725-4E58-B298-07617B9B86A8}\ not found.
File {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4a0db8ed-26bd-11de-be56-444553544200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a0db8ed-26bd-11de-be56-444553544200}\ not found.
File E:\JDSecure\Windows\JDSecure20.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ca310748-289e-11de-be58-444553544200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ca310748-289e-11de-be58-444553544200}\ not found.
File E:\.\EncryptionTool\MaxtorEncryption.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d04c59aa-d7a2-11de-bf6c-444553544200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d04c59aa-d7a2-11de-bf6c-444553544200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d04c59aa-d7a2-11de-bf6c-444553544200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d04c59aa-d7a2-11de-bf6c-444553544200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d04c59aa-d7a2-11de-bf6c-444553544200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d04c59aa-d7a2-11de-bf6c-444553544200}\ not found.
File E:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed7e41d4-c5ca-11dc-8d0e-f717f01bab21}\ not found.
File E:\LaunchU3.exe not found.
C:\WINDOWS\tasks\f94934ba.job moved successfully.
C:\WINDOWS\tasks\PMTask.job moved successfully.
C:\WINDOWS\system32\ernel32.dll moved successfully.
C:\Documents and Settings\kpassina\Application Data\f94934ba.exe moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\A1kUO1oC.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\C5s5e.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\cE555.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\e55k5.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\E79kU7.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\E93kUOC.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\eIQ9w179.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\G3iQ9wSK9.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\G93a79e.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\gM7g3179.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\IQG793kUO.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\iQGM3179.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\iQGMY.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\mY9317.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\O17mY17o.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\O1o93mYW.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\o79mY7.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\O9oC7sK.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\oCE7931sK.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\QG3i7qG.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\SK793179.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\sKU7m3g79.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\u55i5.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\Y7cE1a.dll moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\yWSKUO1oC.dll moved successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:35E5AF34 deleted successfully.
========== FILES ==========
< flushdns /c >
C:\Documents and Settings\kpassina\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\kpassina\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 327814 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 3140989 bytes
->Flash cache emptied: 405 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 327814 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 3140989 bytes
->Flash cache emptied: 405 bytes

User: kpassina
->Temp folder emptied: 484365 bytes
->Temporary Internet Files folder emptied: 5022035 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 35688177 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 889 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 1477140 bytes

User: NetworkService
->Temp folder emptied: 72716 bytes
->Temporary Internet Files folder emptied: 799663 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2142714 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 27056 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 77452146 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 124.00 mb

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: kpassina
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.7.0 log created on 07012010_232524

jpassinault

Post #10July 2, 2010, 3:45 AM UTC

Combofix "has encountered a problem and has to shut down". I tried it several times after I shut off my virus protection. Should I still be connected to the internet? Thanks

SweetTech

Post #11July 2, 2010, 3:54 AM UTC

Hello,

Please try running ComboFix as instructed below:

Download this version of combofix

Please download ComboFix from: Here to your Desktop.

**Note:**In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Tools->Options->Main tab
- Set to "Always ask me where to Save the files".
During the download, rename Combofix to the name provided in the image below:

[external image: Posted Image]
It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
- Close any open browsers.
Double click on the renamed version of ComboFix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the ComboFix log which can be found in the root drive (usually the C: Drive) for further review.

**Note: Do not mouseclick ComboFix's window while it's running. That may cause it to stall**

jpassinault

Post #12July 2, 2010, 4:25 AM UTC

ComboFix 10-07-01.02 - jpassinault 07/01/2010 23:58:32.1.1 - x86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\kpassina\Local Settings\Application Data\DoubleD
c:\program files\Internet Saving Optimizer
c:\program files\Internet Saving Optimizer\3.4.0.4340\adwpx.exe
c:\program files\Internet Saving Optimizer\3.4.0.4340\Data\config.md
c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\chrome.manifest
c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\chrome\content\NPAddOn.js
c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\chrome\content\NPAddOn.xul
c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\chrome\NPAddOn.jar
c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\components\NPFFAddOn.dll
c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\components\NPFFAddOn.xpt
c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\components\NPFFHelperComponent.js
c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\install.rdf
c:\program files\Internet Saving Optimizer\3.4.0.4340\NPCommon.dll
c:\program files\Internet Saving Optimizer\3.4.0.4340\unins000.dat
c:\program files\Internet Saving Optimizer\3.4.0.4340\unins000.exe
c:\windows\system\oeminfo.ini
c:\windows\system32\spool\prtprocs\w32x86\W17yW17y.dll

—– BITS: Possible infected sites —–

hxxp://wsus.nmu.edu
.
((((((((((((((((((((((((( Files Created from 2010-06-02 to 2010-07-02 )))))))))))))))))))))))))))))))
.

2010-07-02 03:25 . 2010-07-02 03:25 ——– d—–w- C:\_OTL
2010-06-29 02:00 . 2010-06-29 02:00 ——– d—–w- c:\documents and settings\kpassina\Application Data\IObit
2010-06-29 02:00 . 2010-06-29 02:00 ——– d—–w- c:\program files\IObit
2010-06-29 01:53 . 2010-06-29 01:56 ——– d—–w- c:\program files\CCleaner
2010-06-26 21:02 . 2010-06-26 21:02 ——– d—–w- c:\program files\Google
2010-06-26 17:05 . 2010-06-26 17:05 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2010-06-26 04:35 . 2010-06-26 04:35 ——– d—–w- c:\program files\NOS
2010-06-26 02:34 . 2010-06-26 02:35 ——– d—–w- c:\documents and settings\kpassina\Local Settings\Application Data\Temp
2010-06-26 02:33 . 2010-06-26 02:33 ——– d—–w- c:\documents and settings\kpassina\Local Settings\Application Data\Deployment
2010-06-24 21:05 . 2010-06-24 21:05 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-06-10 02:07 . 2010-05-06 10:41 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-02 04:14 . 2008-03-26 18:56 73780256 –sha-w- c:\windows\system32\drivers\fidbox.dat
2010-07-02 04:14 . 2008-03-26 18:56 3666976 –sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-07-02 04:13 . 2009-05-21 04:57 ——– d—–w- c:\documents and settings\kpassina\Application Data\Skype
2010-07-02 04:07 . 2008-03-26 18:56 990080 –sha-w- c:\windows\system32\drivers\fidbox.idx
2010-07-02 04:07 . 2008-03-26 18:56 346820 –sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-07-02 04:00 . 2009-05-21 04:59 ——– d—–w- c:\documents and settings\kpassina\Application Data\skypePM
2010-07-02 03:30 . 2008-03-26 18:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-07-01 21:47 . 2009-11-22 23:29 ——– d—–w- c:\documents and settings\kpassina\Application Data\U3
2010-06-29 17:09 . 2009-04-11 19:38 ——– d—–w- c:\program files\Lx_cats
2010-06-29 02:05 . 2008-03-11 14:46 ——– d—–w- c:\program files\Ruckus Player
2010-06-29 02:05 . 2008-03-10 18:03 ——– d—–w- c:\program files\Common Files\Lenovo
2010-06-26 21:32 . 2009-04-11 19:43 ——– d—–w- c:\program files\Abbyy FineReader 6.0 Sprint
2010-06-26 21:06 . 2009-05-15 00:32 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-06-10 17:42 . 2008-03-10 19:42 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-06-09 08:06 . 2010-06-09 08:06 976832 —-a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\24619\AdobeARM.exe
2010-06-09 08:06 . 2010-06-09 08:06 70584 —-a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\24619\AdobeExtractFiles.dll
2010-06-09 08:06 . 2010-06-09 08:06 331176 —-a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\24619\ReaderUpdater.exe
2010-06-09 08:06 . 2010-06-09 08:06 331176 —-a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\24619\AcrobatUpdater.exe
2010-05-27 19:06 . 2010-05-27 19:06 61440 —-a-w- c:\documents and settings\kpassina\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7e3b44ec-n\decora-sse.dll
2010-05-27 19:06 . 2010-05-27 19:06 503808 —-a-w- c:\documents and settings\kpassina\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-542b1bff-n\msvcp71.dll
2010-05-27 19:06 . 2010-05-27 19:06 499712 —-a-w- c:\documents and settings\kpassina\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-542b1bff-n\jmc.dll
2010-05-27 19:06 . 2010-05-27 19:06 348160 —-a-w- c:\documents and settings\kpassina\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-542b1bff-n\msvcr71.dll
2010-05-27 19:06 . 2010-05-27 19:06 12800 —-a-w- c:\documents and settings\kpassina\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7e3b44ec-n\decora-d3d.dll
2010-05-21 18:14 . 2009-10-03 16:23 221568 ——w- c:\windows\system32\MpSigStub.exe
2010-05-06 17:58 . 2010-05-06 17:57 ——– d—–w- c:\program files\QuickTime
2010-05-06 10:41 . 2004-08-04 04:56 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-05 22:02 . 2008-03-26 18:56 97549 —-a-w- c:\windows\system32\drivers\klick.dat
2010-05-05 22:02 . 2008-03-26 18:56 113933 —-a-w- c:\windows\system32\drivers\klin.dat
2010-05-02 05:56 . 2004-08-04 03:17 1850880 ——w- c:\windows\system32\win32k.sys
2010-04-21 23:02 . 2010-04-21 23:02 503808 —-a-w- c:\documents and settings\kpassina\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7fbd1049-n\msvcp71.dll
2010-04-21 23:02 . 2010-04-21 23:02 499712 —-a-w- c:\documents and settings\kpassina\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7fbd1049-n\jmc.dll
2010-04-21 23:02 . 2010-04-21 23:02 348160 —-a-w- c:\documents and settings\kpassina\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7fbd1049-n\msvcr71.dll
2010-04-21 23:02 . 2010-04-21 23:02 61440 —-a-w- c:\documents and settings\kpassina\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5860737c-n\decora-sse.dll
2010-04-21 23:02 . 2010-04-21 23:02 12800 —-a-w- c:\documents and settings\kpassina\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5860737c-n\decora-d3d.dll
2010-04-20 05:51 . 2004-08-04 04:56 285696 —-a-w- c:\windows\system32\atmfd.dll
2010-04-12 21:29 . 2010-04-21 23:01 411368 —-a-w- c:\windows\system32\deployJava1.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-26 39408]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-04-06 26102056]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2010-05-26 2346192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LXCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll" [2005-01-10 69632]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2007-12-05 487424]
"TpShocks"="TpShocks.exe" [2007-11-22 181536]
"TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2008-01-24 66928]
"TPFNF7"="c:\program files\Lenovo\NPDIRECT\TPFNF7SP.exe" [2007-12-20 60704]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2007-12-05 122880]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-05 524288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2008-01-11 294912]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-15 137752]
"lxccmon.exe"="c:\program files\Lexmark 3300 Series\lxccmon.exe" [2005-02-21 192512]
"LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2008-01-11 144728]
"LPMailChecker"="c:\progra~1\THINKV~1\PrdCtr\LPMLCHK.exe" [2008-01-11 124248]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-10-08 995328]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-10-08 1101824]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-15 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-15 162328]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2005-01-20 299008]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2007-04-27 243248]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2008-01-11 208896]
"Backup Reminder"="c:\program files\Northern Michigan University\Backup Reminder\BackupReminder.exe" [2007-02-22 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-3-26 50688]
Intel Wireless Reporting Tool.lnk - c:\program files\Intel\WRT\WRT Tray.exe [2008-2-28 266240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2006-09-06 20:37 34344 ——w- c:\program files\Lenovo\HOTKEY\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2007-12-14 20:36 28672 ——w- c:\program files\Lenovo\HOTKEY\tphklock.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\Nortel Networks\\Extranet.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\WINDOWS\\system32\\lxcccoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxccPSWX.EXE"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15000:UDP"= 15000:UDP:Kaspersky Administration Kit
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

R2 spm;System Profile Monitor;c:\windows\spm.exe [2007-07-02 40960]
R3 DisplayLinkUsbPort;DisplayLink USB Device;c:\windows\system32\DRIVERS\DisplayLinkUsbPort.sys [2007-11-26 20992]
R3 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\system32\DRIVERS\ipsecw2k.sys [2007-04-18 155152]
R3 WAM;WAM;c:\program files\Lenovo\Rescue and Recovery\WAM.sys [2010-01-14 5760]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM86.sys [2007-10-16 19504]
S1 tvtumon;tvtumon;c:\windows\system32\DRIVERS\tvtumon.sys [2008-07-11 46144]
S2 DisplayLinkService;DisplayLink Service;c:\program files\DisplayLink Core Software\DisplayLinkService.exe [2008-03-12 439656]
S2 klnagent;Kaspersky Network Agent;c:\program files\Kaspersky Lab\NetworkAgent\klnagent.exe [2008-03-17 94608]
S2 nmuebs;NMU Emergency Broadcast System;c:\program files\Northern Michigan University\Emergency Broadcast System\nmuebs.exe [2008-06-11 22528]
S2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [2007-12-05 520192]
S2 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [2008-10-09 360448]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 DisplayLinkGA;DisplayLinkGA;c:\windows\system32\DRIVERS\DisplayLinkGAport.sys [2007-03-09 25704]
S3 DisplayLinkmirror;DisplayLinkmirror;c:\windows\system32\DRIVERS\DisplayLinkmirrorport.sys [2007-03-09 23400]
S3 Eacfilt;Eacfilt Miniport;c:\windows\system32\DRIVERS\eacfilt.sys [2007-04-18 26137]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-05-30 24344]
S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\DRIVERS\Tvti2c.sys [2007-05-22 30336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-07-02 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 22:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://login.live.com/login.srf?wa=wsignin1.0&rpsnv=10&ct=1242881400&rver=5.5.4177.0&wp=MBI&wreply=http:%2F%2Fmail.live.com%2Fdefault.aspx&lc=1033&id=64855&mkt=en-US
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\kpassina\Application Data\Mozilla\Firefox\Profiles\4ycsm45b.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.acs.nmu.edu/home
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJinit13126.dll
FF - plugin: c:\program files\Opera\program\plugins\np_gp.dll
FF - plugin: c:\program files\Opera\program\plugins\np_gp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
MSConfigStartUp-Shockwave Updater - c:\windows\system32\Adobe\SHOCKW~1\SWHELP~1.EXE
AddRemove-{1FB52AB3-5987-45a2-85E0-F3EC30DDDC29}}_is1 - c:\program files\Internet Saving Optimizer\3.4.0.4340\unins000.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-02 00:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1936)
c:\windows\system32\klogon.dll
c:\program files\Lenovo\HOTKEY\tphklock.dll

- - - - - - - > 'explorer.exe'(3952)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\netprovcredman.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
c:\windows\System32\TPHDEXLG.exe
c:\program files\Common Files\Lenovo\Scheduler\tvtsched.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Common Files\Lenovo\Logger\logmon.exe
c:\program files\DisplayLink Core Software\DisplayLinkManager.exe
c:\program files\DisplayLink Core Software\DisplayLinkUI.exe
c:\windows\system32\TpShocks.exe
c:\windows\system32\rundll32.exe
c:\program files\Lenovo\HOTKEY\TPONSCR.exe
c:\windows\system32\igfxsrvc.exe

c:\program files\Lenovo\Zoom\TpScrex.exe
c:\windows\system32\lxcccoms.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2010-07-02 00:20:16 - machine was rebooted
ComboFix-quarantined-files.txt 2010-07-02 04:20

Pre-Run: 32,616,542,208 bytes free
Post-Run: 32,454,238,208 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=3 Sets=1,3
- - End Of File - - D6C923DE28CE4AE10AAFE7E72A1C967A

jpassinault

Post #13July 2, 2010, 4:28 AM UTC

It seems to be working fine. I can get to the sites I wasn't able to before. You're amazing. Thank you so much!

SweetTech

Post #14July 2, 2010, 4:28 AM UTC

Hello,

Scanning with MalwareBytes' Anti-Malware
Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT:

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the [external image: Posted Image] button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
- Double click on the [external image: Posted Image] icon on your desktop.
Check [external image: Posted Image]
Click the [external image: Posted Image] button.
Accept any security warnings from your browser.
Check [external image: Posted Image]
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push [external image: Posted Image]
Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the [external image: Posted Image] button.
Push [external image: Posted Image]

NEXT:

OTL Custom Scan

We need to run an OTL Custom Scan

Please reopen [external image: Posted Image] on your desktop.
Copy and Paste the following bolded text into the [external image: Posted Image] textbox.

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Push [external image: Posted Image]
A report will open. Copy and Paste that report in your next reply.

NEXT:

Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. The log that was produced after running the updated MalwareBytes' Anti-Malware scan.
3. The log that was produced after running the ESET Online Virus Scanner.
4. The log that was produced after running the OTL scan.
5. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

Cheers,
SweetTech.

jpassinault

Post #15July 2, 2010, 7:01 AM UTC

1. No new questions.
2.
Malware results

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4266

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

7/2/2010 1:06:15 AM
mbam-log-2010-07-02 (01-06-15).txt

Scan type: Quick scan
Objects scanned: 137465
Time elapsed: 7 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 29
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 8
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\aimactivexdll.aimhelper (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\aimactivexdll.aimhelper.1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\explorerbar.funexplorer (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\explorerbar.funexplorer.1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oeactivexdll.desktopbuttonhandler (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oeactivexdll.desktopbuttonhandler.1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oeactivexdll.desktopoeaddin1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oeactivexdll.desktopoeaddin1.1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3fb17508-0bf4-4fde-845a-323a1052957c} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{42c23154-00fa-4a93-9de9-3eb523cffff6} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{480098c6-f6ad-4c61-9b5c-2bae228a34d1} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{803e73fe-cb73-4d49-8aff-653fd6f44171} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{877f3eab-4462-44df-8475-6064eafd7fbf} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{57aba38e-6535-48f3-99fd-efdc62137c78} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{0514c9b0-e4c6-4d6b-a3a6-b38bc280b115} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c28a0312-c403-417b-a425-a915bc0519cd} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d335d84d-61d8-4b5f-9c4e-067dc8b27ed5} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\AIMActiveXDLL.dll (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Internet Saving Optimizer (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Media Access Startup (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\Addins\OEActiveXDLL.DesktopOEAddin1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Internet Saving Optimizer (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Media Access Startup (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{c5096216-7703-409e-b85a-8a6ee7395128}}_is1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Funband Serach (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Funband Serach (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\EBUNWVLUMV (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{2224e955-00e9-4613-a844-ce69fccaae91} (Adware.DoubleD) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\DoubleD (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\DoubleD\JuicyAccess Toolbar (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher\1.3.0.840 (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher\1.3.0.840\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Documents and Settings\kpassina\Local Settings\Application Data\Internet Saving Optimizer (Adware.DoubleD) -> Delete on reboot.
C:\Documents and Settings\kpassina\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340 (Adware.DoubleD) -> Delete on reboot.
C:\Documents and Settings\kpassina\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340 (Adware.DoubleD) -> Files: 1123 -> Delete on reboot.

Files Infected:
C:\Program Files\System Search Dispatcher\1.3.0.840\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher\1.3.0.840\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher\1.3.0.840\Data\eacore.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher\1.3.0.840\Data\URLDynamic.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher\1.3.0.840\Data\URLStatic.mx (Adware.DoubleD) -> Quarantined and deleted successfully.

3. ESET scan.
C:\nmutools\winupdates_reminder.exe probably a variant of Win32/TrojanClicker.Agent trojan
C:\Qoobox\Quarantine\C\Program Files\Internet Saving Optimizer\3.4.0.4340\adwpx.exe.vir Win32/Adware.DoubleD.AC application
C:\Qoobox\Quarantine\C\Program Files\Internet Saving Optimizer\3.4.0.4340\FF\components\NPFFAddOn.dll.vir a variant of Win32/Adware.DoubleD.AE application

4. OTL scan
OTL logfile created on: 7/2/2010 2:47:51 AM - Run 2
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\kpassina\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 171.00 Mb Available Physical Memory | 17.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 74.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 30.10 Gb Free Space | 40.38% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: kpassina-Y3PF08
Current User Name: jpassinault
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/07/01 22:26:53 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\kpassina\Desktop\OTL.exe
PRC - [2010/06/26 17:02:59 | 000,039,408 | —- | M] (Google Inc.) – C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2010/05/26 11:03:40 | 002,346,192 | —- | M] (IObit) – C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/06/11 14:20:07 | 000,022,528 | —- | M] (Northern Michigan University) – C:\Program Files\Northern Michigan University\Emergency Broadcast System\nmuebs.exe
PRC - [2008/03/17 18:19:56 | 000,094,608 | —- | M] (Kaspersky Lab) – C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe
PRC - [2008/03/12 17:08:10 | 000,451,944 | —- | M] (DisplayLink Corp.) – C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
PRC - [2008/03/12 17:08:08 | 004,359,528 | —- | M] (DisplayLink Corp.) – C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
PRC - [2008/03/12 17:08:08 | 000,439,656 | —- | M] (DisplayLink Corp.) – C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe
PRC - [2008/02/28 09:59:48 | 000,266,240 | —- | M] (Intel Corporation) – C:\Program Files\Intel\WRT\WRT Tray.exe
PRC - [2008/01/25 14:06:08 | 000,111,904 | —- | M] (Lenovo Group Limited) – C:\Program Files\Lenovo\ZOOM\TpScrex.exe
PRC - [2008/01/24 10:21:58 | 000,066,928 | —- | M] (Lenovo Group Limited) – C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
PRC - [2008/01/11 02:21:00 | 000,144,728 | —- | M] (Lenovo Group Limited) – C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE
PRC - [2008/01/11 02:21:00 | 000,124,248 | —- | M] (Lenovo Group Limited) – C:\Program Files\ThinkVantage\PrdCtr\LPMLCHK.EXE
PRC - [2007/12/20 04:04:10 | 000,060,704 | —- | M] (Lenovo Group Limited) – C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe
PRC - [2007/12/05 17:32:06 | 000,487,424 | —- | M] (Lenovo Group Limited) – C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
PRC - [2007/12/05 17:31:58 | 001,122,304 | —- | M] (Lenovo Group Limited) – C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
PRC - [2007/12/05 17:17:14 | 000,520,192 | —- | M] () – C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
PRC - [2007/12/05 17:09:48 | 000,022,016 | —- | M] () – C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
PRC - [2007/12/05 17:01:24 | 000,644,408 | —- | M] (Lenovo Group Limited) – C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
PRC - [2007/12/05 16:14:34 | 000,122,880 | —- | M] (Synaptics, Inc.) – C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2007/11/22 15:09:26 | 000,181,536 | —- | M] (Lenovo.) – C:\WINDOWS\system32\TpShocks.exe
PRC - [2007/11/21 18:38:38 | 000,075,040 | —- | M] (Lenovo Group Limited) – C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
PRC - [2007/11/02 15:51:02 | 000,036,136 | —- | M] (Lenovo) – C:\WINDOWS\system32\ibmpmsvc.exe
PRC - [2007/10/16 18:33:00 | 000,037,424 | —- | M] (Lenovo.) – C:\WINDOWS\system32\TPHDEXLG.exe
PRC - [2007/10/08 14:27:02 | 000,794,624 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
PRC - [2007/10/08 14:18:04 | 000,995,328 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
PRC - [2007/10/08 14:13:36 | 001,101,824 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
PRC - [2007/10/08 14:09:26 | 000,659,456 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
PRC - [2007/10/08 14:06:44 | 001,183,744 | —- | M] (Intel Corporation ) – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
PRC - [2007/10/08 14:01:54 | 000,483,328 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
PRC - [2007/06/13 06:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/04/27 03:33:00 | 000,243,248 | —- | M] (Lenovo Group Ltd.) – C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE
PRC - [2007/01/04 19:48:52 | 000,112,152 | R— | M] (InterVideo) – C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
PRC - [2006/11/03 18:20:12 | 000,866,584 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2006/11/03 18:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2006/11/03 18:02:14 | 000,050,688 | —- | M] (Avanquest Software ) – C:\Program Files\Digital Line Detect\DLG.exe
PRC - [2005/05/20 10:11:06 | 000,925,696 | —- | M] (Analog Devices, Inc.) – C:\Program Files\Analog Devices\Core\smax4pnp.exe
PRC - [2005/02/25 12:42:46 | 000,466,944 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\lxcccoms.exe
PRC - [2005/02/21 07:21:18 | 000,192,512 | —- | M] (Lexmark International, Inc.) – C:\Program Files\Lexmark 3300 Series\lxccmon.exe

========== Modules (SafeList) ==========

MOD - [2010/07/01 22:26:53 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\kpassina\Desktop\OTL.exe
MOD - [2007/12/05 16:14:30 | 000,065,536 | —- | M] (Synaptics, Inc.) – C:\WINDOWS\system32\SynTPFcs.dll
MOD - [2006/08/25 11:45:55 | 001,054,208 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
MOD - [2004/08/03 23:01:18 | 000,102,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - [2010/03/29 08:51:54 | 000,068,000 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files\NOS\bin\getPlus_Helper.dll – (getPlusHelper) getPlus®
SRV - [2009/04/10 23:30:18 | 000,231,952 | —- | M] (Kaspersky Lab) [Auto | Stopped] – C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe – (AVP)
SRV - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
SRV - [2008/10/09 17:05:16 | 000,360,448 | —- | M] (Lenovo Group Limited) [Auto | Stopped] – C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe – (TVT_UpdateMonitor)
SRV - [2008/06/11 14:20:07 | 000,022,528 | —- | M] (Northern Michigan University) [Auto | Running] – C:\Program Files\Northern Michigan University\Emergency Broadcast System\nmuebs.exe – (nmuebs)
SRV - [2008/03/17 18:19:56 | 000,094,608 | —- | M] (Kaspersky Lab) [Auto | Running] – C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe – (klnagent)
SRV - [2008/03/12 17:08:08 | 000,439,656 | —- | M] (DisplayLink Corp.) [Auto | Running] – C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe – (DisplayLinkService)
SRV - [2007/12/05 17:31:58 | 001,122,304 | —- | M] (Lenovo Group Limited) [Auto | Running] – C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe – (TVT Scheduler)
SRV - [2007/12/05 17:21:32 | 000,950,272 | —- | M] (Lenovo Group Limited) [Auto | Stopped] – C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe – (TVT Backup Service)
SRV - [2007/12/05 17:17:14 | 000,520,192 | —- | M] () [Auto | Running] – C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe – (TVT Backup Protection Service)
SRV - [2007/12/05 17:01:24 | 000,644,408 | —- | M] (Lenovo Group Limited) [Auto | Running] – C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe – (ThinkVantage Registry Monitor Service)
SRV - [2007/11/02 15:51:02 | 000,036,136 | —- | M] (Lenovo) [Auto | Running] – C:\WINDOWS\system32\ibmpmsvc.exe – (IBMPMSVC)
SRV - [2007/10/16 18:33:00 | 000,037,424 | —- | M] (Lenovo.) [Auto | Running] – C:\WINDOWS\system32\TPHDEXLG.exe – (TPHDEXLGSVC)
SRV - [2007/10/08 14:27:02 | 000,794,624 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe – (EvtEng) Intel®
SRV - [2007/10/08 14:06:44 | 001,183,744 | —- | M] (Intel Corporation ) [Auto | Running] – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe – (S24EventMonitor) Intel®
SRV - [2007/10/08 14:01:54 | 000,483,328 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe – (RegSrvc) Intel®
SRV - [2007/07/02 10:49:02 | 000,040,960 | -H– | M] (Northern Michigan University) [Auto | Stopped] – C:\WINDOWS\spm.exe – (spm)
SRV - [2007/01/04 19:48:52 | 000,112,152 | R— | M] (InterVideo) [Auto | Running] – C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe – (IviRegMgr)
SRV - [2006/11/03 18:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MsMpEng.exe – (WinDefend)
SRV - [2005/02/25 12:42:46 | 000,466,944 | —- | M] (Lexmark International, Inc.) [On_Demand | Running] – C:\WINDOWS\System32\lxcccoms.exe – (lxcc_device)

========== Driver Services (SafeList) ==========

DRV - [2010/01/13 20:16:14 | 000,005,760 | —- | M] (Lenovo) [Kernel | On_Demand | Stopped] – C:\Program Files\Lenovo\Rescue and Recovery\WAM.sys – (WAM)
DRV - [2009/04/10 23:30:18 | 000,201,504 | —- | M] (Kaspersky Lab) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\klif.sys – (klif)
DRV - [2008/07/11 10:48:00 | 000,046,144 | —- | M] (Lenovo) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\tvtumon.sys – (tvtumon)
DRV - [2008/07/01 14:15:30 | 000,112,144 | —- | M] (Kaspersky Lab) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\kl1.sys – (kl1)
DRV - [2008/05/13 19:08:04 | 000,049,904 | R— | M] (Avanquest Software) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BVRPMPR5.SYS – (BVRPMPR5)
DRV - [2008/03/10 14:03:45 | 000,033,536 | —- | M] (Lenovo) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\tvtfilter.sys – (tvtfilter)
DRV - [2008/03/10 14:03:16 | 000,021,376 | —- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\psadd.sys – (psadd)
DRV - [2008/03/10 14:03:12 | 000,007,012 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\pmemnt.sys – (pmem)
DRV - [2008/01/11 01:30:00 | 000,004,442 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\drivers\TPPWRIF.SYS – (TPPWRIF)
DRV - [2007/12/26 04:04:02 | 000,007,168 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\drivers\TSMAPIP.SYS – (TSMAPIP)
DRV - [2007/11/26 11:21:08 | 000,020,992 | —- | M] (http://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\DisplayLinkUsbPort.sys – (DisplayLinkUsbPort)
DRV - [2007/11/15 10:18:06 | 000,017,845 | —- | M] (Lenovo Group Limited) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\TPHKDRV.sys – (TPHKDRV)
DRV - [2007/11/02 15:50:30 | 000,021,808 | —- | M] (Lenovo.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ibmpmdrv.sys – (IBMPMDRV)
DRV - [2007/11/01 16:26:36 | 000,989,696 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_DPV.sys – (HSF_DPV)
DRV - [2007/11/01 16:25:32 | 000,211,456 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSFHWAZL.sys – (HSFHWAZL)
DRV - [2007/11/01 16:25:22 | 000,731,520 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2007/10/19 11:29:00 | 000,161,792 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\b57xp32.sys – (b57w2k)
DRV - [2007/10/16 18:33:00 | 000,103,472 | —- | M] (Lenovo.) [Kernel | Boot | Running] – C:\WINDOWS\System32\DRIVERS\Apsx86.sys – (Shockprf)
DRV - [2007/10/16 18:32:00 | 000,019,504 | —- | M] (Lenovo.) [Kernel | Boot | Running] – C:\WINDOWS\System32\DRIVERS\ApsHM86.sys – (TPDIGIMN)
DRV - [2007/09/30 00:03:12 | 000,308,248 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\WINDOWS\System32\Drivers\iaStor.sys – (iastor)
DRV - [2007/09/26 06:01:32 | 002,236,032 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\NETw4x32.sys – (NETw4x32) Intel®
DRV - [2007/08/27 11:10:36 | 000,012,288 | —- | M] (Intel Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\s24trans.sys – (s24trans)
DRV - [2007/08/10 19:25:28 | 000,177,664 | —- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SynTP.sys – (SynTP)
DRV - [2007/08/09 11:28:50 | 005,765,056 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\igxpmp32.sys – (ialm)
DRV - [2007/05/30 17:49:06 | 000,024,344 | —- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\klim5.sys – (klim5)
DRV - [2007/05/22 14:59:38 | 000,030,336 | —- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tvti2c.sys – (TVTI2C)
DRV - [2007/04/18 12:55:48 | 000,026,137 | —- | M] (Nortel Networks) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\eacfilt.sys – (Eacfilt)
DRV - [2007/04/18 12:55:30 | 000,155,152 | —- | M] (Nortel Networks NA, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ipsecw2k.sys – (IPSECSHM)
DRV - [2007/04/18 12:55:30 | 000,155,152 | —- | M] (Nortel Networks NA, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ipsecw2k.sys – (IPSECEXT)
DRV - [2007/03/09 12:16:36 | 000,023,400 | —- | M] (DisplayLink Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\DisplayLinkmirrorport.sys – (DisplayLinkmirror)
DRV - [2007/03/09 12:09:08 | 000,025,704 | —- | M] (DisplayLink Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\DisplayLinkGAport.sys – (DisplayLinkGA)
DRV - [2006/10/02 02:55:00 | 000,014,848 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\SMAPINT.SYS – (Smapint)
DRV - [2006/10/02 02:55:00 | 000,009,343 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\drivers\TDSMAPI.SYS – (TDSMAPI)
DRV - [2006/06/20 12:56:48 | 000,178,688 | —- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ADIHdAud.sys – (ADIHdAudAddService)
DRV - [2005/05/17 11:20:06 | 000,015,872 | —- | M] (Atmel, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\atmeltpm.sys – (atmeltpm)
DRV - [2005/01/07 17:07:18 | 000,138,752 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Hdaudbus.sys – (HDAudBus)
DRV - [2004/08/03 23:07:56 | 000,059,264 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\USBAUDIO.sys – (usbaudio) USB Audio Driver (WDM)
DRV - [2004/08/03 23:07:44 | 000,043,008 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\amdagp.sys – (amdagp)
DRV - [2004/08/03 23:07:44 | 000,041,088 | —- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\sisagp.sys – (sisagp)
DRV - [2001/08/17 14:07:44 | 000,019,072 | —- | M] (Adaptec, Inc.) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\sparrow.sys – (Sparrow)
DRV - [2001/08/17 14:07:42 | 000,030,688 | —- | M] (LSI Logic) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\sym_u3.sys – (sym_u3)
DRV - [2001/08/17 14:07:40 | 000,028,384 | —- | M] (LSI Logic) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\sym_hi.sys – (sym_hi)
DRV - [2001/08/17 14:07:36 | 000,032,640 | —- | M] (LSI Logic) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\symc8xx.sys – (symc8xx)
DRV - [2001/08/17 14:07:34 | 000,016,256 | —- | M] (Symbios Logic Inc.) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\symc810.sys – (symc810)
DRV - [2001/08/17 13:52:22 | 000,036,736 | —- | M] (Promise Technology, Inc.) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\ultra.sys – (ultra)
DRV - [2001/08/17 13:52:20 | 000,045,312 | —- | M] (QLogic Corporation) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\ql12160.sys – (ql12160)
DRV - [2001/08/17 13:52:20 | 000,040,320 | —- | M] (QLogic Corporation) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\ql1080.sys – (ql1080)
DRV - [2001/08/17 13:52:18 | 000,049,024 | —- | M] (QLogic Corporation) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\ql1280.sys – (ql1280)
DRV - [2001/08/17 13:52:16 | 000,179,584 | —- | M] (Mylex Corporation) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys – (dac2w2k)
DRV - [2001/08/17 13:52:12 | 000,017,280 | —- | M] (American Megatrends Inc.) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\mraid35x.sys – (mraid35x)
DRV - [2001/08/17 13:52:00 | 000,026,496 | —- | M] (Advanced System Products, Inc.) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\asc.sys – (asc)
DRV - [2001/08/17 13:51:58 | 000,014,848 | —- | M] (Advanced System Products, Inc.) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\asc3550.sys – (asc3550)
DRV - [2001/08/17 13:51:56 | 000,005,248 | —- | M] (Acer Laboratories Inc.) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\aliide.sys – (AliIde)
DRV - [2001/08/17 13:51:54 | 000,006,656 | —- | M] (CMD Technology, Inc.) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\cmdide.sys – (CmdIde)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://login.live.com/login.srf?wa=wsignin…5&mkt=en-US
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.acs.nmu.edu/home"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.63
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/27 13:14:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/06/27 13:14:09 | 000,000,000 | —D | M]

[2008/07/01 14:30:42 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\Mozilla\Extensions
[2010/07/02 00:36:25 | 000,000,000 | —D | M] – C:\Documents and Settings\kpassina\Application Data\Mozilla\Firefox\Profiles\4ycsm45b.default\extensions
[2010/05/08 11:36:03 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\kpassina\Application Data\Mozilla\Firefox\Profiles\4ycsm45b.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/25 23:29:41 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\kpassina\Application Data\Mozilla\Firefox\Profiles\4ycsm45b.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/07/02 00:36:25 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/04/21 19:01:14 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2006/05/16 04:50:00 | 000,053,355 | —- | M] (Oracle Corporation) – C:\Program Files\Mozilla Firefox\plugins\NPJinit13126.dll

O1 HOSTS File: ([2010/07/02 00:10:22 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [Backup Reminder] C:\Program Files\Northern Michigan University\Backup Reminder\BackupReminder.exe (Northern Michigan University)
O4 - HKLM..\Run: [BLOG] C:\Program Files\ThinkPad\Utilities\BATLOGEX.DLL ()
O4 - HKLM..\Run: [EZEJMNAP] C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE (Lenovo Group Ltd.)
O4 - HKLM..\Run: [FaxCenterServer] C:\Program Files\Lexmark Fax Solutions\fm3032.exe ()
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [LPMailChecker] C:\Program Files\ThinkVantage\PrdCtr\LPMLCHK.EXE (Lenovo Group Limited)
O4 - HKLM..\Run: [LPManager] C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE (Lenovo Group Limited)
O4 - HKLM..\Run: [LXCCCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.DLL ()
O4 - HKLM..\Run: [lxccmon.exe] C:\Program Files\Lexmark 3300 Series\lxccmon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [PWRMGRTR] C:\Program Files\ThinkPad\Utilities\PWRMGRTR.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TPFNF7] C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TpShocks] C:\WINDOWS\System32\TpShocks.exe (Lenovo.)
O4 - HKLM..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Advanced SystemCare 3] C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe (IObit)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software )
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Intel Wireless Reporting Tool.lnk = C:\Program Files\Intel\WRT\WRT Tray.exe (Intel Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogOff = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.)
O9 - Extra Button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\SCIEPlgn.dll (Kaspersky Lab)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: nmu.edu ([cognosbi] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([download] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([ftp] ftp in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([my] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([my] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([myuser] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([myuser] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([schedule] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([webct] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([webct] https in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([www] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([www.acs] http in Local intranet)
O15 - HKCU\..Trusted Domains: nmu.edu ([www.acs] https in Local intranet)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1200669642687 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1267071389750 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFECAFE-0013-0001-0026-ABCDEFABCDEF} Reg Error: Value error. (JInitiator 1.3.1.26)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O20 - Winlogon\Notify\tpfnf2: DllName - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll ()
O20 - Winlogon\Notify\tphotkey: DllName - C:\Program Files\Lenovo\HOTKEY\tphklock.dll - C:\Program Files\Lenovo\HOTKEY\tphklock.dll (Lenovo Group Limited)
O24 - Desktop WallPaper: C:\Documents and Settings\kpassina\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\kpassina\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/01/17 15:41:14 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2008/01/17 15:40:44 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16620634377289728)

========== Files/Folders - Created Within 30 Days ==========

[2010/07/02 01:19:47 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/07/02 00:56:50 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Application Data\Malwarebytes
[2010/07/02 00:56:39 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/07/02 00:56:37 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/07/02 00:56:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/07/02 00:56:36 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/02 00:54:26 | 006,153,352 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\kpassina\Desktop\mbam-setup.exe
[2010/07/02 00:40:44 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/07/01 23:55:04 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/07/01 23:55:04 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/07/01 23:55:04 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/07/01 23:55:04 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/07/01 23:54:45 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/07/01 23:54:24 | 000,000,000 | —D | C] – C:\Qoobox
[2010/07/01 23:25:24 | 000,000,000 | —D | C] – C:\_OTL
[2010/07/01 22:26:27 | 000,574,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\kpassina\Desktop\OTL.exe
[2010/07/01 18:19:17 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\kpassina\Desktop\HiJackThis.exe
[2010/06/28 23:05:46 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Desktop\Misc. WORD
[2010/06/28 22:00:42 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Application Data\IObit
[2010/06/28 22:00:41 | 000,000,000 | —D | C] – C:\Program Files\IObit
[2010/06/28 21:59:02 | 000,000,000 | RH-D | C] – C:\Documents and Settings\kpassina\Recent
[2010/06/28 21:53:49 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/06/28 21:53:35 | 001,154,616 | —- | C] (Piriform Ltd) – C:\Documents and Settings\kpassina\Desktop\ccsetup233_slim.exe
[2010/06/28 21:53:07 | 007,505,152 | —- | C] (IObit ) – C:\Documents and Settings\kpassina\Desktop\asc-setup-mj.exe
[2010/06/26 17:02:21 | 000,000,000 | —D | C] – C:\Program Files\Google
[2010/06/26 17:02:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Google
[2010/06/26 13:05:11 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2010/06/26 00:35:15 | 000,000,000 | —D | C] – C:\Program Files\NOS
[2010/06/25 22:34:08 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Local Settings\Application Data\Temp
[2010/06/25 22:33:14 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Local Settings\Application Data\Deployment
[2010/06/09 22:07:39 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010/06/06 19:10:10 | 000,000,000 | —D | C] – C:\Documents and Settings\kpassina\Desktop\You Tube

========== Files - Modified Within 30 Days ==========

[2010/07/02 02:48:32 | 080,597,024 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox.dat
[2010/07/02 02:48:31 | 003,673,376 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox2.dat
[2010/07/02 02:26:30 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/07/02 01:11:20 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/02 01:10:46 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/02 01:10:44 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/02 01:10:41 | 1063,702,528 | -HS- | M] () – C:\hiberfil.sys
[2010/07/02 01:09:38 | 004,718,592 | -H– | M] () – C:\Documents and Settings\kpassina\NTUSER.DAT
[2010/07/02 01:09:37 | 000,347,204 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox2.idx
[2010/07/02 01:09:35 | 000,990,992 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox.idx
[2010/07/02 01:08:58 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\kpassina\ntuser.ini
[2010/07/02 01:08:47 | 011,657,216 | -H– | M] () – C:\Documents and Settings\kpassina\Local Settings\Application Data\IconCache.db
[2010/07/02 01:07:48 | 000,012,454 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Malware results.docx
[2010/07/02 01:06:30 | 000,002,533 | —- | M] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007 (2).lnk
[2010/07/02 00:56:41 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/02 00:55:07 | 006,153,352 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\kpassina\Desktop\mbam-setup.exe
[2010/07/02 00:10:51 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/07/02 00:10:22 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/07/01 23:54:03 | 003,725,496 | R— | M] () – C:\Documents and Settings\kpassina\Desktop\ComboFix.exe
[2010/07/01 23:32:38 | 000,000,497 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Hotmail.url
[2010/07/01 22:43:53 | 000,293,376 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Gamer oyzf1c7v.exe
[2010/07/01 22:26:53 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\kpassina\Desktop\OTL.exe
[2010/07/01 22:16:50 | 000,000,152 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Munising Weather.URL
[2010/07/01 21:19:38 | 000,004,767 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Bing.url
[2010/07/01 20:39:28 | 000,010,965 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\7-1-10 Computer Problem Outline.docx
[2010/07/01 20:15:45 | 000,000,260 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Ask.com.url
[2010/07/01 18:19:25 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\kpassina\Desktop\HiJackThis.exe
[2010/07/01 17:42:58 | 000,002,465 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\MSNBC.com.url
[2010/06/30 19:15:01 | 000,000,211 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Google.url
[2010/06/30 15:31:59 | 000,000,575 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\YouTube.url
[2010/06/30 15:08:39 | 000,000,100 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\CNN News.URL
[2010/06/30 14:56:15 | 000,000,231 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\NASCAR.url
[2010/06/29 11:57:25 | 000,000,143 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Login Facebook.URL
[2010/06/28 22:26:38 | 000,000,660 | —- | M] () – C:\WINDOWS\win.ini
[2010/06/28 22:26:38 | 000,000,235 | RHS- | M] () – C:\boot.ini
[2010/06/28 22:14:03 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/06/28 22:00:51 | 000,000,892 | —- | M] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced SystemCare.lnk
[2010/06/28 22:00:51 | 000,000,874 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Advanced SystemCare.lnk
[2010/06/28 22:00:51 | 000,000,156 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\IObit Freeware.url
[2010/06/28 21:46:44 | 001,154,616 | —- | M] (Piriform Ltd) – C:\Documents and Settings\kpassina\Desktop\ccsetup233_slim.exe
[2010/06/28 21:45:46 | 007,505,152 | —- | M] (IObit ) – C:\Documents and Settings\kpassina\Desktop\asc-setup-mj.exe
[2010/06/27 18:14:49 | 000,000,134 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\TV6.URL
[2010/06/27 13:14:20 | 000,001,620 | —- | M] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/06/27 13:14:20 | 000,001,602 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/06/26 14:52:19 | 000,000,342 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Munising Radar.url
[2010/06/24 17:05:23 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/23 19:02:58 | 000,000,223 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\TIME.url
[2010/06/23 19:02:50 | 000,493,082 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/23 19:02:50 | 000,435,828 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/23 19:02:50 | 000,068,558 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/16 11:35:48 | 000,000,298 | —- | M] () – C:\Documents and Settings\kpassina\Desktop\Plover Weather.url
[2010/06/10 12:00:50 | 000,266,208 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2010/07/02 01:07:47 | 000,012,454 | —- | C] () – C:\Documents and Settings\kpassina\Desktop\Malware results.docx
[2010/07/02 00:56:41 | 000,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/01 23:55:04 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/07/01 23:55:04 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/07/01 23:55:04 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/07/01 23:55:04 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/07/01 23:55:04 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/07/01 23:41:46 | 003,725,496 | R— | C] () – C:\Documents and Settings\kpassina\Desktop\ComboFix.exe
[2010/07/01 22:43:48 | 000,293,376 | —- | C] () – C:\Documents and Settings\kpassina\Desktop\Gamer oyzf1c7v.exe
[2010/07/01 18:14:37 | 000,010,965 | —- | C] () – C:\Documents and Settings\kpassina\Desktop\7-1-10 Computer Problem Outline.docx
[2010/06/30 18:44:37 | 000,000,211 | —- | C] () – C:\Documents and Settings\kpassina\Desktop\Google.url
[2010/06/28 22:26:32 | 000,001,618 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
[2010/06/28 22:26:32 | 000,000,737 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Intel Wireless Reporting Tool.lnk
[2010/06/28 22:00:51 | 000,000,892 | —- | C] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced SystemCare.lnk
[2010/06/28 22:00:51 | 000,000,874 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Advanced SystemCare.lnk
[2010/06/28 22:00:51 | 000,000,156 | —- | C] () – C:\Documents and Settings\kpassina\Desktop\IObit Freeware.url
[2010/06/26 18:48:29 | 000,001,620 | —- | C] () – C:\Documents and Settings\kpassina\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/06/26 18:48:29 | 000,001,602 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/06/24 17:05:23 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/06/26 23:43:11 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\LXPRMON.DLL
[2009/06/26 23:43:11 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\LXPMONUI.DLL
[2009/06/26 23:39:42 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxccvs.dll
[2008/07/16 09:52:04 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2008/07/01 13:31:37 | 000,000,026 | —- | C] () – C:\WINDOWS\Lidbeep.ini
[2008/03/26 14:52:57 | 000,000,059 | —- | C] () – C:\WINDOWS\WININIT.INI
[2008/03/11 10:45:13 | 000,036,962 | —- | C] () – C:\WINDOWS\System32\ActPanel.dll
[2008/03/11 10:06:08 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2008/03/11 10:06:08 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2008/03/11 10:06:08 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2008/03/11 10:06:08 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2008/03/11 10:06:08 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2008/03/11 10:06:08 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2008/03/10 13:50:34 | 000,009,343 | —- | C] () – C:\WINDOWS\System32\drivers\TDSMAPI.SYS
[2008/03/10 13:47:14 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\drivers\TSMAPIP.SYS
[2008/03/10 13:42:36 | 000,004,442 | —- | C] () – C:\WINDOWS\System32\drivers\TPPWRIF.SYS
[2008/03/10 13:37:26 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\SynTPCoI.dll
[2008/03/10 12:31:12 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4860.dll
[2007/12/14 16:12:14 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\DEVMAN.DLL
[2006/01/26 15:42:26 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/05/06 12:59:10 | 000,001,024 | —- | M] () – C:\.rnd
[2008/01/17 15:41:14 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/06/28 22:26:38 | 000,000,235 | RHS- | M] () – C:\boot.ini
[2010/07/02 00:20:19 | 000,024,148 | —- | M] () – C:\ComboFix.txt
[2008/01/17 15:41:14 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/07/02 01:10:41 | 1063,702,528 | -HS- | M] () – C:\hiberfil.sys
[2008/01/17 15:41:14 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/05/01 16:32:49 | 000,002,556 | —- | M] () – C:\logfile
[2010/07/01 19:00:26 | 000,000,528 | —- | M] () – C:\lxcc.log
[2009/04/11 15:36:19 | 000,000,000 | —- | M] () – C:\lxccfire.000
[2009/06/26 23:39:12 | 000,000,000 | —- | M] () – C:\lxccfire.csv
[2009/04/11 15:37:27 | 000,000,291 | —- | M] () – C:\LXCCINST.000
[2009/06/26 23:40:05 | 000,000,291 | —- | M] () – C:\LXCCINST.csv
[2010/07/01 21:46:31 | 000,005,670 | —- | M] () – C:\lxccscan.log
[2009/05/23 22:38:29 | 001,061,910 | —- | M] () – C:\lxccUNST.csv
[2008/01/17 15:41:14 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2009/11/03 17:38:14 | 000,002,854 | —- | M] () – C:\nagent_log.txt
[2004/08/04 07:00:00 | 000,047,564 | RHS- | M] () – C:\ntdetect.com
[2004/08/03 22:59:34 | 000,250,032 | RHS- | M] () – C:\ntldr
[2010/07/02 01:10:39 | 1598,029,824 | -HS- | M] () – C:\pagefile.sys
[2004/08/04 07:00:00 | 000,260,272 | RHS- | M] () – C:\peldr
[2010/07/02 01:18:48 | 000,454,729 | —- | M] () – C:\sysiclog.txt
[2004/08/04 07:00:00 | 000,000,010 | —- | M] () – C:\WIN51
[2004/08/04 07:00:00 | 000,000,010 | —- | M] () – C:\WIN51IP
[2004/08/04 07:00:00 | 000,000,010 | —- | M] () – C:\WIN51IP.SP2

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2008/07/06 08:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/02/13 20:22:00 | 000,286,208 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp4wm.DLL
[2007/03/02 18:23:38 | 000,235,520 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp5in.DLL
[2005/01/04 17:22:28 | 000,073,728 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\lxccPP5C.DLL
[2006/10/26 19:58:12 | 000,030,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/03/08 04:31:44 | 000,348,160 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtmsft.dll
[2009/03/08 04:31:38 | 000,216,064 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtrans.dll
[2010/05/06 06:41:50 | 000,184,320 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\iepeers.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008/01/17 10:28:48 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2008/01/17 10:28:48 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2008/01/17 10:28:48 | 000,892,928 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2007/03/08 11:36:28 | 000,577,536 | —- | M] (Microsoft Corporation) MD5=B409909F6E2E8A7067076ED748ABF1E7 – C:\WINDOWS\system32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2004/08/04 00:56:48 | 000,082,944 | —- | M] (Microsoft Corporation) MD5=2ED0B7F12A60F90092081C50FA0EC2B2 – C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2004/08/04 00:56:48 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=9BEACB911CA61E5881102188AB7FB431 – C:\WINDOWS\system32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"NoAutoUpdate" = 0
"AUOptions" = 4
"ScheduledInstallDay" = 0
"ScheduledInstallTime" = 18
"UseWUServer" = 1
"AutoInstallMinorUpdates" = 1
"DetectionFrequency" = 22
"DetectionFrequencyEnabled" = 0
"NoAutoRebootWithLoggedOnUsers" = 1
"RebootRelaunchTimeout" = 5
"RebootRelaunchTimeoutEnabled" = 0
"RebootWarningTimeout" = 5
"RebootWarningTimeoutEnabled" = 0
"RescheduleWaitTime" = 5
"RescheduleWaitTimeEnabled" = 1

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-06-29 15:59:46

< >
< End of report >

5. Seems to be working OK

Thank you,

✨ Ask AI

Ask AI