What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Browser locking up

21 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Was on Bluray.com and noticed I had a PM. Opened it to read it, it was telling me to go to some website to watch free movies. I did not click on any links but ever since , my browser is locking up constantly.

Heres the HJT log..

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:01:53 PM, on 7/8/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\LTMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\Micro Innovations\Wireless Laser Mouse\moffice.exe
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\SYSTEM32\USRshutA.exe
C:\Program Files\Micro Innovations\Wireless Laser Mouse\MOUSE32A.DAT
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Micro Innovations\Wireless Laser Mouse\moffice.exe
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - https://objects.aol.com/mcafee/molbin/share…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - https://objects.aol.com/mcafee/molbin/share…,20/McGDMgr.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 7566 bytes
Post #2
Hello,

I will be helping you on removing malwares on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Do not install/uninstall anything on your computer unless advised.
  • Do not run any other scanning tools other than those instructed for you to use.
  • Follow the instructions on the order they are given.
  • Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
  • If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
  • If you do not reply within 3 days after my last response, I will be asking you whether you still need assistance and if you still don't reply within 48 hours then the topic will be closed.
  • And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.

_________________________________________________


OTL:
  • Download OTL to your desktop.
  • Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output
  • Check the boxes beside LOP Check and Purity Check.
  • Copy and paste the following bold text into the box under Custom Scan

    netsvcs
    %SYSTEMDRIVE%\*.exe
    c:\windows\system32\drivers\*.sys /90
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    /md5stop
    CREATERESTOREPOINT

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of the OTL.txt and post it with your next reply along with the Extras.txt log.

–Next–

[external image: Posted Image]
Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
  • Double click GMER.exe.
    [external image: Posted Image]
  • If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO, then use the following settings for a more complete scan..
  • In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
      [external image: Posted Image]
      Click the image to enlarge it
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
  • Save the log where you can easily find it, such as your desktop.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.

To post in your next reply:
1. OTL logs.
2. GMER log.
Post #3
Ok so I followed your instructions completely…

Here is the OTL file

OTL logfile created on: 7/10/2010 3:00:10 PM - Run 1
OTL by OldTimer - Version 3.2.9.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 501.00 Mb Available Physical Memory | 49.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 147.14 Gb Total Space | 130.08 Gb Free Space | 88.40% Space Free | Partition Type: NTFS
Drive D: | 5.50 Gb Total Space | 0.94 Gb Free Space | 17.07% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive N: | 42.34 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: OWNER
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Micro Innovations\Wireless Laser Mouse\moffice.exe ()
PRC - C:\Program Files\Micro Innovations\Wireless Laser Mouse\mouse32a.dat ()
PRC - C:\Program Files\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
PRC - C:\WINDOWS\ltmsg.exe (Agere Systems)
PRC - C:\Program Files\HP\Digital Imaging\Unload\HpqCmon.exe ()
PRC - C:\WINDOWS\system32\usrmlnka.exe (U.S. Robotics Corporation)
PRC - C:\WINDOWS\system32\usrshuta.exe ( U.S. Robotics Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\Program Files\Micro Innovations\Wireless Laser Mouse\mouDL32A.dll ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Driver Services (SafeList) ==========

DRV - (Sunkfiltp) – C:\WINDOWS\System32\Drivers\sunkfiltp.sys File not found
DRV - (PCTINDIS5) – C:\WINDOWS\System32\PCTINDIS5.SYS File not found
DRV - (hwdatacard) – C:\WINDOWS\System32\DRIVERS\ewusbmdm.sys File not found
DRV - (ewusbnet) – C:\WINDOWS\System32\DRIVERS\ewusbnet.sys File not found
DRV - (catchme) – C:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys File not found
DRV - (AvgTdiX) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (NWUSBCDFIL) – C:\WINDOWS\system32\drivers\NwUsbCdFil.sys (Novatel Wireless Inc.)
DRV - (NWADI) – C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (NWUSBPort2) – C:\WINDOWS\system32\drivers\nwusbser2.sys (Novatel Wireless Inc.)
DRV - (NWUSBPort) – C:\WINDOWS\system32\drivers\nwusbser.sys (Novatel Wireless Inc.)
DRV - (NWUSBModem) – C:\WINDOWS\system32\drivers\nwusbmdm.sys (Novatel Wireless Inc.)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (hwusbdev) – C:\WINDOWS\system32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.)
DRV - (SMSIVZAM5) – C:\Program Files\Verizon Wireless\VZAccess Manager\SMSIVZAM5.sys (Smith Micro Inc.)
DRV - (moufiltr) – C:\WINDOWS\system32\drivers\moufiltr.sys (Chic Tech.)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (S3Psddr) – C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (nv_agp) – C:\WINDOWS\System32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (SunkFilt) – C:\WINDOWS\system32\drivers\Sunkfilt.sys (Alcor Micro Corp.)
DRV - (viaagp1) – C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (ltmodem5) – C:\WINDOWS\system32\drivers\ltmdmnt.sys (Agere Systems)
DRV - (fasttx2k) – C:\WINDOWS\System32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (NVENET) – C:\WINDOWS\system32\drivers\NVENET.sys (NVIDIA Corporation)
DRV - (SiSkp) – C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SISAGP) – C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (rtl8139) – C:\WINDOWS\system32\drivers\R8139n51.sys (Realtek Semiconductor Corporation )
DRV - (USRpdA) – C:\WINDOWS\system32\drivers\USRpdA.sys (U.S. Robotics Corporation)
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.825
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/06/02 10:24:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/06 10:56:34 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/06 18:31:48 | 000,000,000 | —D | M]

[2010/01/17 13:46:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2010/01/17 13:46:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions\[removed]
[2010/07/10 14:52:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\z1i3q6r7.default\extensions
[2010/04/26 22:07:10 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\z1i3q6r7.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/10 14:52:12 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/05/10 09:16:41 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2009/11/19 18:16:28 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2010/05/10 09:16:26 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/11/19 18:16:29 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll

O1 HOSTS File: ([2006/02/22 16:40:20 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\HpqCmon.exe ()
O4 - HKLM..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Micro Innovations\Wireless Laser Mouse\moffice.exe ()
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe (HP)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [LTMSG] C:\WINDOWS\ltmsg.exe (Agere Systems)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PS2] C:\WINDOWS\system32\ps2.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
O4 - HKLM..\Run: [USRpdA] File not found
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: //@mail.mar@ ([]msn in Local intranet)
O15 - HKCU\..Trusted Domains: //@signup.mar@ ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab (Reg Error: Key error.)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} https://objects.aol.com/mcafee/molbin/share…83/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} https://objects.aol.com/mcafee/molbin/share…,20/McGDMgr.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.4.2/jinstall-…indows-i586.cab (Java Plug-in 1.4.2)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll (PCPitstop Exam)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/10/10 22:32:03 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2008/08/21 03:39:48 | 000,000,074 | R— | M] () - N:\AUTORUN.INF – [ CDFS ]
O33 - MountPoints2\{210c20f2-83e7-11df-86fc-947f58fdaa7b}\Shell - "" = AutoRun
O33 - MountPoints2\{210c20f2-83e7-11df-86fc-947f58fdaa7b}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{210c20f2-83e7-11df-86fc-947f58fdaa7b}\Shell\AutoRun\command - "" = M:\VZAccess_Manager.exe – File not found
O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell - "" = AutoRun
O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell\AutoRun\command - "" = K:\AutoRun.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/07/10 14:52:00 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/06/29 21:36:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Verizon Wireless
[2010/06/29 21:34:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\WEngineLite
[2010/06/29 21:34:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Verizon Wireless
[2010/06/29 21:33:07 | 000,000,000 | —D | C] – C:\Program Files\Verizon Wireless
[2010/06/29 21:32:23 | 000,000,000 | —D | C] – C:\Program Files\Novatel Wireless
[2010/06/29 21:32:16 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Downloaded Installations
[2010/06/29 21:32:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\InstallShield
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/10 14:59:10 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/07/10 14:52:06 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/07/10 14:40:56 | 000,022,391 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/07/10 14:40:55 | 000,000,188 | —- | M] () – C:\WINDOWS\System\hpsysdrv.DAT
[2010/07/10 14:40:44 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/10 14:40:37 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/10 14:40:34 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/10 14:40:32 | 1073,139,712 | -HS- | M] () – C:\hiberfil.sys
[2010/07/10 12:37:01 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/10 12:06:10 | 061,821,997 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/07/09 22:38:34 | 003,670,016 | -H– | M] () – C:\Documents and Settings\Owner\NTUSER.DAT
[2010/07/09 22:38:34 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Owner\ntuser.ini
[2010/07/08 20:01:40 | 000,002,447 | —- | M] () – C:\Documents and Settings\Owner\Desktop\HiJackThis (2).lnk
[2010/06/30 21:46:36 | 001,580,306 | -H– | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db
[2010/06/30 17:10:20 | 000,000,088 | —- | M] () – C:\WINDOWS\popcinfo.dat
[2010/06/29 21:34:41 | 000,001,024 | —- | M] () – C:\Documents and Settings\All Users\Desktop\VZAccess Manager.lnk
[2010/06/29 21:33:43 | 000,524,016 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/29 21:33:43 | 000,442,466 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/29 21:33:43 | 000,071,732 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/24 20:14:07 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/22 18:52:14 | 000,034,680 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/06/21 13:06:47 | 000,156,360 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/08 20:01:29 | 000,002,447 | —- | C] () – C:\Documents and Settings\Owner\Desktop\HiJackThis (2).lnk
[2010/06/29 21:34:41 | 000,001,024 | —- | C] () – C:\Documents and Settings\All Users\Desktop\VZAccess Manager.lnk
[2010/03/06 15:58:15 | 000,021,504 | —- | C] () – C:\WINDOWS\jestertb.dll
[2009/02/12 19:24:30 | 000,000,032 | —- | C] () – C:\WINDOWS\AuthMgr.INI
[2007/05/05 20:29:36 | 000,000,014 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/10/22 13:22:00 | 000,212,992 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/06/09 13:53:23 | 000,000,000 | —- | C] () – C:\WINDOWS\MSDraw.ini
[2006/05/30 16:37:32 | 000,455,168 | —- | C] () – C:\WINDOWS\System32\redllw32.dll
[2006/05/30 16:37:32 | 000,240,128 | —- | C] () – C:\WINDOWS\System32\PDDLLW32.DLL
[2005/11/16 17:44:44 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/10/23 12:13:03 | 000,000,170 | —- | C] () – C:\WINDOWS\GetServer.ini
[2005/08/31 16:48:39 | 000,021,840 | —- | C] () – C:\WINDOWS\System32\SIntfNT.dll
[2005/08/31 16:48:39 | 000,017,212 | —- | C] () – C:\WINDOWS\System32\SIntf32.dll
[2005/08/31 16:48:39 | 000,012,067 | —- | C] () – C:\WINDOWS\System32\SIntf16.dll
[2005/07/19 11:21:49 | 000,000,414 | —- | C] () – C:\WINDOWS\hpbvspst.ini
[2005/07/18 15:50:03 | 000,001,990 | —- | C] () – C:\WINDOWS\hpdj3740.ini
[2005/07/14 20:37:14 | 000,000,431 | —- | C] () – C:\WINDOWS\MVPWORD.INI
[2005/07/13 16:39:40 | 000,000,026 | —- | C] () – C:\WINDOWS\UP9ASP.INI
[2005/07/13 16:27:26 | 000,000,099 | —- | C] () – C:\WINDOWS\upst.ini
[2005/07/13 16:27:26 | 000,000,024 | —- | C] () – C:\WINDOWS\atid.ini
[2005/07/13 15:33:00 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2005/07/13 15:33:00 | 001,470,464 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2005/07/13 15:33:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2005/07/13 15:33:00 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2005/07/13 15:33:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2005/07/13 15:33:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2005/07/11 13:33:31 | 000,240,640 | —- | C] () – C:\WINDOWS\System32\nmocod.dll
[2005/07/11 13:31:31 | 000,000,082 | —- | C] () – C:\WINDOWS\usrwiz.ini
[2003/10/14 01:41:40 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/10/14 01:24:52 | 000,002,154 | —- | C] () – C:\WINDOWS\System32\mshrml.ini
[2003/10/13 18:52:52 | 000,000,438 | —- | C] () – C:\WINDOWS\System32\1_ssetup.ini
[2003/10/13 18:52:52 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\sunistlog.ini
[2003/10/11 01:33:40 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll
[2003/10/11 01:33:10 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2003/10/11 01:33:10 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2003/10/11 01:29:24 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2003/10/11 01:24:47 | 000,030,203 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2003/10/11 01:24:29 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\syscontr.dll
[2003/10/11 01:23:52 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2003/10/11 01:18:34 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/10/11 01:07:37 | 000,000,907 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2003/10/10 23:31:33 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/10/10 22:56:51 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2003/10/10 22:56:51 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2003/10/10 22:56:33 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2003/10/10 22:35:14 | 000,000,904 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/10/10 22:22:28 | 000,000,667 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/09/23 04:19:42 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/03/27 16:28:44 | 000,004,955 | —- | C] () – C:\WINDOWS\System32\DProg.ini
[2003/01/08 01:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/03/13 16:46:46 | 000,053,248 | R— | C] () – C:\WINDOWS\System32\zlib.dll
[1999/07/23 13:46:48 | 000,000,116 | —- | C] () – C:\WINDOWS\AuHCcup1.ini
[1999/07/23 10:53:20 | 000,129,536 | —- | C] () – C:\WINDOWS\AuHCcup1.dll
[1997/11/17 18:13:16 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll

========== LOP Check ==========

[2005/10/23 16:39:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avg7
[2010/04/04 20:57:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2007/02/13 12:23:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2010/01/19 13:58:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2010/06/21 13:02:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\T-Mobile
[2010/01/17 13:28:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2005/06/30 13:11:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/02/18 19:27:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Visual Networks
[2010/06/29 21:34:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WEngineLite
[2010/01/17 10:32:09 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
[2010/01/11 15:20:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\EarthLink
[2005/07/17 12:47:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\eGames
[2010/03/27 22:40:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Facebook
[2005/08/20 19:44:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\interMute
[2005/07/18 16:23:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InterVideo
[2005/08/20 19:46:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Leadertech
[2010/01/18 13:49:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\LimeWire
[2006/01/16 15:09:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Lionhead Studios
[2008/10/27 17:33:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\LTOA
[2003/10/11 01:47:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SampleView
[2010/01/16 15:04:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Smith Micro
[2010/01/12 17:52:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\T-Mobile

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >
[2005/12/05 20:07:51 | 000,010,920 | —- | M] () – C:\aolconnfix.exe

< c:\windows\system32\drivers\*.sys /90 >
[2010/06/02 10:00:44 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\system32\drivers\avgmfx86.sys
[2010/06/02 10:00:45 | 000,242,896 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\system32\drivers\avgtdix.sys


< MD5 for: AGP440.SYS >
[2004/08/04 02:05:44 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2010/01/16 17:00:23 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004/08/04 02:05:44 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2010/01/16 17:00:23 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ERDNT\cache\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 00:07:42 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2002/08/29 08:00:00 | 010,158,890 | —- | M] () .cab file – C:\I386\sp1.cab:atapi.sys
[2002/08/29 15:00:00 | 010,158,890 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2004/08/04 02:05:44 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2010/01/16 17:00:23 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2002/08/29 15:00:00 | 010,158,890 | —- | M] () .cab file – C:\WINDOWS\I386\sp1.cab:atapi.sys
[2004/08/04 02:05:44 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2010/01/16 17:00:23 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2002/08/29 08:00:00 | 000,086,912 | —- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA – C:\WINDOWS\$NtUninstallQ331958$\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 23:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 01:56:44 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2009/02/06 14:46:09 | 000,408,064 | —- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 – C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009/02/06 14:46:09 | 000,408,064 | —- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 – C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[2004/08/04 01:56:46 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 01:56:46 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
< End of report >



Here is the EXTRAS file

OTL Extras logfile created on: 7/10/2010 3:00:11 PM - Run 1
OTL by OldTimer - Version 3.2.9.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 501.00 Mb Available Physical Memory | 49.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 147.14 Gb Total Space | 130.08 Gb Free Space | 88.40% Space Free | Partition Type: NTFS
Drive D: | 5.50 Gb Total Space | 0.94 Gb Free Space | 17.07% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive N: | 42.34 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: OWNER
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe – (AVG Technologies CZ, s.r.o.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{092eeeee-9fdd-4895-a568-0818c96beb6c}" = AiO_Scan
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{14589F05-C658-4594-9429-D437BA688686}" = IntelliMover Data Transfer Demo
"{145CACAF-9B34-41FC-BE49-7D510A253E78}" = Multimedia Card Reader
"{1F7CCFA3-D926-4882-B2A5-A0217ED25597}" = PC-Doctor for Windows
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{2A267BC6-F77F-4DD4-825F-7AEB1F68B4B1}" = HpSdpAppCoreApp
"{2E132061-C78A-48D4-A899-1D13B9D189FA}" = Memories Disc Creator 2.0
"{2F1FD032-67D1-4569-923F-47EAF132BF0F}" = DocProc
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3AA7FDD6-E358-453D-BC77-22E3CF81DA83}" = Super Glinx!
"{3CF78481-FB7B-4B51-99A2-D5E0CD0B3AAF}" = HPSystemDiagnostics
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{3FF660F4-147B-48CB-B824-2B595759D9EF}" = VZAccess Manager
"{40B739E1-40CC-4F0D-9BA1-B75492FFA732}" = Super Nisqually!
"{45B6180B-DCAB-4093-8EE8-6164457517F0}" = Photosmart 140,240,7200,7600,7700,7900 Series
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4FB6F304-A91D-4919-98E5-D96E074EA9E5}" = SkinsHP1
"{54DE0B75-6CD9-44C4-B10A-1F25DA9899D8}" = Quicken 2004
"{54e854d5-d5d4-452d-9c75-b39f5625b5fb}" = Readme
"{5ADF6293-D60F-4425-AFA7-CEB820DB872B}" = QuickProjects
"{5D7F0A0E-369E-46C0-9F99-FAB21A064781}" = HP Photo and Imaging 2.0 - Photosmart Cameras
"{629CCE02-041D-4577-892C-577861181771}" = Verizon Wireless USB760 Firmware Updates
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{66C018BD-6F16-4B32-B4CD-1DC1B21FBDFF}" = Zone Deluxe Games
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7148F0A8-6813-11D6-A77B-00B0D0142000}" = Java 2 Runtime Environment, SE v1.4.2
"{745A92AF-53B4-41A7-91C3-9B026B1D5897}" = InstantShare
"{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}" = Microsoft Works 7.0
"{791B20D4-AE59-4DE9-B45F-BA01F3D0A493}" = ArcSoft ShowBiz 2
"{7BBD57D6-09B1-4CC3-9664-A0D53EE25247}" = PSShortcutsP
"{829698DE-9EAC-475E-9A05-B7BA807CA1EF}" = Director
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics Driver
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{939227BD-19D8-4684-8A04-31AC9F6A564C}" = Scan
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = RecordNow!
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = InterVideo WinDVD Player
"{9F4EEA0C-7174-4BD3-89AF-7AB2F9F6AEDD}" = hpmdtab
"{A301896D-9F55-4492-B518-30EAC4C723E1}" = Super Collapse!
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A363B66C-1547-47bf-90F0-3834E70A841A}" = CreativeProjects
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC2BA148-EE9C-4F1A-AFCE-F38C2C71D29B}" = Mobile Broadband Generic Drivers
"{AC76BA86-7AD7-1033-7B44-000000000001}" = Adobe Reader 6.0
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B83E0346-D2D0-11D5-A9AE-00105AA9E047}" = U.S. Robotics ControlCenter
"{bb6cac2a-1fa0-471a-bc3c-ade699c39f3c}" = Fax
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{c330461f-c4a9-4fc7-af5d-c158e0b56aa7}" = AiOSoftware
"{C38BC5B7-62D3-4880-82DD-A4803FD81921}" = PhotoGallery
"{C6A7AF96-4EB1-4AAE-8318-1AB393C64F88}" = Microsoft Plus! Digital Media Edition
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC0A24CB-87C9-4F1C-A1F2-F87D8D4DDCAF}" = HP Software Update
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE4F8FFB-4063-4247-9F14-ECE61AFEFA25}" = TrayApp
"{CFD1B282-555D-494d-8231-4175C2AF08C2}" = PrintScreen
"{D0122362-6333-4DE4-93F6-A5A2F3CC101A}" = HP Organize
"{D1D8C9C4-89BE-4f37-9EC4-B80E3C239C41}" = Copy
"{D545BB81-DEB0-49f7-BE26-197BC31AAF57}" = SkinsHP2
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E4ABB302-9D82-4D18-83D5-AD1DFE786AA8}" = Unload
"{ec7d7a6a-31cb-4810-826f-74171bef44f1}" = AIOMinimal
"{F247869D-3643-4A9F-821B-3534145928E3}" = HPIZ311
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F38FA38A-7E5A-4209-88ED-4DE21CD20EEF}" = HP PSC & OfficeJet 3.0
"{F419D20A-7719-4639-8E30-C073A040D878}" = HP Deskjet Preloaded Printer Drivers
"{F673E347-F2D2-44BB-A430-AB3EE02A3902}" = Ultimate Solitaire 500
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"{FBBF532A-47AC-457d-AC06-0D3163D8911E}" = WebReg
"Ad-Aware" = Ad-Aware
"Ad-Aware SE Personal" = Ad-Aware SE Personal
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AVG9Uninstall" = AVG Free 9.0
"BackWeb-137903 Uninstaller" = Updates from HP
"Balloon Kaboom" = Balloon Kaboom
"Balloon Pop Special Edition" = Balloon Pop Special Edition
"Bejeweled 2 Deluxe 1.1" = Bejeweled 2 Deluxe 1.1
"Bejeweled Deluxe 1.862" = Bejeweled Deluxe 1.862
"Bingo Master Special Edition" = Bingo Master Special Edition
"Blast Thru Special Edition" = Blast Thru Special Edition
"Block Rox" = Block Rox
"Bogglev1" = Boggle
"Bonkerz" = Bonkerz
"CCleaner" = CCleaner
"Collector's Edition 251" = Collector's Edition 251
"Color Wheel" = Color Wheel
"Concentration" = Concentration (remove only)
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"Crazy Puzzle Special Edition" = Crazy Puzzle Special Edition
"Crystal Wizard" = Crystal Wizard
"Drop" = Drop
"Drop!" = Drop!
"Easy Chef's Holiday Favorites" = Easy Chef's Holiday Favorites
"Easy Chef's Million Recipes" = Easy Chef's Million Recipes
"Easy Chef's Pies, Pastries & Cobblers" = Easy Chef's Pies, Pastries & Cobblers
"Easy Chef's Slow Cookin'" = Easy Chef's Slow Cookin'
"eGames GameButler" = eGames GameButler
"Flipster" = Flipster
"Flipster Twin Pack" = Flipster Twin Pack
"Galapago_is1" = Galapago
"Google Updater" = Google Updater
"HijackThis" = HijackThis 2.0.2
"HP Photo & Imaging" = HP Photo & Imaging 3.1
"HPTOOLKIT" = toolkit
"ie8" = Windows Internet Explorer 8
"InstallShield_{145CACAF-9B34-41FC-BE49-7D510A253E78}" = Multimedia Card Reader
"InstallShield_{54DE0B75-6CD9-44C4-B10A-1F25DA9899D8}" = Quicken 2004
"InstallShield_{F673E347-F2D2-44BB-A430-AB3EE02A3902}" = Ultimate Solitaire 500
"Jewel Quest" = Jewel Quest (remove only)
"Keno Special Edition" = Keno Special Edition
"Lexicon Special Edition" = Lexicon Special Edition
"LimeWire" = LimeWire 5.4.6
"Luxor AR" = Luxor Amun Rising (remove only)
"Luxor2" = Luxor 2 (remove only)
"Mahjongg Platinum 3" = Mahjongg Platinum 3
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Maze Cube" = Maze Cube
"Micro Innovations Wireless Laser Mouse" = Micro Innovations Wireless Laser Mouse
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mobile Broadband Generic Drivers" = Mobile Broadband Generic Drivers
"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
"MVP Word Search" = MVP Word Search
"NVIDIA Drivers" = NVIDIA Drivers
"Peggle Deluxe 1.0" = Peggle Deluxe 1.0
"Penguin Puzzle" = Penguin Puzzle
"PS2" = PS2
"Puzzle And Word Games" = Puzzle And Word Games
"Python 2.2 combined Win32 extensions" = Python 2.2 combined Win32 extensions
"Python 2.2.1" = Python 2.2.1
"Shockwave" = Shockwave
"Slide Puzzle" = Slide Puzzle
"Solitaire Master 5" = Solitaire Master 5
"Space Puzzle" = Space Puzzle
"StreetPlugin" = Learn2 Player (Uninstall Only)
"Twistingo" = Twistingo
"Ultimate Mahjongg 10" = Ultimate Mahjongg 10
"Ultimate Puzzles 500" = Ultimate Puzzles 500
"ViewpointMediaPlayer" = Viewpoint Media Player
"WIC" = Windows Imaging Component
"WildTangent CDA" = WildTangent Web Driver
"Windows XP Service Pack" = Windows XP Service Pack 3
"Word Mojo Deluxe" = Word Mojo Deluxe
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update
"Zuma Deluxe 1.0" = Zuma Deluxe 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.2

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/8/2010 3:37:05 PM | Computer Name = OWNER | Source = Google Update | ID = 20
Description =

Error - 7/8/2010 4:37:05 PM | Computer Name = OWNER | Source = Google Update | ID = 20
Description =

Error - 7/8/2010 5:37:05 PM | Computer Name = OWNER | Source = Google Update | ID = 20
Description =

Error - 7/8/2010 6:37:05 PM | Computer Name = OWNER | Source = Google Update | ID = 20
Description =

Error - 7/8/2010 7:37:08 PM | Computer Name = OWNER | Source = Google Update | ID = 20
Description =

Error - 7/8/2010 8:37:05 PM | Computer Name = OWNER | Source = Google Update | ID = 20
Description =

Error - 7/8/2010 10:42:02 PM | Computer Name = OWNER | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.2.3828, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 7/8/2010 10:42:06 PM | Computer Name = OWNER | Source = Application Error | ID = 1000
Description = Faulting application plugin-container.exe, version 1.9.2.3828, faulting
module ntdll.dll, version 5.1.2600.5755, fault address 0x0000100b.

Error - 7/9/2010 7:37:05 PM | Computer Name = OWNER | Source = Google Update | ID = 20
Description =

Error - 7/9/2010 8:37:05 PM | Computer Name = OWNER | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 7/9/2010 7:12:47 PM | Computer Name = OWNER | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 7/9/2010 7:12:47 PM | Computer Name = OWNER | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 7/9/2010 7:12:48 PM | Computer Name = OWNER | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 7/9/2010 7:12:48 PM | Computer Name = OWNER | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 7/9/2010 7:12:48 PM | Computer Name = OWNER | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 7/9/2010 7:12:48 PM | Computer Name = OWNER | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 7/9/2010 7:12:48 PM | Computer Name = OWNER | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 7/9/2010 7:12:48 PM | Computer Name = OWNER | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 7/10/2010 11:56:24 AM | Computer Name = OWNER | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2

Error - 7/10/2010 2:40:48 PM | Computer Name = OWNER | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2


< End of report >



And as for the GMER. I uncchecked what you told me to and ran scan. After a while my computer would reboot and a microsoft wondows error messgae came up and this is what it says

"Error signature
BCCode : 100000d1 BCP1 : 30BA122B BCP2 :000001C BCP3 : 00000001
BCP4 : 85F1C004 OSVer : 5_1_2600 SP : 3_0 Product : 768_1



I did try to run it again and the same thing happened.
Post #4
Hi,

Please go to VirSCAN
  • Click on Browse.
  • On the File Upload window, copy/paste the text below into the File name box:
    C:\WINDOWS\System32\SIntfNT.dll
  • Click Upload. Allow the file to be scanned. If it says already scanned – click Reanalyze Now
Please post the results in your next reply.

–Next–

Try running GMER in safe mode. To do this,
  • Restart your computer.
  • Keep on tapping f8 when windows starts to boot. Do this before you see the windows screen.
  • When a list of menu appears, scroll to Safe Mode using the arrow keys then press Enter.
Run GMER with the settings specified above. If that still won't work then open GMER, click on the box beside "Files" to uncheck it. Then run.

To post in your next reply:
1. VirSCAN log.
2. GMER log.
Post #5
Ok tried to run Gmer in safe mode and once I hit scan, the program just shut off. I tried unchecking folders and it did the same. Here is the other file a-squared 4.0.0.32 20090604013225 2009-06-04 Virus.Win32.Killmbr.D!IK 2.052 AhnLab V3 2009.06.05.00 2009.06.05 2009-06-05 Win-Trojan/Dialer.712704.B 0.741 AntiVir 8.2.0.180 7.1.4.59 2009-06-04 KIT/GhostDial.1 0.553 Antiy 2.0.18 20090604.2498051 2009-06-04 Trojan/Win32.Dialer.gvg 0.155 Arcavir 2009 200906041608 2009-06-04 Dialer.Bib 0.390 Authentium 5.1.1 200906041652 2009-06-04 W32/Trojan2.DOJN (Exact) 1.175 AVAST! 4.7.4 090604-0 2009-06-04 Win32:Dialer-1314 [Trj] 0.051 AVG 8.5.286 270.12.53/2155 2009-06-05 Dialer.KNV 0.374 BitDefender 7.81008.3335505 7.25811 2009-06-05 Trojan.Generic.1004008 0.752 CA (VET) 9.0.0.143 31.6.6539 2009-06-05 - 9.172 ClamAV 0.95.1 9421 2009-06-05 Dialer-3765 0.180 Comodo 3.9 1259 2009-06-04 ApplicUnwnt.Win32.PornTool.Agent.fi 0.743 CP Secure 1.1.0.715 2009.06.03 2009-06-03 - 9.973 Dr.Web 4.44.0.9170 2009.06.05 2009-06-05 BackDoor.Pigeon.12989 4.852 F-Prot 4.4.4.56 20090604 2009-06-04 W32/Trojan2.DOJN (exact) 1.146 F-Secure 5.51.6100 2009.06.05.03 2009-06-05 - 5.786 Fortinet 2.81-3.117 10.466 2009-06-04 Suspicious 0.353 GData 19.5615/19.353 20090605 2009-06-05 Win32:Dialer-1313 [Trj] [Engine:B] 4.388 Ikarus T3.1.01.57 2009.06.03.72814 2009-06-03 Virus.Win32.Killmbr.D 3.108 JiangMin 11.0.706 2009.06.03 2009-06-03 Trojan/Dialer.gnc 2.068 Kaspersky 5.5.10 2009.06.05 2009-06-05 not-a-virus:Porn-Dialer.Win32.Agent.fi 0.081 KingSoft 2009.2.5.15 2009.6.4.21 2009-06-04 Win32.Hack.ReSSDT.c.716800 0.506 McAfee 5.3.00 5636 2009-06-04 BackDoor-DSQ 2.974 Microsoft 1.4701 2009.06.04 2009-06-04 Backdoor:Win32/Farfli.J 4.287 mks_vir 2.01 2009.06.05 2009-06-05 - 3.350 Norman 6.01.05 6.01.00 2009-06-02 W32/Dialer.DHRP 4.009 nProtect 20090604.01 4070376 2009-06-04 Trojan/W32.Dialer.712704 5.231 Panda 9.05.01 2009.06.04 2009-06-04 - 1.861 Quick Heal 10.00 2009.06.05 2009-06-05 - 1.369 Rising 20.0 21.32.34.00 2009-06-04 Backdoor.Win32.Drwolf.axh 0.990 Sophos 2.87.1 4.42 2009-06-05 Mal/Whybo-A 2.442 Sunbelt 5170 5170 2009-06-04 Porn-Dialer.Win32.Agent.fi 0.939 Symantec 1.3.0.24 20090604.002 2009-06-04 - 0.062 The Hacker 6.3.4.3 v00340 2009-06-04 Trojan/Dialer.Agent.fi 0.628 Trend Micro 8.700-1004 6.170.08 2009-06-04 TROJ_DIAL.RHB 0.062 VBA32 3.12.10.6 20090604.1412 2009-06-04 Porn-Dialer.Win32.Agent.fi 1.958 ViRobot 20090604 2009.06.04 2009-06-04 - 0.424 VirusBuster 4.5.11.10 10.107.2/1575686 2009-06-04 Dialer.Agent.IFEU 1.896 I see alot of bad in this file including porn. all I have to say is that im going to have a long talk with my father about what he does online. :)
Post #6
Hi,

Have you installed games like Warcraft 3 or Zeus or something like those before?

Let's run this scan instead:

We Need to check for Rootkits with RootRepeal
Please download RootRepeal one of these locations and save it to your desktop
Here
Here
Here
  • Open [external image: Posted Image] on your desktop.
  • Click the [external image: Posted Image] tab.
  • Click the [external image: Posted Image] button.
  • Check just these boxes:
  • [external image: Posted Image]
  • Push Ok
  • Check the box for your main system drive (Usually C:, and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your post.
Post #7
Here ya go my friend. ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2010/07/11 22:03 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xF4B83000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7A29000 Size: 8192 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xBA263000 Size: 49152 File Visible: No Signed: - Status: - SSDT ——————- #: 041 Function Name: NtCreateKey Status: Hooked by "Lbd.sys" at address 0xf74d787e #: 247 Function Name: NtSetValueKey Status: Hooked by "Lbd.sys" at address 0xf74d7bfe ==EOF==
Post #8
Hi,

How about this?

Have you installed games like Warcraft 3 or Zeus or something like those before?


As these files seems to be from Securom:

[2005/08/31 16:48:39 | 000,021,840 | —- | C] () – C:\WINDOWS\System32\SIntfNT.dll
[2005/08/31 16:48:39 | 000,017,212 | —- | C] () – C:\WINDOWS\System32\SIntf32.dll
[2005/08/31 16:48:39 | 000,012,067 | —- | C] () – C:\WINDOWS\System32\SIntf16.dll
Post #9
I installed Diablo 2 about 4 years ago and its been out of the system since….I think. I do install a bunch of cd-rom games like Bejeweled and carp** like that for my mom. But nothing off the internet.
Post #10
Hi,

Ok then. Please do the following:

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1

:Files
C:\WINDOWS\System32\SIntfNT.dll
C:\WINDOWS\System32\SIntf32.dll
C:\WINDOWS\System32\SIntf16.dll

:Commands
[purity]
[emptytemp]
[emptyflash]
  • Then click the Run Fix button at the top.
  • Let the program run unhindered, reboot when it is done.
  • Then post the result and a new OTL log in your next reply. ( don't check the boxes beside LOP Check or Purity this time )
–Next–

Please download Malwarebytes' Anti-Malware to your desktop.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post back the log.
Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so immediately.

To post in your next reply:
1. OTL logs.
2. Malwarebytes' log.
Post #11
Heres mbam log


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

7/12/2010 9:46:22 PM
mbam-log-2010-07-12 (21-46-22).txt

Scan type: Quick scan
Objects scanned: 138359
Time elapsed: 7 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)






Heres the OTL

OTL logfile created on: 7/12/2010 9:29:57 PM - Run 2
OTL by OldTimer - Version 3.2.9.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 558.00 Mb Available Physical Memory | 55.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 147.14 Gb Total Space | 129.97 Gb Free Space | 88.33% Space Free | Partition Type: NTFS
Drive D: | 5.50 Gb Total Space | 0.94 Gb Free Space | 17.07% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive N: | 42.34 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: OWNER
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Micro Innovations\Wireless Laser Mouse\moffice.exe ()
PRC - C:\Program Files\Micro Innovations\Wireless Laser Mouse\mouse32a.dat ()
PRC - C:\Program Files\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
PRC - C:\WINDOWS\ltmsg.exe (Agere Systems)
PRC - C:\Program Files\HP\Digital Imaging\Unload\HpqCmon.exe ()
PRC - C:\WINDOWS\system32\usrmlnka.exe (U.S. Robotics Corporation)
PRC - C:\WINDOWS\system32\usrshuta.exe ( U.S. Robotics Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\Program Files\Micro Innovations\Wireless Laser Mouse\mouDL32A.dll ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Driver Services (SafeList) ==========

DRV - (Sunkfiltp) – C:\WINDOWS\System32\Drivers\sunkfiltp.sys File not found
DRV - (PCTINDIS5) – C:\WINDOWS\System32\PCTINDIS5.SYS File not found
DRV - (hwdatacard) – C:\WINDOWS\System32\DRIVERS\ewusbmdm.sys File not found
DRV - (ewusbnet) – C:\WINDOWS\System32\DRIVERS\ewusbnet.sys File not found
DRV - (catchme) – C:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys File not found
DRV - (AvgTdiX) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (NWUSBCDFIL) – C:\WINDOWS\system32\drivers\NwUsbCdFil.sys (Novatel Wireless Inc.)
DRV - (NWADI) – C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (NWUSBPort2) – C:\WINDOWS\system32\drivers\nwusbser2.sys (Novatel Wireless Inc.)
DRV - (NWUSBPort) – C:\WINDOWS\system32\drivers\nwusbser.sys (Novatel Wireless Inc.)
DRV - (NWUSBModem) – C:\WINDOWS\system32\drivers\nwusbmdm.sys (Novatel Wireless Inc.)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (hwusbdev) – C:\WINDOWS\system32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.)
DRV - (SMSIVZAM5) – C:\Program Files\Verizon Wireless\VZAccess Manager\SMSIVZAM5.sys (Smith Micro Inc.)
DRV - (moufiltr) – C:\WINDOWS\system32\drivers\moufiltr.sys (Chic Tech.)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (S3Psddr) – C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (nv_agp) – C:\WINDOWS\System32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (SunkFilt) – C:\WINDOWS\system32\drivers\Sunkfilt.sys (Alcor Micro Corp.)
DRV - (viaagp1) – C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (ltmodem5) – C:\WINDOWS\system32\drivers\ltmdmnt.sys (Agere Systems)
DRV - (fasttx2k) – C:\WINDOWS\System32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (NVENET) – C:\WINDOWS\system32\drivers\NVENET.sys (NVIDIA Corporation)
DRV - (SiSkp) – C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SISAGP) – C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (rtl8139) – C:\WINDOWS\system32\drivers\R8139n51.sys (Realtek Semiconductor Corporation )
DRV - (USRpdA) – C:\WINDOWS\system32\drivers\USRpdA.sys (U.S. Robotics Corporation)
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.825
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/06/02 10:24:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/06 10:56:34 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/06 18:31:48 | 000,000,000 | —D | M]

[2010/01/17 13:46:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2010/01/17 13:46:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions\[removed]
[2010/07/12 18:52:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\z1i3q6r7.default\extensions
[2010/04/26 22:07:10 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\z1i3q6r7.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/12 18:52:49 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/05/10 09:16:41 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2009/11/19 18:16:28 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2010/05/10 09:16:26 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/11/19 18:16:29 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll

O1 HOSTS File: ([2006/02/22 16:40:20 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\HpqCmon.exe ()
O4 - HKLM..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Micro Innovations\Wireless Laser Mouse\moffice.exe ()
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe (HP)
O4 - HKLM..\Run: [LTMSG] C:\WINDOWS\ltmsg.exe (Agere Systems)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PS2] C:\WINDOWS\system32\ps2.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
O4 - HKLM..\Run: [USRpdA] File not found
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: //@mail.mar@ ([]msn in Local intranet)
O15 - HKCU\..Trusted Domains: //@signup.mar@ ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab (Reg Error: Key error.)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} https://objects.aol.com/mcafee/molbin/share…83/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} https://objects.aol.com/mcafee/molbin/share…,20/McGDMgr.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.4.2/jinstall-…indows-i586.cab (Java Plug-in 1.4.2)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll (PCPitstop Exam)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/10/10 22:32:03 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2008/08/21 03:39:48 | 000,000,074 | R— | M] () - N:\AUTORUN.INF – [ CDFS ]
O33 - MountPoints2\{210c20f2-83e7-11df-86fc-947f58fdaa7b}\Shell - "" = AutoRun
O33 - MountPoints2\{210c20f2-83e7-11df-86fc-947f58fdaa7b}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{210c20f2-83e7-11df-86fc-947f58fdaa7b}\Shell\AutoRun\command - "" = M:\VZAccess_Manager.exe – File not found
O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell - "" = AutoRun
O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell\AutoRun\command - "" = K:\AutoRun.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/07/11 21:57:25 | 000,472,064 | —- | C] ( ) – C:\Documents and Settings\Owner\Desktop\RootRepeal.exe
[2010/07/10 14:52:00 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/06/29 21:36:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Verizon Wireless
[2010/06/29 21:34:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\WEngineLite
[2010/06/29 21:34:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Verizon Wireless
[2010/06/29 21:33:07 | 000,000,000 | —D | C] – C:\Program Files\Verizon Wireless
[2010/06/29 21:32:23 | 000,000,000 | —D | C] – C:\Program Files\Novatel Wireless
[2010/06/29 21:32:16 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Downloaded Installations
[2010/06/29 21:32:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\InstallShield
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/12 20:37:05 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/12 18:21:47 | 061,925,743 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/07/12 18:15:05 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/07/12 18:14:34 | 000,022,391 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/07/12 18:14:30 | 000,000,188 | —- | M] () – C:\WINDOWS\System\hpsysdrv.DAT
[2010/07/12 18:14:24 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/12 18:14:17 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/12 18:14:11 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/12 18:14:09 | 1073,139,712 | -HS- | M] () – C:\hiberfil.sys
[2010/07/12 14:55:05 | 003,670,016 | -H– | M] () – C:\Documents and Settings\Owner\NTUSER.DAT
[2010/07/12 14:55:05 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Owner\ntuser.ini
[2010/07/11 22:31:17 | 002,110,502 | -H– | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db
[2010/07/11 22:00:26 | 000,000,015 | —- | M] () – C:\Documents and Settings\Owner\Desktop\settings.dat
[2010/07/11 21:57:52 | 000,472,064 | —- | M] ( ) – C:\Documents and Settings\Owner\Desktop\RootRepeal.exe
[2010/07/11 18:08:29 | 000,000,088 | —- | M] () – C:\WINDOWS\popcinfo.dat
[2010/07/10 15:07:51 | 000,284,915 | —- | M] () – C:\Documents and Settings\Owner\Desktop\gmer.zip
[2010/07/10 14:52:06 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/07/08 20:01:40 | 000,002,447 | —- | M] () – C:\Documents and Settings\Owner\Desktop\HiJackThis (2).lnk
[2010/06/29 21:34:41 | 000,001,024 | —- | M] () – C:\Documents and Settings\All Users\Desktop\VZAccess Manager.lnk
[2010/06/29 21:33:43 | 000,524,016 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/29 21:33:43 | 000,442,466 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/29 21:33:43 | 000,071,732 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/24 20:14:07 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/22 18:52:14 | 000,034,680 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/06/21 13:06:47 | 000,156,360 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/11 22:00:02 | 000,000,015 | —- | C] () – C:\Documents and Settings\Owner\Desktop\settings.dat
[2010/07/11 15:25:59 | 1073,139,712 | -HS- | C] () – C:\hiberfil.sys
[2010/07/10 15:08:26 | 000,293,376 | —- | C] () – C:\Documents and Settings\Owner\Desktop\gmer.exe
[2010/07/10 15:07:50 | 000,284,915 | —- | C] () – C:\Documents and Settings\Owner\Desktop\gmer.zip
[2010/07/08 20:01:29 | 000,002,447 | —- | C] () – C:\Documents and Settings\Owner\Desktop\HiJackThis (2).lnk
[2010/06/29 21:34:41 | 000,001,024 | —- | C] () – C:\Documents and Settings\All Users\Desktop\VZAccess Manager.lnk
[2010/03/06 15:58:15 | 000,021,504 | —- | C] () – C:\WINDOWS\jestertb.dll
[2009/02/12 19:24:30 | 000,000,032 | —- | C] () – C:\WINDOWS\AuthMgr.INI
[2007/05/05 20:29:36 | 000,000,014 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/10/22 13:22:00 | 000,212,992 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/06/09 13:53:23 | 000,000,000 | —- | C] () – C:\WINDOWS\MSDraw.ini
[2006/05/30 16:37:32 | 000,455,168 | —- | C] () – C:\WINDOWS\System32\redllw32.dll
[2006/05/30 16:37:32 | 000,240,128 | —- | C] () – C:\WINDOWS\System32\PDDLLW32.DLL
[2005/11/16 17:44:44 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/10/23 12:13:03 | 000,000,170 | —- | C] () – C:\WINDOWS\GetServer.ini
[2005/08/31 16:48:39 | 000,021,840 | —- | C] () – C:\WINDOWS\System32\SIntfNT.dll
[2005/08/31 16:48:39 | 000,017,212 | —- | C] () – C:\WINDOWS\System32\SIntf32.dll
[2005/08/31 16:48:39 | 000,012,067 | —- | C] () – C:\WINDOWS\System32\SIntf16.dll
[2005/07/19 11:21:49 | 000,000,414 | —- | C] () – C:\WINDOWS\hpbvspst.ini
[2005/07/18 15:50:03 | 000,001,990 | —- | C] () – C:\WINDOWS\hpdj3740.ini
[2005/07/14 20:37:14 | 000,000,431 | —- | C] () – C:\WINDOWS\MVPWORD.INI
[2005/07/13 16:39:40 | 000,000,026 | —- | C] () – C:\WINDOWS\UP9ASP.INI
[2005/07/13 16:27:26 | 000,000,099 | —- | C] () – C:\WINDOWS\upst.ini
[2005/07/13 16:27:26 | 000,000,024 | —- | C] () – C:\WINDOWS\atid.ini
[2005/07/13 15:33:00 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2005/07/13 15:33:00 | 001,470,464 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2005/07/13 15:33:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2005/07/13 15:33:00 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2005/07/13 15:33:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2005/07/13 15:33:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2005/07/11 13:33:31 | 000,240,640 | —- | C] () – C:\WINDOWS\System32\nmocod.dll
[2005/07/11 13:31:31 | 000,000,082 | —- | C] () – C:\WINDOWS\usrwiz.ini
[2003/10/14 01:41:40 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/10/14 01:24:52 | 000,002,154 | —- | C] () – C:\WINDOWS\System32\mshrml.ini
[2003/10/13 18:52:52 | 000,000,438 | —- | C] () – C:\WINDOWS\System32\1_ssetup.ini
[2003/10/13 18:52:52 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\sunistlog.ini
[2003/10/11 01:33:40 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll
[2003/10/11 01:33:10 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2003/10/11 01:33:10 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2003/10/11 01:29:24 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2003/10/11 01:24:47 | 000,030,203 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2003/10/11 01:24:29 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\syscontr.dll
[2003/10/11 01:23:52 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2003/10/11 01:18:34 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/10/11 01:07:37 | 000,000,907 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2003/10/10 23:31:33 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/10/10 22:56:51 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2003/10/10 22:56:51 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2003/10/10 22:56:33 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2003/10/10 22:35:14 | 000,000,904 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/10/10 22:22:28 | 000,000,667 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/09/23 04:19:42 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/03/27 16:28:44 | 000,004,955 | —- | C] () – C:\WINDOWS\System32\DProg.ini
[2003/01/08 01:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/03/13 16:46:46 | 000,053,248 | R— | C] () – C:\WINDOWS\System32\zlib.dll
[1999/07/23 13:46:48 | 000,000,116 | —- | C] () – C:\WINDOWS\AuHCcup1.ini
[1999/07/23 10:53:20 | 000,129,536 | —- | C] () – C:\WINDOWS\AuHCcup1.dll
[1997/11/17 18:13:16 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll

========== Custom Scans ==========


< :OTL >

< O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found. >

< O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. >

< @Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 >

< >

< :Files >

< C:\WINDOWS\System32\SIntfNT.dll >
[2005/09/11 16:43:06 | 000,021,840 | —- | M] () – C:\WINDOWS\system32\SIntfNT.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

< C:\WINDOWS\System32\SIntf32.dll >
[2005/09/11 16:43:06 | 000,017,212 | —- | M] () – C:\WINDOWS\system32\SIntf32.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

< C:\WINDOWS\System32\SIntf16.dll >
[2005/09/11 16:43:06 | 000,012,067 | —- | M] () – C:\WINDOWS\system32\SIntf16.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

< >

< :Commands >

< [purity] >

< [emptytemp] >

< [emptyflash] >

========== Alternate Data Streams ==========

@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
< End of report >
Post #12
Hi,

Let's run the OTL fix again. Please do not copy the word "CODE".

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell - "" = AutoRun
O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell\AutoRun\command - "" = K:\AutoRun.exe – File not found

:Files
C:\WINDOWS\System32\SIntfNT.dll
C:\WINDOWS\System32\SIntf32.dll
C:\WINDOWS\System32\SIntf16.dll

:Commands
[purity]
[emptytemp]
[emptyflash]
  • Then click the Run Fix button at the top.
  • Let the program run unhindered, reboot when it is done.
  • Then post the result and a new OTL log in your next reply. ( don't check the boxes beside LOP Check or Purity this time )
Post #13
:pullhair: Woops, didnt realize I copied that.


Ok heres the new file

OTL logfile created on: 7/14/2010 11:38:32 AM - Run 3
OTL by OldTimer - Version 3.2.9.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 572.00 Mb Available Physical Memory | 56.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 147.14 Gb Total Space | 130.24 Gb Free Space | 88.51% Space Free | Partition Type: NTFS
Drive D: | 5.50 Gb Total Space | 0.94 Gb Free Space | 17.07% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive N: | 42.34 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: OWNER
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Micro Innovations\Wireless Laser Mouse\moffice.exe ()
PRC - C:\Program Files\Micro Innovations\Wireless Laser Mouse\mouse32a.dat ()
PRC - C:\Program Files\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
PRC - C:\WINDOWS\ltmsg.exe (Agere Systems)
PRC - C:\Program Files\HP\Digital Imaging\Unload\HpqCmon.exe ()
PRC - C:\WINDOWS\system32\usrmlnka.exe (U.S. Robotics Corporation)
PRC - C:\WINDOWS\system32\usrshuta.exe ( U.S. Robotics Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\Program Files\Micro Innovations\Wireless Laser Mouse\mouDL32A.dll ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Driver Services (SafeList) ==========

DRV - (Sunkfiltp) – C:\WINDOWS\System32\Drivers\sunkfiltp.sys File not found
DRV - (PCTINDIS5) – C:\WINDOWS\System32\PCTINDIS5.SYS File not found
DRV - (hwdatacard) – C:\WINDOWS\System32\DRIVERS\ewusbmdm.sys File not found
DRV - (ewusbnet) – C:\WINDOWS\System32\DRIVERS\ewusbnet.sys File not found
DRV - (catchme) – C:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys File not found
DRV - (AvgTdiX) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (NWUSBCDFIL) – C:\WINDOWS\system32\drivers\NwUsbCdFil.sys (Novatel Wireless Inc.)
DRV - (NWADI) – C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (NWUSBPort2) – C:\WINDOWS\system32\drivers\nwusbser2.sys (Novatel Wireless Inc.)
DRV - (NWUSBPort) – C:\WINDOWS\system32\drivers\nwusbser.sys (Novatel Wireless Inc.)
DRV - (NWUSBModem) – C:\WINDOWS\system32\drivers\nwusbmdm.sys (Novatel Wireless Inc.)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (hwusbdev) – C:\WINDOWS\system32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.)
DRV - (SMSIVZAM5) – C:\Program Files\Verizon Wireless\VZAccess Manager\SMSIVZAM5.sys (Smith Micro Inc.)
DRV - (moufiltr) – C:\WINDOWS\system32\drivers\moufiltr.sys (Chic Tech.)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (S3Psddr) – C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (nv_agp) – C:\WINDOWS\System32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (SunkFilt) – C:\WINDOWS\system32\drivers\Sunkfilt.sys (Alcor Micro Corp.)
DRV - (viaagp1) – C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (ltmodem5) – C:\WINDOWS\system32\drivers\ltmdmnt.sys (Agere Systems)
DRV - (fasttx2k) – C:\WINDOWS\System32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (NVENET) – C:\WINDOWS\system32\drivers\NVENET.sys (NVIDIA Corporation)
DRV - (SiSkp) – C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SISAGP) – C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (rtl8139) – C:\WINDOWS\system32\drivers\R8139n51.sys (Realtek Semiconductor Corporation )
DRV - (USRpdA) – C:\WINDOWS\system32\drivers\USRpdA.sys (U.S. Robotics Corporation)
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.825
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/06/02 10:24:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/06 10:56:34 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/06 18:31:48 | 000,000,000 | —D | M]

[2010/01/17 13:46:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2010/01/17 13:46:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions\[removed]
[2010/07/12 18:52:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\z1i3q6r7.default\extensions
[2010/04/26 22:07:10 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\z1i3q6r7.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/12 18:52:49 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/05/10 09:16:41 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2009/11/19 18:16:28 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2010/05/10 09:16:26 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/11/19 18:16:29 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll

O1 HOSTS File: ([2006/02/22 16:40:20 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\HpqCmon.exe ()
O4 - HKLM..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Micro Innovations\Wireless Laser Mouse\moffice.exe ()
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe (HP)
O4 - HKLM..\Run: [LTMSG] C:\WINDOWS\ltmsg.exe (Agere Systems)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PS2] C:\WINDOWS\system32\ps2.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
O4 - HKLM..\Run: [USRpdA] File not found
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: //@mail.mar@ ([]msn in Local intranet)
O15 - HKCU\..Trusted Domains: //@signup.mar@ ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab (Reg Error: Key error.)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} https://objects.aol.com/mcafee/molbin/share…83/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} https://objects.aol.com/mcafee/molbin/share…,20/McGDMgr.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.4.2/jinstall-…indows-i586.cab (Java Plug-in 1.4.2)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll (PCPitstop Exam)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/10/10 22:32:03 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2008/08/21 03:39:48 | 000,000,074 | R— | M] () - N:\AUTORUN.INF – [ CDFS ]
O33 - MountPoints2\{210c20f2-83e7-11df-86fc-947f58fdaa7b}\Shell - "" = AutoRun
O33 - MountPoints2\{210c20f2-83e7-11df-86fc-947f58fdaa7b}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{210c20f2-83e7-11df-86fc-947f58fdaa7b}\Shell\AutoRun\command - "" = M:\VZAccess_Manager.exe – File not found
O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell - "" = AutoRun
O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell\AutoRun\command - "" = K:\AutoRun.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/07/11 21:57:25 | 000,472,064 | —- | C] ( ) – C:\Documents and Settings\Owner\Desktop\RootRepeal.exe
[2010/07/10 14:52:00 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/06/29 21:36:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Verizon Wireless
[2010/06/29 21:34:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\WEngineLite
[2010/06/29 21:34:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Verizon Wireless
[2010/06/29 21:33:07 | 000,000,000 | —D | C] – C:\Program Files\Verizon Wireless
[2010/06/29 21:32:23 | 000,000,000 | —D | C] – C:\Program Files\Novatel Wireless
[2010/06/29 21:32:16 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Downloaded Installations
[2010/06/29 21:32:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\InstallShield
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/14 11:39:10 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/07/14 11:37:01 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/14 11:25:58 | 061,977,519 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/07/14 11:15:20 | 000,022,391 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/07/14 11:15:16 | 000,000,188 | —- | M] () – C:\WINDOWS\System\hpsysdrv.DAT
[2010/07/14 11:15:12 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/14 11:14:20 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/14 11:14:15 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/14 11:14:11 | 1073,139,712 | -HS- | M] () – C:\hiberfil.sys
[2010/07/13 10:40:29 | 003,670,016 | -H– | M] () – C:\Documents and Settings\Owner\NTUSER.DAT
[2010/07/13 10:40:29 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Owner\ntuser.ini
[2010/07/11 22:31:17 | 002,110,502 | -H– | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db
[2010/07/11 22:00:26 | 000,000,015 | —- | M] () – C:\Documents and Settings\Owner\Desktop\settings.dat
[2010/07/11 21:57:52 | 000,472,064 | —- | M] ( ) – C:\Documents and Settings\Owner\Desktop\RootRepeal.exe
[2010/07/11 18:08:29 | 000,000,088 | —- | M] () – C:\WINDOWS\popcinfo.dat
[2010/07/10 15:07:51 | 000,284,915 | —- | M] () – C:\Documents and Settings\Owner\Desktop\gmer.zip
[2010/07/10 14:52:06 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/07/08 20:01:40 | 000,002,447 | —- | M] () – C:\Documents and Settings\Owner\Desktop\HiJackThis (2).lnk
[2010/06/29 21:34:41 | 000,001,024 | —- | M] () – C:\Documents and Settings\All Users\Desktop\VZAccess Manager.lnk
[2010/06/29 21:33:43 | 000,524,016 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/29 21:33:43 | 000,442,466 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/29 21:33:43 | 000,071,732 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/24 20:14:07 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/22 18:52:14 | 000,034,680 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/06/21 13:06:47 | 000,156,360 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/11 22:00:02 | 000,000,015 | —- | C] () – C:\Documents and Settings\Owner\Desktop\settings.dat
[2010/07/11 15:25:59 | 1073,139,712 | -HS- | C] () – C:\hiberfil.sys
[2010/07/10 15:08:26 | 000,293,376 | —- | C] () – C:\Documents and Settings\Owner\Desktop\gmer.exe
[2010/07/10 15:07:50 | 000,284,915 | —- | C] () – C:\Documents and Settings\Owner\Desktop\gmer.zip
[2010/07/08 20:01:29 | 000,002,447 | —- | C] () – C:\Documents and Settings\Owner\Desktop\HiJackThis (2).lnk
[2010/06/29 21:34:41 | 000,001,024 | —- | C] () – C:\Documents and Settings\All Users\Desktop\VZAccess Manager.lnk
[2010/03/06 15:58:15 | 000,021,504 | —- | C] () – C:\WINDOWS\jestertb.dll
[2009/02/12 19:24:30 | 000,000,032 | —- | C] () – C:\WINDOWS\AuthMgr.INI
[2007/05/05 20:29:36 | 000,000,014 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/10/22 13:22:00 | 000,212,992 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/06/09 13:53:23 | 000,000,000 | —- | C] () – C:\WINDOWS\MSDraw.ini
[2006/05/30 16:37:32 | 000,455,168 | —- | C] () – C:\WINDOWS\System32\redllw32.dll
[2006/05/30 16:37:32 | 000,240,128 | —- | C] () – C:\WINDOWS\System32\PDDLLW32.DLL
[2005/11/16 17:44:44 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/10/23 12:13:03 | 000,000,170 | —- | C] () – C:\WINDOWS\GetServer.ini
[2005/08/31 16:48:39 | 000,021,840 | —- | C] () – C:\WINDOWS\System32\SIntfNT.dll
[2005/08/31 16:48:39 | 000,017,212 | —- | C] () – C:\WINDOWS\System32\SIntf32.dll
[2005/08/31 16:48:39 | 000,012,067 | —- | C] () – C:\WINDOWS\System32\SIntf16.dll
[2005/07/19 11:21:49 | 000,000,414 | —- | C] () – C:\WINDOWS\hpbvspst.ini
[2005/07/18 15:50:03 | 000,001,990 | —- | C] () – C:\WINDOWS\hpdj3740.ini
[2005/07/14 20:37:14 | 000,000,431 | —- | C] () – C:\WINDOWS\MVPWORD.INI
[2005/07/13 16:39:40 | 000,000,026 | —- | C] () – C:\WINDOWS\UP9ASP.INI
[2005/07/13 16:27:26 | 000,000,099 | —- | C] () – C:\WINDOWS\upst.ini
[2005/07/13 16:27:26 | 000,000,024 | —- | C] () – C:\WINDOWS\atid.ini
[2005/07/13 15:33:00 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2005/07/13 15:33:00 | 001,470,464 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2005/07/13 15:33:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2005/07/13 15:33:00 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2005/07/13 15:33:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2005/07/13 15:33:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2005/07/11 13:33:31 | 000,240,640 | —- | C] () – C:\WINDOWS\System32\nmocod.dll
[2005/07/11 13:31:31 | 000,000,082 | —- | C] () – C:\WINDOWS\usrwiz.ini
[2003/10/14 01:41:40 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/10/14 01:24:52 | 000,002,154 | —- | C] () – C:\WINDOWS\System32\mshrml.ini
[2003/10/13 18:52:52 | 000,000,438 | —- | C] () – C:\WINDOWS\System32\1_ssetup.ini
[2003/10/13 18:52:52 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\sunistlog.ini
[2003/10/11 01:33:40 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll
[2003/10/11 01:33:10 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2003/10/11 01:33:10 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2003/10/11 01:29:24 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2003/10/11 01:24:47 | 000,030,203 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2003/10/11 01:24:29 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\syscontr.dll
[2003/10/11 01:23:52 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2003/10/11 01:18:34 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/10/11 01:07:37 | 000,000,907 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2003/10/10 23:31:33 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/10/10 22:56:51 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2003/10/10 22:56:51 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2003/10/10 22:56:33 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2003/10/10 22:35:14 | 000,000,904 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/10/10 22:22:28 | 000,000,667 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/09/23 04:19:42 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/03/27 16:28:44 | 000,004,955 | —- | C] () – C:\WINDOWS\System32\DProg.ini
[2003/01/08 01:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/03/13 16:46:46 | 000,053,248 | R— | C] () – C:\WINDOWS\System32\zlib.dll
[1999/07/23 13:46:48 | 000,000,116 | —- | C] () – C:\WINDOWS\AuHCcup1.ini
[1999/07/23 10:53:20 | 000,129,536 | —- | C] () – C:\WINDOWS\AuHCcup1.dll
[1997/11/17 18:13:16 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll

========== Custom Scans ==========


< :OTL >

< O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found. >

< O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. >

< @Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 >

< O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell - "" = AutoRun >

< O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell\AutoRun - "" = Auto&Play; >

< O33 - MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\Shell\AutoRun\command - "" = K:\AutoRun.exe – File not found >

< >

< :Files >

< C:\WINDOWS\System32\SIntfNT.dll >
[2005/09/11 16:43:06 | 000,021,840 | —- | M] () – C:\WINDOWS\system32\SIntfNT.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

< C:\WINDOWS\System32\SIntf32.dll >
[2005/09/11 16:43:06 | 000,017,212 | —- | M] () – C:\WINDOWS\system32\SIntf32.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

< C:\WINDOWS\System32\SIntf16.dll >
[2005/09/11 16:43:06 | 000,012,067 | —- | M] () – C:\WINDOWS\system32\SIntf16.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

< >

< :Commands >

< [purity] >

< [emptytemp] >

< [emptyflash] >

========== Alternate Data Streams ==========

@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
< End of report >
Post #14
Hi,

It is the same. Begin copying from the word :OTL to [emptyflash], include those words then click on Run Fix button.

It should be the Run Fix button and not the Run Scan button.
Post #15
:thumbup: Ok thats what I was doing wrong, I was just hitting scan. Heres the correct file. All processes killed ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found. ADS C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26f80a64-ffc4-11de-8587-946eb0f9245d}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26f80a64-ffc4-11de-8587-946eb0f9245d}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{26f80a64-ffc4-11de-8587-946eb0f9245d}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26f80a64-ffc4-11de-8587-946eb0f9245d}\ not found. File K:\AutoRun.exe not found. ========== FILES ========== C:\WINDOWS\System32\SIntfNT.dll moved successfully. C:\WINDOWS\System32\SIntf32.dll moved successfully. C:\WINDOWS\System32\SIntf16.dll moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 13690439 bytes User: All Users ->Flash cache emptied: 143 bytes User: Dad ->Temp folder emptied: 1952007 bytes ->Temporary Internet Files folder emptied: 4785798 bytes ->Java cache emptied: 13706239 bytes ->FireFox cache emptied: 37624252 bytes ->Flash cache emptied: 21124 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 13690439 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Owner ->Temp folder emptied: 23456254 bytes ->Temporary Internet Files folder emptied: 7550606 bytes ->Java cache emptied: 18636753 bytes ->FireFox cache emptied: 87823266 bytes ->Flash cache emptied: 2042711 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 39097 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 78355998 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 2503812 bytes Total Files Cleaned = 292.00 mb [EMPTYFLASH] User: Administrator User: All Users ->Flash cache emptied: 0 bytes User: Dad ->Flash cache emptied: 0 bytes User: Default User User: LocalService User: NetworkService User: Owner ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.9.0 log created on 07142010_224754 Files\Folders moved on Reboot… Registry entries deleted on Reboot…

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI