Z0G7YA1I0 browser Hijacker

I have gotten a browser hijacker from somewhere, and Spysweeper doesn't seem to be able to detect and remove.

I tried to follow the instructions from previous forums, but I'm afraid I may have to be walked through some of these processes.

I did download and run ComboFix and I will attempt to post the log file here.

Thanks,
Dez


ComboFix 10-07-10.01 - Kory 07/11/2010 0:59.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.497 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Webroot AntiVirus with Spy Sweeper *On-access scanning disabled* (Updated) {77E10C7F-2CCA-4187-9394-BDBC267AD597}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Chele\Desktop\Sysinternals Antivirus.lnk
c:\documents and settings\Chele\Start Menu\Programs\Sysinternals Antivirus
c:\documents and settings\Chele\Start Menu\Programs\Sysinternals Antivirus\Sysinternals Antivirus.lnk
c:\documents and settings\Jessica\Desktop\PC_Antispyware2010.lnk
c:\documents and settings\Kory\Application Data\Razay
c:\documents and settings\Kory\Application Data\Razay\kiop.exe
c:\documents and settings\Kory\Local Settings\Temporary Internet Files\edima.db
c:\documents and settings\LocalService\Desktop\Sysinternals Antivirus.lnk
c:\program files\Internet Explorer\SET247.tmp
c:\program files\Internet Explorer\SET248.tmp
c:\program files\Internet Explorer\SET24A.tmp
c:\program files\nuar.old
c:\program files\scdata
c:\program files\scdata\dbsinit.exe
c:\program files\scdata\images\i1.gif
c:\program files\scdata\images\i2.gif
c:\program files\scdata\images\i3.gif
c:\program files\scdata\images\j1.gif
c:\program files\scdata\images\j2.gif
c:\program files\scdata\images\j3.gif
c:\program files\scdata\images\jj1.gif
c:\program files\scdata\images\jj2.gif
c:\program files\scdata\images\jj3.gif
c:\program files\scdata\images\l1.gif
c:\program files\scdata\images\l2.gif
c:\program files\scdata\images\l3.gif
c:\program files\scdata\images\pix.gif
c:\program files\scdata\images\t1.gif
c:\program files\scdata\images\t2.gif
c:\program files\scdata\images\Thumbs.db
c:\program files\scdata\images\up1.gif
c:\program files\scdata\images\up2.gif
c:\program files\scdata\images\w1.gif
c:\program files\scdata\images\w11.gif
c:\program files\scdata\images\w2.gif
c:\program files\scdata\images\w3.jpg
c:\program files\scdata\images\word.doc
c:\program files\scdata\images\wt1.gif
c:\program files\scdata\images\wt2.gif
c:\program files\scdata\images\wt3.gif
c:\program files\scdata\wispex.html
c:\program files\skynet.dat
c:\program files\wp3.dat
c:\program files\wp4.dat
c:\windows\010112010146120114.fx
c:\windows\0101120101464949.fx
c:\windows\adaway.lic
c:\windows\cookies.ini
c:\windows\DOWNLO~1\ax_Mjpeg.ocx
c:\windows\Downloaded Program Files\setup.dll
c:\windows\prxid93ps.dat
c:\windows\qugozap.scr
c:\windows\system32\bszip.dll
c:\windows\system32\JTsDNqss.ini
c:\windows\system32\JTsDNqss.ini2
c:\windows\system32\logs
c:\windows\system32\msapps\comsrvr.exe
c:\windows\system32\mvevgiej.ini
c:\windows\system32\pac.txt
c:\windows\system32\prssvGgh.ini
c:\windows\system32\prssvGgh.ini2
c:\windows\system32\vjtxiuvl.ini
c:\windows\system32\yyitefvd.ini
c:\windows\umabas._sy
c:\windows\xpsp1hfm.log

Infected copy of c:\windows\system32\drivers\netbt.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_COMServer
——-\Service_COMServer


((((((((((((((((((((((((( Files Created from 2010-06-11 to 2010-07-11 )))))))))))))))))))))))))))))))
.

2010-07-11 07:06 . 2010-07-11 07:06 212544 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-06-17 03:32 . 2010-06-17 03:32 ——– d—–w- C:\e8e8aa5ab941c21d9c
2010-06-15 22:50 . 2010-06-15 22:51 ——– d—–w- c:\documents and settings\Jessica\tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-06 02:55 . 2008-01-08 22:32 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-07-03 22:10 . 2007-06-13 02:47 ——– d—–w- c:\documents and settings\Jessica\Application Data\LimeWire
2010-07-02 18:03 . 2006-05-30 07:28 1682 –sha-w- c:\windows\system32\KGyGaAvL.sys
2010-07-02 18:03 . 2006-04-20 02:44 56 –sh–r- c:\windows\system32\19F53832F6.sys
2010-07-01 02:48 . 2009-03-04 01:59 ——– d—–w- c:\program files\PokerStars
2010-06-28 00:00 . 2006-10-02 07:57 ——– d—–w- c:\documents and settings\Kory\Application Data\Weypam
2010-06-28 00:00 . 2008-12-05 09:39 ——– d—–w- c:\documents and settings\Taylor\Application Data\Ezig
2010-06-28 00:00 . 2010-06-11 07:52 ——– d—–w- c:\documents and settings\Chele\Application Data\Naorqi
2010-06-28 00:00 . 2009-08-09 09:15 ——– d—–w- c:\documents and settings\Jessica\Application Data\Ypuz
2010-06-28 00:00 . 2007-10-20 09:11 ——– d—–w- c:\documents and settings\Kory\Application Data\Ywuk
2010-06-26 14:57 . 2010-01-15 14:04 ——– d—–w- c:\documents and settings\Kory\Application Data\Mavasy
2010-06-24 03:23 . 2008-10-16 18:14 ——– d—–w- c:\documents and settings\Taylor\Application Data\Unhi
2010-06-22 06:06 . 2009-03-26 07:40 ——– d—–w- c:\documents and settings\Jessica\Application Data\Tuqo
2010-06-21 01:27 . 2008-06-10 20:44 ——– d—–w- c:\documents and settings\Chele\Application Data\Osvi
2010-06-19 06:27 . 2008-02-14 12:36 ——– d—–w- c:\documents and settings\Kory\Application Data\Efpawi
2010-06-16 02:44 . 2010-05-27 21:20 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-06-10 10:22 . 2009-03-10 01:02 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-06-08 22:27 . 2009-02-24 23:30 106728 —-a-w- c:\documents and settings\Jessica\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-06 22:25 . 2009-03-20 00:39 ——– d—–w- c:\program files\Microsoft Silverlight
2010-06-06 21:04 . 2006-08-04 02:42 ——– d—–w- c:\documents and settings\Taylor\Application Data\LimeWire
2010-06-02 23:31 . 2006-03-31 23:07 106728 —-a-w- c:\documents and settings\Taylor\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-29 16:11 . 2007-11-14 05:03 ——– d—–w- c:\program files\iTunes
2010-05-27 23:27 . 2010-05-27 23:27 ——– d—–w- c:\documents and settings\Kory\Application Data\CyberLink
2010-05-27 21:50 . 2010-05-27 21:39 ——– d—–w- c:\documents and settings\Kory\Application Data\muvee Technologies
2010-05-27 21:37 . 2010-05-27 21:09 ——– d—–w- c:\program files\Common Files\muvee Technologies
2010-05-27 21:37 . 2010-05-27 21:09 ——– d—–w- c:\program files\muvee Technologies
2010-05-27 21:36 . 2005-07-18 17:49 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-05-27 21:18 . 2006-03-29 23:54 106728 —-a-w- c:\documents and settings\Kory\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-27 21:08 . 2010-05-27 21:08 ——– d—–w- c:\documents and settings\All Users\Application Data\muvee Technologies
2010-05-27 21:07 . 2010-05-27 21:07 ——– d—–w- c:\documents and settings\Kory\Application Data\InstallShield
2010-05-25 04:06 . 2008-05-06 02:40 ——– d—–w- c:\documents and settings\Kory\Application Data\LimeWire
2010-05-06 10:41 . 2004-08-19 20:49 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2004-08-19 20:49 1851264 —-a-w- c:\windows\system32\win32k.sys
2010-04-25 22:17 . 2006-11-23 19:03 102032 —-a-w- c:\documents and settings\Chele\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-20 05:30 . 2004-08-19 20:49 285696 —-a-w- c:\windows\system32\atmfd.dll
2009-08-14 07:24 . 2009-08-14 07:24 19517 —-a-w- c:\program files\Common Files\olohetad.bin
2009-08-14 07:24 . 2009-08-14 07:24 14691 —-a-w- c:\program files\Common Files\ufojelaf.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupIconOverlayId]
@="{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}"
[HKEY_CLASSES_ROOT\CLSID\{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}]
2009-05-13 22:34 238968 —-a-w- c:\program files\Webroot\Spy Sweeper\Backup\CtxMenu_1_0_0_10.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-16 39408]
"ChicagoBearsDesktopAlert"="c:\documents and settings\Kory\Local Settings\Apps\2.0\DZN84Z3E.6X9\28VMX7R3.76P\crow..tion_1d7d5262b5c5acd1_0001.0000_b597ee5f509aeef7\CroweChizek.ChicagoBears.DesktopAlert.exe" [2010-04-24 370176]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150596.exe" [2009-04-29 468408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-11-12 4583424]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 339968]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-17 135168]
"mmtask"="c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 53248]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 57344]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-05-16 68592]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2009-11-06 6515784]

c:\documents and settings\Jessica\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\documents and settings\All Users\Documents\LimeWire\LimeWire.exe [2010-6-22 503808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-02 15:36 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2005-04-25 13:50 139264 —-a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 06:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 11:00 132496 —-a-w- c:\program files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2006-12-18 06:25 185896 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\All Users\\Documents\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [8/14/2009 1:12 AM 64160]
R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [4/21/2009 6:27 PM 29808]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/5/2009 7:03 PM 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/5/2009 7:04 PM 108552]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 7:49 AM 1029456]
S1 Start1Driver;Start1Driver; [x]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe –> c:\progra~1\AVG\AVG8\avgwdsvc.exe [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/3/2010 11:39 AM 135664]
.
Contents of the 'Scheduled Tasks' folder

2010-07-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 08:12]

2010-07-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2010-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-03 18:38]

2010-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-03 18:38]

2010-07-11 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-02-09 22:06]

2010-07-06 c:\windows\Tasks\wrSpySweeper_73653352B63849CAAF400AD1233DF69C.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2006-07-13 22:19]

2010-07-06 c:\windows\Tasks\wrSpySweeper_73653352B63849CAAF400AD1233DF69C.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2006-07-13 22:19]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.foxnews.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/clientapps/AutoSearch/SearchBarLM/YSetSearch/2008/11/20/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uCustomizeSearch =
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: { - c:\documents and settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
DPF: {A78856A6-334B-43AF-96F5-58574005910D} - hxxp://w.s0.gc.sj.ipixmedia.com/code/Einstaller.cab
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Search Protection - c:\program files\Yahoo!\Search Protection\SearchProtection.exe
HKLM-Run-1ceb603b - c:\windows\system32\jeigvevm.dll
ShellExecuteHooks-{D3A93164-BBDE-4245-BB24-7B0B12976D89} - (no file)
SafeBoot-svcWRSSSDK
AddRemove-Ad-Aware SE Personal - c:\progra~1\Lavasoft\AD-AWA~1\UNWISE.EXE
AddRemove-AVG8Uninstall - c:\program files\AVG\AVG8\setup.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
AddRemove-{8ADFC4160D694100B5B8A22DE9DCABD9} - c:\program files\DivX\DivXPlayerUninstall.exe
AddRemove-{B7050CBDB2504B34BC2A9CA0A692CC29} - c:\program files\DivX\DivXWebPlayerUninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-11 01:23
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1092)
c:\windows\system32\WININET.dll
c:\program files\Webroot\Spy Sweeper\Backup\CtxMenu_1_0_0_10.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\Google\Quick Search Box\bin\1.2.1151.245\qsb.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\msi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Webroot\Spy Sweeper\WRConsumerService.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Intel\Intel Matrix Storage Manager\iaantmon.exe
c:\windows\system32\nvsvc32.exe
c:\program files\TomTom HOME 2\TomTomHOMEService.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\windows\stsystra.exe
c:\windows\eHome\ehmsas.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\iPod\bin\iPodService.exe
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
c:\program files\Webroot\Spy Sweeper\SSU.EXE
.
**************************************************************************
.
Completion time: 2010-07-11 01:46:22 - machine was rebooted
ComboFix-quarantined-files.txt 2010-07-11 08:46

Pre-Run: 78,774,063,104 bytes free
Post-Run: 84,509,351,936 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

- - End Of File - - 5F73C0A408DCB1CFD9D956FED0F0BE32

I ran ComboFix and here is the log file…

ComboFix 10-07-11.03 - Kory 07/11/2010 19:47:54.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.518 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Kory\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Webroot AntiVirus with Spy Sweeper *On-access scanning disabled* (Updated) {77E10C7F-2CCA-4187-9394-BDBC267AD597}

file zipped: c:\program files\Common Files\olohetad.bin
file zipped: c:\program files\Common Files\ufojelaf.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Chele\Application Data\Naorqi
c:\documents and settings\Chele\Application Data\Osvi
c:\documents and settings\Jessica\Application Data\Tuqo
c:\documents and settings\Jessica\Application Data\Tuqo\ymex.nas
c:\documents and settings\Jessica\Application Data\Tuqo\ymex.tmp
c:\documents and settings\Jessica\Application Data\Ypuz
c:\documents and settings\Kory\Application Data\Efpawi
c:\documents and settings\Kory\Application Data\Mavasy
c:\documents and settings\Kory\Application Data\Weypam
c:\documents and settings\Kory\Application Data\Ywuk
c:\documents and settings\Taylor\Application Data\Ezig
c:\documents and settings\Taylor\Application Data\Unhi
c:\documents and settings\Taylor\Application Data\Unhi\umcy.noi
c:\documents and settings\Taylor\Application Data\Unhi\umcy.tmp
c:\program files\Common Files\olohetad.bin
c:\program files\Common Files\ufojelaf.exe

Infected copy of c:\windows\system32\Drivers\atapi.sys was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\atapi.sys

.
((((((((((((((((((((((((( Files Created from 2010-06-12 to 2010-07-12 )))))))))))))))))))))))))))))))
.

2010-07-11 20:22 . 2010-07-12 02:54 212544 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-06-17 03:32 . 2010-06-17 03:32 ——– d—–w- C:\e8e8aa5ab941c21d9c
2010-06-15 22:50 . 2010-06-15 22:51 ——– d—–w- c:\documents and settings\Jessica\tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupIconOverlayId]
@="{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}"
[HKEY_CLASSES_ROOT\CLSID\{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}]
2009-05-13 22:34 238968 —-a-w- c:\program files\Webroot\Spy Sweeper\Backup\CtxMenu_1_0_0_10.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-16 39408]
"ChicagoBearsDesktopAlert"="c:\documents and settings\Kory\Local Settings\Apps\2.0\DZN84Z3E.6X9\28VMX7R3.76P\crow..tion_1d7d5262b5c5acd1_0001.0000_b597ee5f509aeef7\CroweChizek.ChicagoBears.DesktopAlert.exe" [2010-04-24 370176]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150596.exe" [2009-04-29 468408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-11-12 4583424]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 339968]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-17 135168]
"mmtask"="c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 53248]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 57344]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-05-16 68592]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2009-11-06 6515784]

c:\documents and settings\Jessica\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\documents and settings\All Users\Documents\LimeWire\LimeWire.exe [2010-6-22 503808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-02 15:36 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2005-04-25 13:50 139264 —-a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 06:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 11:00 132496 —-a-w- c:\program files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2006-12-18 06:25 185896 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\All Users\\Documents\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [8/14/2009 1:12 AM 64160]
R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [4/21/2009 6:27 PM 29808]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/5/2009 7:03 PM 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/5/2009 7:04 PM 108552]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\Spy Sweeper\WRConsumerService.exe [8/15/2009 9:45 AM 1201640]
S1 Start1Driver;Start1Driver; [x]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe –> c:\progra~1\AVG\AVG8\avgwdsvc.exe [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/3/2010 11:39 AM 135664]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 7:49 AM 1029456]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [11/13/2009 4:31 AM 92008]
.
Contents of the 'Scheduled Tasks' folder

2010-07-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 08:12]

2010-07-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2010-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-03 18:38]

2010-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-03 18:38]

2010-07-12 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-02-09 22:06]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.foxnews.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/clientapps/AutoSearch/SearchBarLM/YSetSearch/2008/11/20/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uCustomizeSearch =
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: { - c:\documents and settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
DPF: {A78856A6-334B-43AF-96F5-58574005910D} - hxxp://w.s0.gc.sj.ipixmedia.com/code/Einstaller.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-11 19:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(172)
c:\windows\system32\WININET.dll
c:\program files\Webroot\Spy Sweeper\Backup\CtxMenu_1_0_0_10.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\Google\Quick Search Box\bin\1.2.1151.245\qsb.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\msi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Intel\Intel Matrix Storage Manager\iaantmon.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\windows\stsystra.exe
c:\windows\eHome\ehmsas.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\iPod\bin\iPodService.exe
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Webroot\Spy Sweeper\SSU.EXE
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Completion time: 2010-07-11 20:30:46 - machine was rebooted
ComboFix-quarantined-files.txt 2010-07-12 03:30
ComboFix2.txt 2010-07-11 08:46

Pre-Run: 84,877,582,336 bytes free
Post-Run: 84,934,344,704 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

- - End Of File - - 9E6EB253A5B7810E237219FC5776E0CE

Also, here is the other log file you requested…


ABBYY FineReader 5.0 Sprint
Absolute Poker
Ad-Aware
AdMission Photo Uploader
Adobe Download Manager 2.0 (Remove Only)
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop 7.0
Adobe Reader 7.0.8
Adobe Shockwave Player 11.5
Adobe® Photoshop® Album Starter Edition 3.0
AOLIcon
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask.com Toolbar
AutoUpdate
Banctec Service Agreement
Bonjour
ClueFinders® 3rd Grade Adventures
Coupon Printer for Windows
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell Picture Studio v3.0
Dell Support Center
Dell System Restore
DellSupport
Desktop News Alert
Disney's CD-ROM Sampler
DivX Converter
DoylesRoom
EPSON CardMonitor
EPSON PhotoStarter3.0
EPSON PictureMate Deluxe User's Guide
EPSON Printer Software
ESPNMotion
Freeze Clip Art
GameRanger
GemMaster Mystic
Get High Speed Internet!
Google Toolbar for Internet Explorer
Google Update Helper
High Definition Audio Driver Package - KB835221
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB960043)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows XP (KB942288-v3)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Intel Matrix Storage Manager
Intel® 537EP V9x DF PCI Modem
Intel® PRO Network Connections Software v9.2.4.11
Intel® PROSafe for Wired Connections
Internet Explorer Default Page
iPod for Windows 2005-02-22
iPod for Windows 2006-03-23
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Jasc Paint Shop Photo Album 5
Jasc Paint Shop Pro Studio, Dell Editon
Java 2 Runtime Environment, SE v1.4.2_03
Java™ 6 Update 2
Java™ 6 Update 3
Java™ SE Runtime Environment 6 Update 1
Learn2 Player (Uninstall Only)
Lexmark X1100 Series
LimeWire 5.5.10
Macromedia Flash Player
Microsoft .NET Framework 1.0 Hotfix (KB953295)
Microsoft .NET Framework 1.0 Hotfix (KB979904)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Age of Empires II
Microsoft Age of Empires II: The Conquerors Expansion
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2003
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Primary Interoperability Assemblies 2005
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Modem Event Monitor
Modem Helper
Modem On Hold
Move Networks Media Player for Internet Explorer
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 and SOAP Toolkit 3.0
Musicmatch for Windows Media Player
Musicmatch® Jukebox
muvee photoMemories stylePack
muveeNow 2.2
My Way Search Assistant
Nancy Drew: Treasure in the Royal Tower
NVIDIA Drivers
Otto
PokerStars
PowerDVD 5.5
QuickBooks Simple Start Special Edition
QuickTime
RealPlayer
RollerCoaster Tycoon 2
Secret Agent™ Barbie™
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for 2007 Microsoft Office System (KB982312)
Security Update for 2007 Microsoft Office System (KB982331)
Security Update for Microsoft Office Excel 2007 (KB982308)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office Outlook 2007 (KB972363)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office Publisher 2007 (KB982124)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB982135)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Sonic DLA
Sonic Encoders
Sonic MyDVD LE
Sonic RecordNow Audio
Sonic RecordNow Copy
Sonic RecordNow Data
Sonic Update Manager
Spy Sweeper Core
The Sims Makin' Magic
TomTom HOME 2.7.3.1894
TomTom HOME Visual Studio Merge Modules
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Outlook 2007 Junk Email Filter (kb983486)
Update for Windows Internet Explorer 8 (KB971180)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update Rollup 1 for Windows XP Media Center Edition 2005 with HDTV Support (KB873369)
Viewpoint Media Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Warcraft III
WebFldrs XP
Webroot AntiVirus with Spy Sweeper
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format Runtime
Windows Media Player 10
Windows XP Media Center Edition 2005 KB894553
Windows XP Media Center Edition 2005 KB973768
Windows XP Service Pack 3
WordPerfect Office 12
XML Paper Specification Shared Components Pack 1.0
XviD MPEG-4 Video Codec


ComboFix did detect AVG running, but I couldn't find it anywhere. I went ahead and ran ComboFix anyway. I hope this doesn't create a problem.

BTW, thanks for your help so far and your quick reply. Please let me know if I am doing anything else wrong as I am new to forums like this.

Dez

Here is the OTL Fix:

All processes killed
========== SERVICES/DRIVERS ==========
========== FILES ==========
C:\Documents and Settings\All Users\Documents\My Music\give me more dj vodka7.wma moved successfully.
C:\Documents and Settings\Chele\Application Data\Sun\Java\Deployment\cache\6.0\1\11e45981-44a3f28e moved successfully.
File\Folder C:\Documents and Settings\Chele\Application Data\Sun\Java\Deployment\cache\6.0\1\11e45981-44a3f28e not found.
File\Folder C:\Documents and Settings\Chele\Application Data\Sun\Java\Deployment\cache\6.0\1\11e45981-44a3f28e not found.
C:\Documents and Settings\Kory\Application Data\Sun\Java\Deployment\cache\6.0\2\3dcad182-76df4259 moved successfully.
C:\Documents and Settings\Kory\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\eRT.jar-5e59a67e-13514679.zip moved successfully.
C:\Documents and Settings\Kory\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nRT.jar-2b3dd25e-55105037.zip moved successfully.
C:\Program Files\iTunes\give me more dj vodka7.wma moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 6161 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: All Users

User: Chele
->Temp folder emptied: 195822 bytes
->Temporary Internet Files folder emptied: 17513818 bytes
->Java cache emptied: 12008702 bytes
->Flash cache emptied: 19922 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 56504 bytes

User: Jessica
->Temp folder emptied: 416430 bytes
->Temporary Internet Files folder emptied: 57714995 bytes
->Java cache emptied: 8730439 bytes
->Flash cache emptied: 129124 bytes

User: Kory
->Temp folder emptied: 193678175 bytes
->Temporary Internet Files folder emptied: 5795625 bytes
->Java cache emptied: 1957112 bytes
->Flash cache emptied: 191086 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 144594 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 1857 bytes

User: Taylor
->Temp folder emptied: 148643 bytes
->Temporary Internet Files folder emptied: 20135316 bytes
->Java cache emptied: 12192833 bytes
->Flash cache emptied: 147926 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 109681 bytes
%systemroot%\System32 .tmp files removed: 19488948 bytes
%systemroot%\System32\dllcache .tmp files removed: 9306112 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1167258 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 285098164 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 32902 bytes
RecycleBin emptied: 114021910 bytes

Total Files Cleaned = 725.00 mb


[EMPTYFLASH]

User: Administrator

User: All Users

User: Chele
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Jessica
->Flash cache emptied: 0 bytes

User: Kory
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService
->Flash cache emptied: 0 bytes

User: Taylor
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.9.0 log created on 07142010_220843

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\Jessica\Local Settings\Temp\hsperfdata_Jessica\4436 not found!
C:\Documents and Settings\Jessica\Local Settings\Temp\jna7426923630733914938.dll moved successfully.
C:\Documents and Settings\Kory\Local Settings\Temp\Google Toolbar\GoogleToolbarWelcome.log moved successfully.
File\Folder C:\Documents and Settings\Kory\Local Settings\Temp\~DF2E40.tmp not found!
File\Folder C:\Documents and Settings\Kory\Local Settings\Temp\~DF2E54.tmp not found!
File\Folder C:\Documents and Settings\Kory\Local Settings\Temp\~DF2F24.tmp not found!
File\Folder C:\Documents and Settings\Kory\Local Settings\Temp\~DF2F34.tmp not found!
File\Folder C:\Documents and Settings\Kory\Local Settings\Temp\~DF2F7E.tmp not found!
File\Folder C:\Documents and Settings\Kory\Local Settings\Temp\~DF2F8E.tmp not found!
C:\Documents and Settings\Kory\Local Settings\Temporary Internet Files\Content.IE5\XYLU1ZXG\iframe[1].htm moved successfully.
C:\Documents and Settings\Kory\Local Settings\Temporary Internet Files\Content.IE5\T537L17P\de[1].htm moved successfully.
C:\Documents and Settings\Kory\Local Settings\Temporary Internet Files\Content.IE5\6GKXIMNZ\index[1].htm moved successfully.
C:\Documents and Settings\Kory\Local Settings\Temporary Internet Files\Content.IE5\6GKXIMNZ\like[1].htm moved successfully.
C:\Documents and Settings\Taylor\Local Settings\Temp\Google Toolbar\GoogleToolbarWelcome.log moved successfully.
File\Folder C:\Documents and Settings\Taylor\Local Settings\Temp\~DF6A4.tmp not found!
File\Folder C:\Documents and Settings\Taylor\Local Settings\Temp\~DF77F.tmp not found!
File\Folder C:\Documents and Settings\Taylor\Local Settings\Temp\~DF800.tmp not found!
File\Folder C:\Documents and Settings\Taylor\Local Settings\Temp\~DF810.tmp not found!
File\Folder C:\Documents and Settings\Taylor\Local Settings\Temp\~DF90C.tmp not found!
File\Folder C:\Documents and Settings\Taylor\Local Settings\Temp\~DF91C.tmp not found!
C:\Documents and Settings\Taylor\Local Settings\Temporary Internet Files\Content.IE5\UIIU3ZVL\01[1].htm moved successfully.
C:\Documents and Settings\Taylor\Local Settings\Temporary Internet Files\Content.IE5\UIIU3ZVL\01[2].htm moved successfully.
C:\Documents and Settings\Taylor\Local Settings\Temporary Internet Files\Content.IE5\UIIU3ZVL\02 Draco Malfoy[1].jpg moved successfully.
C:\Documents and Settings\Taylor\Local Settings\Temporary Internet Files\Content.IE5\UIIU3ZVL\ad[4].htm moved successfully.
C:\Documents and Settings\Taylor\Local Settings\Temporary Internet Files\Content.IE5\UIIU3ZVL\ad[5].htm moved successfully.
C:\Documents and Settings\Taylor\Local Settings\Temporary Internet Files\Content.IE5\UIIU3ZVL\do_not_delete[1].htm moved successfully.
C:\Documents and Settings\Taylor\Local Settings\Temporary Internet Files\Content.IE5\UIIU3ZVL\NCP=1[1].htm moved successfully.
C:\Documents and Settings\Taylor\Local Settings\Temporary Internet Files\Content.IE5\UIIU3ZVL\NCP=1[2].htm moved successfully.
C:\Documents and Settings\Taylor\Local Settings\Temporary Internet Files\Content.IE5\303PDOV8\the-darkest-of-roses-draco-malfoy-009-what-a-muddy-date[1].htm moved successfully.

Registry entries deleted on Reboot…

Here is the OTL scan:

OTL logfile created on: 7/14/2010 10:25:48 PM - Run 1
OTL by OldTimer - Version 3.2.9.0 Folder = C:\Documents and Settings\Kory\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 409.00 Mb Available Physical Memory | 40.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.33 Gb Total Space | 77.45 Gb Free Space | 53.66% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 430.15 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: D5DC8Y71
Current User Name: Kory
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/07/14 22:06:20 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Kory\Desktop\OTL.exe
PRC - [2009/11/19 09:27:14 | 001,201,640 | —- | M] (Webroot Software, Inc. ) – C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
PRC - [2009/11/13 04:31:14 | 000,092,008 | —- | M] (TomTom) – C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2009/11/06 15:19:58 | 006,515,784 | —- | M] (Webroot Software, Inc.) – C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
PRC - [2009/11/06 12:00:22 | 004,048,240 | —- | M] (Webroot Software, Inc. (www.webroot.com)) – C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
PRC - [2009/11/06 12:00:22 | 000,165,232 | —- | M] (Webroot Software, Inc. (www.webroot.com)) – C:\Program Files\Webroot\Spy Sweeper\SSU.exe
PRC - [2009/05/16 12:28:43 | 000,039,408 | —- | M] (Google Inc.) – C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2009/05/16 12:28:42 | 000,068,592 | —- | M] (Google Inc.) – C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
PRC - [2008/04/13 17:12:28 | 000,060,416 | —- | M] (Microsoft Corporation) – C:\Program Files\Outlook Express\msimn.exe
PRC - [2008/04/13 17:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/03/15 11:09:36 | 000,460,784 | —- | M] (Gteko Ltd.) – C:\Program Files\DellSupport\DSAgnt.exe
PRC - [2006/01/17 13:03:06 | 000,135,168 | —- | M] (Musicmatch, Inc.) – C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
PRC - [2005/04/25 06:49:52 | 000,086,142 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
PRC - [2005/03/22 21:20:44 | 000,339,968 | —- | M] (SigmaTel, Inc.) – C:\WINDOWS\stsystra.exe
PRC - [2004/07/27 14:50:18 | 000,081,920 | —- | M] (InstallShield Software Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


========== Modules (SafeList) ==========

MOD - [2010/07/14 22:06:20 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Kory\Desktop\OTL.exe
MOD - [2008/04/13 17:10:20 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] – C:\WINDOWS\System32\hidserv.dll – (HidServ)
SRV - File not found [Auto | Stopped] – C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe – (avg8wd)
SRV - [2010/03/05 01:12:19 | 001,029,456 | —- | M] (Lavasoft) [On_Demand | Stopped] – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe – (Lavasoft Ad-Aware Service)
SRV - [2009/11/19 09:27:14 | 001,201,640 | —- | M] (Webroot Software, Inc. ) [Auto | Running] – C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe – (WRConsumerService)
SRV - [2009/11/13 04:31:14 | 000,092,008 | —- | M] (TomTom) [Auto | Running] – C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe – (TomTomHOMEService)
SRV - [2009/11/06 12:00:22 | 004,048,240 | —- | M] (Webroot Software, Inc. (www.webroot.com)) [Auto | Running] – C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe – (WebrootSpySweeperService)
SRV - [2007/03/07 15:47:46 | 000,076,848 | —- | M] () [On_Demand | Stopped] – C:\Program Files\DellSupport\brkrsvc.exe – (DSBrokerService)
SRV - [2005/04/25 06:49:52 | 000,086,142 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe – (IAANTMon) Intel®


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\DRIVERS\wanatw4.sys – (wanatw) WAN Miniport (ATW)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Program Files\muvee Technologies\muveeNow 2.2\mvBurnerDll\NTIDrvr.sys – (NTIDrvr)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\ComboFix\catchme.sys – (catchme)
DRV - [2009/11/06 12:00:36 | 000,176,752 | —- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] – C:\WINDOWS\SYSTEM32\Drivers\SSIDRV.SYS – (SSIDRV)
DRV - [2009/11/06 12:00:36 | 000,023,152 | —- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] – C:\WINDOWS\SYSTEM32\Drivers\SSHRMD.SYS – (SSHRMD)
DRV - [2009/11/06 12:00:34 | 000,029,808 | —- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\ssfs0bbc.sys – (ssfs0bbc)
DRV - [2009/07/03 07:49:08 | 000,064,160 | —- | M] (Lavasoft AB) [File_System | Boot | Running] – C:\WINDOWS\system32\DRIVERS\Lbd.sys – (Lbd)
DRV - [2009/05/02 08:36:19 | 000,027,784 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\WINDOWS\System32\Drivers\avgmfx86.sys – (AvgMfx86)
DRV - [2009/05/02 08:36:18 | 000,325,896 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\avgldx86.sys – (AvgLdx86)
DRV - [2009/05/02 08:36:05 | 000,108,552 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\avgtdix.sys – (AvgTdiX)
DRV - [2008/04/13 11:36:39 | 000,043,008 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\amdagp.sys – (amdagp)
DRV - [2008/04/13 11:36:39 | 000,040,960 | —- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sisagp.sys – (sisagp)
DRV - [2008/04/13 09:36:05 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hdaudbus.sys – (HDAudBus)
DRV - [2007/03/01 19:54:22 | 000,021,056 | —- | M] (Webroot Software Inc (www.webroot.com)) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\sskbfd.sys – (SSKBFD)
DRV - [2007/02/25 12:10:48 | 000,005,376 | –S- | M] (Gteko Ltd.) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\dsunidrv.sys – (dsunidrv)
DRV - [2006/10/05 16:07:28 | 000,004,736 | —- | M] (Gteko Ltd.) [Kernel | On_Demand | Running] – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys – (DSproct)
DRV - [2005/04/25 11:28:14 | 000,871,040 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\iastor.sys – (iastor)
DRV - [2005/03/31 17:22:16 | 000,180,096 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\sthda.sys – (STHDA) High Definition Audio Driver (WDM)
DRV - [2004/12/05 23:05:00 | 000,100,603 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\dla\tfsnudfa.sys – (tfsnudfa)
DRV - [2004/12/05 23:05:00 | 000,098,714 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\dla\tfsnudf.sys – (tfsnudf)
DRV - [2004/12/05 23:05:00 | 000,086,586 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\dla\tfsnifs.sys – (tfsnifs)
DRV - [2004/12/05 23:05:00 | 000,034,843 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\dla\tfsncofs.sys – (tfsncofs)
DRV - [2004/12/05 23:05:00 | 000,025,883 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\dla\tfsnboio.sys – (tfsnboio)
DRV - [2004/12/05 23:05:00 | 000,015,227 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\dla\tfsnopio.sys – (tfsnopio)
DRV - [2004/12/05 23:05:00 | 000,006,363 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\dla\tfsnpool.sys – (tfsnpool)
DRV - [2004/12/05 23:05:00 | 000,004,123 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\dla\tfsndrct.sys – (tfsndrct)
DRV - [2004/12/05 23:05:00 | 000,002,239 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\dla\tfsndres.sys – (tfsndres)
DRV - [2004/12/01 01:22:00 | 000,087,488 | —- | M] (Sonic Solutions) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\drvmcdb.sys – (drvmcdb)
DRV - [2004/11/23 00:56:00 | 000,040,480 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\drvnddm.sys – (drvnddm)
DRV - [2004/11/11 21:10:00 | 002,738,400 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nv4_mini.sys – (nv)
DRV - [2004/11/02 13:12:14 | 000,019,456 | —- | M] (Intel Corporation ) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\iqvw32.sys – (NAL)
DRV - [2004/07/14 09:29:04 | 000,005,627 | —- | M] (Sonic Solutions) [File_System | System | Running] – C:\WINDOWS\system32\drivers\sscdbhk5.sys – (sscdbhk5)
DRV - [2004/07/14 09:28:50 | 000,023,545 | —- | M] (Sonic Solutions) [File_System | System | Running] – C:\WINDOWS\system32\drivers\ssrtln.sys – (ssrtln)
DRV - [2004/06/16 01:52:40 | 000,061,157 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\IntelC53.sys – (IntelC53)
DRV - [2004/03/06 02:15:34 | 000,647,929 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\IntelC52.sys – (IntelC52)
DRV - [2004/03/06 02:14:42 | 001,233,525 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\IntelC51.sys – (IntelC51)
DRV - [2004/03/06 02:13:38 | 000,037,048 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\mohfilt.sys – (mohfilt)
DRV - [2002/11/08 17:45:06 | 000,017,217 | —- | M] (Dell Computer Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\omci.sys – (omci)
DRV - [2001/08/17 12:07:44 | 000,019,072 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sparrow.sys – (Sparrow)
DRV - [2001/08/17 12:07:42 | 000,030,688 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sym_u3.sys – (sym_u3)
DRV - [2001/08/17 12:07:40 | 000,028,384 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sym_hi.sys – (sym_hi)
DRV - [2001/08/17 12:07:36 | 000,032,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\symc8xx.sys – (symc8xx)
DRV - [2001/08/17 12:07:34 | 000,016,256 | —- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\symc810.sys – (symc810)
DRV - [2001/08/17 11:57:38 | 000,016,128 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\MODEMCSA.sys – (MODEMCSA)
DRV - [2001/08/17 11:52:22 | 000,036,736 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ultra.sys – (ultra)
DRV - [2001/08/17 11:52:20 | 000,045,312 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ql12160.sys – (ql12160)
DRV - [2001/08/17 11:52:20 | 000,040,320 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ql1080.sys – (ql1080)
DRV - [2001/08/17 11:52:18 | 000,049,024 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ql1280.sys – (ql1280)
DRV - [2001/08/17 11:52:16 | 000,179,584 | —- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys – (dac2w2k)
DRV - [2001/08/17 11:52:12 | 000,017,280 | —- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\mraid35x.sys – (mraid35x)
DRV - [2001/08/17 11:52:00 | 000,026,496 | —- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\asc.sys – (asc)
DRV - [2001/08/17 11:51:58 | 000,014,848 | —- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\asc3550.sys – (asc3550)
DRV - [2001/08/17 11:51:56 | 000,005,248 | —- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\aliide.sys – (AliIde)
DRV - [2001/08/17 11:51:54 | 000,006,656 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\cmdide.sys – (CmdIde)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local



O1 HOSTS File: ([2010/07/11 19:56:31 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ask.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Google Quick Search Box] C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe (Musicmatch, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe (Webroot Software, Inc.)
O4 - HKCU..\Run: [ChicagoBearsDesktopAlert] C:\Documents and Settings\Kory\Local Settings\Apps\2.0\DZN84Z3E.6X9\28VMX7R3.76P\crow..tion_1d7d5262b5c5acd1_0001.0000_b597ee5f509aeef7\CroweChizek.ChicagoBears.DesktopAlert.exe (Crowe Chizek and Company LLC)
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\Shockwave 11\SwHelper_1150596.exe -Update -1150596 -Mozilla\4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident\4.0; File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Reg Error: Key error.)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2…78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A78856A6-334B-43AF-96F5-58574005910D} http://w.s0.gc.sj.ipixmedia.com/code/Einstaller.cab (CEinstaller Object)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\Documents and Settings\Kory\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Kory\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (625\ecurity Packages settings..) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/05/27 14:37:53 | 000,000,100 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/07/14 22:08:43 | 000,000,000 | —D | C] – C:\_OTL
[2010/07/14 22:06:17 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Kory\Desktop\OTL.exe
[2010/07/14 06:00:16 | 000,000,000 | —D | C] – C:\Documents and Settings\Kory\Local Settings\Application Data\Temp
[2010/07/13 17:47:17 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2010/07/12 23:57:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Kory\Application Data\Malwarebytes
[2010/07/12 23:57:04 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/07/12 23:57:02 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/07/12 23:57:02 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/07/12 23:56:59 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/12 23:56:09 | 006,153,352 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Kory\Desktop\mbam-setup.exe
[2010/07/12 23:51:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Kory\Desktop\JavaRa
[2010/07/12 23:42:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/07/12 23:41:45 | 000,423,656 | —- | C] (Oracle) – C:\WINDOWS\System32\deployJava1.dll
[2010/07/12 23:41:45 | 000,153,376 | —- | C] (Oracle) – C:\WINDOWS\System32\javaws.exe
[2010/07/12 23:41:45 | 000,145,184 | —- | C] (Oracle) – C:\WINDOWS\System32\javaw.exe
[2010/07/12 23:41:45 | 000,145,184 | —- | C] (Oracle) – C:\WINDOWS\System32\java.exe
[2010/07/12 23:41:45 | 000,073,728 | —- | C] (Oracle) – C:\WINDOWS\System32\javacpl.cpl
[2010/07/12 22:53:09 | 016,066,336 | —- | C] (Oracle) – C:\Documents and Settings\Kory\Desktop\jre-6u21-windows-i586.exe
[2010/07/12 22:45:39 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2010/07/12 22:44:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS
[2010/07/12 22:44:13 | 027,386,256 | —- | C] ( ) – C:\Documents and Settings\Kory\Desktop\AdbeRdr930_en_US.exe
[2010/07/12 22:06:19 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/07/11 20:30:59 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2010/07/11 19:46:56 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/07/11 19:44:30 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/07/11 00:44:43 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/07/11 00:44:43 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/07/11 00:44:43 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/07/11 00:44:24 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/07/11 00:42:32 | 000,000,000 | —D | C] – C:\Qoobox
[2010/07/11 00:04:27 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/07/05 17:18:20 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/06/16 20:32:18 | 000,000,000 | —D | C] – C:\e8e8aa5ab941c21d9c

========== Files - Modified Within 30 Days ==========

[2010/07/14 22:18:56 | 000,007,275 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/07/14 22:18:15 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/14 22:18:08 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/14 22:17:47 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/14 22:17:45 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/14 22:17:44 | 1071,812,608 | -HS- | M] () – C:\hiberfil.sys
[2010/07/14 22:16:57 | 005,242,880 | —- | M] () – C:\Documents and Settings\Kory\ntuser.dat
[2010/07/14 22:06:20 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Kory\Desktop\OTL.exe
[2010/07/14 22:01:00 | 000,000,232 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/07/14 22:00:06 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/14 20:46:46 | 000,000,355 | —- | M] () – C:\WINDOWS\lexstat.ini
[2010/07/14 03:11:05 | 000,508,212 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/07/14 03:11:05 | 000,446,214 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/07/14 03:11:05 | 000,073,420 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/07/13 19:31:45 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/07/13 00:10:12 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Kory\ntuser.ini
[2010/07/12 23:57:10 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/12 23:56:13 | 006,153,352 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Kory\Desktop\mbam-setup.exe
[2010/07/12 23:50:49 | 000,071,798 | —- | M] () – C:\Documents and Settings\Kory\Desktop\JavaRa.zip
[2010/07/12 23:41:07 | 000,153,376 | —- | M] (Oracle) – C:\WINDOWS\System32\javaws.exe
[2010/07/12 23:41:06 | 000,145,184 | —- | M] (Oracle) – C:\WINDOWS\System32\javaw.exe
[2010/07/12 23:41:05 | 000,145,184 | —- | M] (Oracle) – C:\WINDOWS\System32\java.exe
[2010/07/12 23:41:05 | 000,073,728 | —- | M] (Oracle) – C:\WINDOWS\System32\javacpl.cpl
[2010/07/12 23:40:59 | 000,423,656 | —- | M] (Oracle) – C:\WINDOWS\System32\deployJava1.dll
[2010/07/12 22:53:20 | 016,066,336 | —- | M] (Oracle) – C:\Documents and Settings\Kory\Desktop\jre-6u21-windows-i586.exe
[2010/07/12 22:47:52 | 000,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/07/12 22:46:07 | 000,000,732 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Acrobat_com.lnk
[2010/07/12 22:44:15 | 027,386,256 | —- | M] ( ) – C:\Documents and Settings\Kory\Desktop\AdbeRdr930_en_US.exe
[2010/07/12 01:12:04 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/07/11 19:56:40 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/07/11 19:56:31 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/07/11 19:47:02 | 000,000,279 | RHS- | M] () – C:\boot.ini
[2010/07/11 19:36:24 | 003,736,761 | R— | M] () – C:\Documents and Settings\Kory\Desktop\ComboFix.exe
[2010/07/11 03:40:14 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/07/11 00:52:26 | 000,000,279 | —- | M] () – C:\Boot.bak
[2010/07/03 17:51:35 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/07/02 11:03:53 | 000,001,682 | -HS- | M] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2010/07/02 11:03:53 | 000,000,056 | RHS- | M] () – C:\WINDOWS\System32\19F53832F6.sys
[2010/07/01 16:01:29 | 001,577,812 | -H– | M] () – C:\Documents and Settings\Kory\Local Settings\Application Data\IconCache.db
[2010/06/15 19:21:22 | 000,505,122 | —- | M] () – C:\Documents and Settings\Kory\Desktop\Immunization.jpg

========== Files Created - No Company Name ==========

[2010/07/14 22:13:55 | 000,212,544 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/07/12 23:57:10 | 000,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/12 23:50:49 | 000,071,798 | —- | C] () – C:\Documents and Settings\Kory\Desktop\JavaRa.zip
[2010/07/12 22:47:52 | 000,001,729 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/07/12 22:46:07 | 000,000,732 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Acrobat_com.lnk
[2010/07/11 00:52:26 | 000,000,279 | —- | C] () – C:\Boot.bak
[2010/07/11 00:52:21 | 000,260,272 | —- | C] () – C:\cmldr
[2010/07/11 00:44:43 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/07/11 00:44:43 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/07/11 00:44:43 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/07/11 00:44:43 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/07/11 00:44:43 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/07/11 00:41:06 | 003,736,761 | R— | C] () – C:\Documents and Settings\Kory\Desktop\ComboFix.exe
[2010/06/15 19:21:19 | 000,505,122 | —- | C] () – C:\Documents and Settings\Kory\Desktop\Immunization.jpg
[2009/11/06 12:00:28 | 000,031,088 | —- | C] () – C:\WINDOWS\System32\wrLZMA.dll
[2009/08/14 02:00:57 | 000,001,152 | —- | C] () – C:\WINDOWS\System32\windrv.sys
[2009/08/14 00:24:52 | 000,017,181 | —- | C] () – C:\WINDOWS\iwoxorejuc.sys
[2009/08/14 00:24:52 | 000,012,861 | —- | C] () – C:\WINDOWS\System32\ufizejaf.sys
[2009/06/14 23:25:30 | 000,000,000 | —- | C] () – C:\WINDOWS\game.INI
[2008/11/08 12:20:09 | 000,000,100 | —- | C] () – C:\WINDOWS\ka.ini
[2008/09/19 14:57:34 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/09/19 14:55:10 | 000,000,416 | —- | C] () – C:\WINDOWS\System32\dtu100.dll.manifest
[2008/09/19 14:55:10 | 000,000,416 | —- | C] () – C:\WINDOWS\System32\dpl100.dll.manifest
[2008/09/19 14:54:18 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2007/02/05 09:30:27 | 000,000,214 | —- | C] () – C:\WINDOWS\TLCAPPS.INI
[2007/02/05 09:29:57 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2006/09/18 00:00:47 | 000,761,856 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2006/09/18 00:00:47 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2006/07/12 17:23:39 | 000,075,088 | —- | C] () – C:\WINDOWS\System32\adwfil.dll
[2006/07/12 17:23:39 | 000,013,034 | —- | C] () – C:\WINDOWS\System32\gblfil.dll
[2006/07/12 17:23:39 | 000,010,834 | —- | C] () – C:\WINDOWS\System32\chtfil.dll
[2006/07/12 17:23:39 | 000,005,142 | —- | C] () – C:\WINDOWS\System32\iawfil.dll
[2006/07/12 17:23:39 | 000,004,826 | —- | C] () – C:\WINDOWS\System32\vgamfil.dll
[2006/07/12 17:23:39 | 000,004,442 | —- | C] () – C:\WINDOWS\System32\hatfil.dll
[2006/07/12 17:23:39 | 000,003,818 | —- | C] () – C:\WINDOWS\System32\viofil.dll
[2006/07/12 17:23:39 | 000,003,444 | —- | C] () – C:\WINDOWS\System32\srchin.dll
[2006/07/12 17:23:39 | 000,002,782 | —- | C] () – C:\WINDOWS\System32\lgwfil.dll
[2006/07/12 17:23:39 | 000,001,830 | —- | C] () – C:\WINDOWS\System32\cultfil.dll
[2006/07/12 17:23:39 | 000,001,378 | —- | C] () – C:\WINDOWS\System32\gdwfil.dll
[2006/07/12 17:23:39 | 000,000,980 | —- | C] () – C:\WINDOWS\System32\imgfil.dll
[2006/07/12 17:23:39 | 000,000,514 | —- | C] () – C:\WINDOWS\System32\snetfil.dll
[2006/07/12 17:23:39 | 000,000,306 | —- | C] () – C:\WINDOWS\System32\picsfil.dll
[2006/07/12 17:23:39 | 000,000,258 | —- | C] () – C:\WINDOWS\System32\srchout.dll
[2006/07/12 17:23:38 | 000,334,174 | —- | C] () – C:\WINDOWS\sqlite3.dll
[2006/06/06 20:36:31 | 000,000,000 | —- | C] () – C:\WINDOWS\Textart.INI
[2006/06/06 20:18:56 | 000,000,168 | —- | C] () – C:\WINDOWS\Clipbook.INI
[2006/05/30 00:28:34 | 000,001,682 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2006/05/13 21:28:52 | 000,000,078 | —- | C] () – C:\WINDOWS\Ariel_dm.ini
[2006/05/13 21:28:26 | 000,001,371 | —- | C] () – C:\WINDOWS\DISNEY.INI
[2006/05/06 22:07:21 | 000,102,912 | —- | C] () – C:\WINDOWS\System32\islzma.dll
[2006/05/06 22:07:18 | 000,684,032 | —- | C] () – C:\WINDOWS\libeay32.dll
[2006/05/06 22:07:18 | 000,155,648 | —- | C] () – C:\WINDOWS\ssleay32.dll
[2006/04/19 19:44:12 | 000,000,056 | RHS- | C] () – C:\WINDOWS\System32\19F53832F6.sys
[2006/03/28 22:05:40 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/03/28 21:57:44 | 000,000,097 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2006/03/28 21:57:36 | 000,000,048 | —- | C] () – C:\WINDOWS\EPSPictureMate.ini
[2006/03/28 21:57:06 | 000,000,052 | —- | C] () – C:\WINDOWS\System32\EAL32.INI
[2006/03/28 21:21:36 | 000,000,355 | —- | C] () – C:\WINDOWS\lexstat.ini
[2005/07/18 11:03:40 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/07/18 10:59:15 | 000,000,138 | —- | C] () – C:\WINDOWS\wininit.ini
[2005/07/18 10:32:54 | 000,000,375 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/04/09 15:04:54 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/19 14:20:39 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/19 14:01:43 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/03/28 07:17:32 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\LXBKLCNP.DLL
[2002/11/13 09:40:22 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxbkvs.dll
[2002/09/13 05:40:06 | 000,000,266 | —- | C] () – C:\WINDOWS\System32\lxbkcoin.ini
[1997/06/13 18:56:08 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\iyvu9_32.dll

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2006/03/28 21:59:21 | 000,000,741 | —- | M] () – C:\892.cin
[2010/07/14 22:17:38 | 000,023,910 | —- | M] () – C:\aaw7boot.log
[2007/08/08 18:01:15 | 000,000,000 | —- | M] () – C:\AILog.txt
[2010/05/27 14:37:53 | 000,000,100 | —- | M] () – C:\AUTOEXEC.BAT
[2010/07/11 00:52:26 | 000,000,279 | —- | M] () – C:\Boot.bak
[2010/07/11 19:47:02 | 000,000,279 | RHS- | M] () – C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | —- | M] () – C:\cmldr
[2010/07/11 20:30:48 | 000,013,016 | —- | M] () – C:\ComboFix.txt
[2004/08/19 14:07:14 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2006/04/04 18:57:41 | 000,000,216 | —- | M] () – C:\DebugTrace-RockallDLL.log
[2005/07/18 10:37:04 | 000,005,969 | RH– | M] () – C:\dell.sdr
[2010/07/14 22:17:44 | 1071,812,608 | -HS- | M] () – C:\hiberfil.sys
[2006/07/29 12:41:23 | 000,004,128 | —- | M] () – C:\INFCACHE.1
[2007/06/16 10:57:25 | 000,000,164 | —- | M] () – C:\install.dat
[2004/08/19 14:07:14 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2006/05/25 20:59:44 | 000,001,044 | -H– | M] () – C:\IPH.PH
[2010/07/12 23:53:37 | 000,007,083 | —- | M] () – C:\JavaRa.log
[2004/08/19 14:07:14 | 000,000,000 | -H– | M] () – C:\MSDOS.SYS
[2004/08/10 03:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/09/23 17:47:54 | 000,250,048 | RHS- | M] () – C:\ntldr
[2008/11/19 21:27:44 | 000,262,144 | —- | M] () – C:\ntuser.dat
[2008/11/19 21:27:44 | 000,001,024 | -H– | M] () – C:\ntuser.dat.LOG
[2010/07/14 22:17:42 | 1610,612,736 | -HS- | M] () – C:\pagefile.sys
[2005/07/18 10:58:02 | 000,000,087 | —- | M] () – C:\SystemInfo.ini

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/19 14:06:24 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2008/07/06 05:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2003/03/28 04:20:50 | 000,078,336 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\LXBKPP5C.DLL
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/04/13 17:11:51 | 001,267,200 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\comsvcs.dll
[2009/03/08 04:31:44 | 000,348,160 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtmsft.dll
[2009/03/08 04:31:38 | 000,216,064 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtrans.dll
[2009/11/06 12:00:28 | 000,031,088 | —- | M] () Unable to obtain MD5 – C:\WINDOWS\system32\wrLZMA.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2004/08/19 13:56:28 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2004/08/19 13:56:28 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2004/08/19 13:56:28 | 000,876,544 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/13 17:12:08 | 000,578,560 | —- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B – C:\WINDOWS\system32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/13 17:12:10 | 000,082,432 | —- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A – C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/13 17:12:10 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 – C:\WINDOWS\system32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-14 10:11:15

========== Alternate Data Streams ==========

@Alternate Data Stream - 149 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:647B4AD9
< End of report >