Spyware / Malware / Virus Removal

An extremly infected machine!

30 min read

Looking for the outcome? Ask AI

CatByte

Post #16July 24, 2010, 8:33 PM UTC

Please make sure there is no proxy selected

Go to Start > Control Panel, and choose Network Connections.
Right click on your default connection, usually Local Area Connection for cable and DSL or Dial-up Connection if you are using Dial-up, and choose Properties.
Click the Networking tab
Double-click on the Internet Protocol (TCP/IP) item.
Write down the settings in case you should need to change them back.
Select the radio button that says "Obtain DNS servers automatically".
Click OK twice to get out of the properties screen and restart your computer.
If not prompted to reboot go ahead and reboot manually.

In I.E.

Check internet options settings.
Tools > Internet Options > Connections
LAN settings
Choose "automatically detect settings"
uncheck both proxy settings boxes

In FireFox

Click on Advanced -> Network -> Setttings…
the No Proxy option should be selected

jeff matthews

Post #17July 25, 2010, 7:30 PM UTC last edited July 25, 2010, 8:18 PM UTC

Ok i ran through all the steps this time. I found that MSN and yahoo now signs in perfectly in "normal startup" mode. This WAS an issue before so im glad its not now, were getting some w here at least lol. How ever the internet is still not able to connect. I used the "flush the router commands like you said, and i also ran TFC and changed the proxy settings. The only thing that I did not do was reset the router settings cause i don't think its a router issue because like i said i have it hooked up through my router and the same issues were happening on his router.

Here is the program log list!

CCC Help English
Celestia 1.5.1
CPUID CPU-Z 1.54
Critical Update for Windows Media Player 11 (KB959772)
DAO
Diablo
Diablo II
Dungeons & Dragons Online ®: Eberron Unlimited ™ v01.10.01.801
DVD Decrypter (Remove Only)
DVD Shrink 3.2
EA Download Manager
EA Download Manager UI
Flash DVD Ripper
GameDesire-Pool & Snooker
Gliderman
Google Chrome
Google Earth
Google Talk Plugin
Google Update Helper
Google Updater
GUIDE PLUS+™ for Windows® System - ATI
GXTranscoder v2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB981793)
HP DeskJet 710C Series (Remove only)
InterActual Player
iTunes
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java Auto Updater
Java™ 6 Update 2
Java™ 6 Update 20
Java™ 6 Update 3
Java™ 6 Update 5/
Java™ 6 Update 7
LightScribe 1.4.44.1
Lionheart: Legacy of the Crusader ™
Malwarebytes' Anti-Malware
Matroska Pack (remove only)
MatroskaProp (remove only)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office 97, Professional Edition
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MobileMe Control Panel
MovieEdit Task
Mozilla Firefox (3.6.7)
MSN
MSVCRT
Need2Find Bar
Nero Suite
Network Stumbler 0.4.0 (remove only)
OpenOffice.org Installer 1.0
Pando Media Booster
PhotoStitch
QuickTime
RAW Image Task 2.2
Safari
SAS10
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Encoder (KB979332)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB979309)
Segoe UI
SiS 900 PCI Fast Ethernet Adapter Driver
Skins
Skype Toolbars
Skype™ 4.2
Super Mario Pac v1.1
Switch
Temperature Converter
Titan Quest
Titan Quest Immortal Throne
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Viewpoint Media Player
WebFldrs XP
Winamp
Winamp Remote
Winamp Toolbar
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Player 11
Windows Search 4.0
Windows XP Service Pack 3
WinRAR archiver
WinZip
Yahoo! extras
Yahoo! Install Manager
Yahoo! Messenger
Yahoo! Search Protection
Yahoo! Software Update
Yahoo! Toolbar

This computer really seems to have some issues still though. the computer is still pretty slow on startup. The internet is finally able to connect, Woohoo! lol. I guess this problem has finally been fixed, thank god. I guess flushing the router was the magic trick that needed to be done.

Also i want to note that i ran Maleware bytes again and found 3 other infections that were from "java" i deleted them, but the fact that the system is still picking up infections worries me. Because i think the computer still has some vulnerabilities and some of the maleware is not completely cleaned because it keeps coming back. I have also only been on safe mode, i rebooted just a few times back into "normal startup" but thats it. So yeah there is some issues here most definitely with infections still. I want to make sure this computer is cleaned of all infections before the internet starts causing issues again.

I am VERY suspicious of this "need2findbar" i can't seem to delete it and i know for a fact its causing a problem cause i saw it in the logs also. I went to the regeedit and tried to manually delete it my self. But i still can't seem to remove it from the programs list cause it says "cannot find it" when i try to remove it.

jeff matthews

Post #18July 25, 2010, 9:15 PM UTC last edited July 25, 2010, 9:40 PM UTC

After doing some research on this, i found this link

http://vil.nai.com/vil/content/v_134739.htm

You might want to take a look at it. Its bout that "need2findbar" which i can't seem to remove. It also says thats its a type of adware hyjacker application that changes internet settings. That would explain why his internet was not able to connect to the appropriate proxy settings.

jeff matthews

Post #19July 25, 2010, 9:39 PM UTC last edited July 25, 2010, 10:01 PM UTC

I also found this information on it.

http://vil.nai.com/vil/content/v_134739.htm

Im trying to delete all the files for this program, it says it comes bundled with kazzaa. So i guess at some point he had kazzaa on his computer.

I tried downloading spyboy search and destroy and it won't even install. dayam this computer is so limited right now on what it can do, its really hard to work on it, when its like this.

jeff matthews

Post #20July 25, 2010, 10:15 PM UTC last edited July 25, 2010, 10:24 PM UTC

Ive tried everything i can, im just stuck at this point. i tried using housecall another type of antivirus and the same error message during installation, "the connection with the server could not be established". Its like i can't install anything right now. Also i want to note that i can't use the "search all files and folders feature" in safe mode either. I have to reboot into normal startup in order to search files and folders. This is just weird man, i just don't know what the hell is going on.

CatByte

Post #21July 25, 2010, 10:26 PM UTC

Please do the following:

J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java Auto Updater
Java™ 6 Update 2
Java™ 6 Update 20
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7

remove all those versions of Java from Add/Remove programs

then install this current version of Java:

http://java.com/en/download/index.jsp

Please stop fixing things on your own, you may make it impossible for me to resolve anything if you do.

Please run the following:

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under the Custom Scan box paste this in

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your next reply.

jeff matthews

Post #22July 25, 2010, 10:32 PM UTC last edited July 25, 2010, 10:35 PM UTC

Wow this is bad. i don't know what i have done. but java won't install now. It says "internet connection settings are incorrect, installer cannot proceed with the current internet connection settings. Its almost as if NO programs are installing now. This wasn't an issue before, this just now happend. Yeah i copy, i won't do nothing untill you say so, sorry.

jeff matthews

Post #23July 25, 2010, 10:39 PM UTC last edited July 25, 2010, 10:57 PM UTC

I'll try OTL right now.

Yeah OTL works, im doing the custom scan right now. But i can't install java cause its not allowing me for some reason. Something with the internet settings are messed up.

Here are the log files.

OTL LOG

OTL logfile created on: 7/25/2010 3:44:21 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Mattew Rigel\My Documents\programslog
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 60.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 74.00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 66.09 Gb Total Space | 5.11 Gb Free Space | 7.73% Space Free | Partition Type: NTFS
Drive D: | 123.83 Gb Total Space | 116.35 Gb Free Space | 93.96% Space Free | Partition Type: NTFS
Drive E: | 351.60 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MATTEW
Current User Name: Mattew Rigel
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Mattew Rigel\My Documents\programslog\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\snmp.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.EXE (ATI Technologies Inc.)
PRC - C:\Program Files\ATI Multimedia\main\atidtct.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\essspk.exe ()
PRC - C:\Program Files\Microsoft Office\Office\OSA.EXE ()

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Mattew Rigel\My Documents\programslog\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (SNMP) – C:\WINDOWS\system32\snmp.exe (Microsoft Corporation)
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (LPDSVC) – C:\WINDOWS\system32\tcpsvcs.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (catchme) – C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys File not found
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ATIAVAIW) – C:\WINDOWS\system32\drivers\atinavt2.sys (ATI Technologies Inc.)
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (nm) – C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (zumbus) – C:\WINDOWS\system32\drivers\zumbus.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (SiSkp) – C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SISNICXP) – C:\WINDOWS\system32\drivers\sisnicxp.sys (SiS Corporation)
DRV - (ATITUNEP) – C:\WINDOWS\system32\drivers\atineuxx.sys (ATI Technologies Inc.)
DRV - (ATIXSAudio) – C:\WINDOWS\system32\drivers\atinesxx.sys (ATI Technologies Inc.)
DRV - (atinevxx) – C:\WINDOWS\system32\drivers\atinevxx.sys (ATI Technologies Inc.)
DRV - (PCDCODEC) – C:\WINDOWS\system32\drivers\atinpdxx.sys (ATI Technologies Inc.)
DRV - (MVDCODEC) – C:\WINDOWS\system32\drivers\atinmdxx.sys (ATI Technologies Inc.)
DRV - (ativraxx) – C:\WINDOWS\system32\drivers\atinraxx.sys (ATI Technologies Inc.)
DRV - (WinDriver6) – C:\WINDOWS\system32\drivers\windrvr6.sys (Jungo)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (atinrvxx) ATI WDM Rage Theater Video (Microsoft Corporation) – C:\WINDOWS\system32\drivers\atinrvxx.sys (ATI Technologies Inc.)
DRV - (MPE) – C:\WINDOWS\system32\drivers\mpe.sys (Microsoft Corporation)
DRV - (NSNDIS5) – C:\WINDOWS\system32\nsndis5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (ATI Remote Wonder II) – C:\WINDOWS\system32\drivers\atirwvd.sys (Jungo)
DRV - (SISNIC) – C:\WINDOWS\system32\drivers\sisnic.sys (SiS Corporation)
DRV - (Edspport) – C:\WINDOWS\system32\drivers\es56tpi.sys (Creative Labs,Inc.)
DRV - (MODEMCSA) – C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (HPFECP13) – C:\WINDOWS\System32\drivers\HPFECP13.SYS ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.Google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A8 55 B8 8D F6 16 CB 01 [binary data]
IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5643

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web"
FF - prefs.js..browser.search.defaulturl: "http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch"
FF - prefs.js..browser.search.order.1: "Fast Browser Search"
FF - prefs.js..browser.search.selectedEngine: "Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.ba/firefox?client=firefox-a&rlz;=1R0GGGL_en"
FF - prefs.js..extensions.enabledItems: [removed]:1.11.7
FF - prefs.js..extensions.enabledItems: [removed]:3.5.0.145
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.64
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100119091315
FF - prefs.js..extensions.enabledItems: [removed]:1.36
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.21
FF - prefs.js..keyword.URL: "http://www.sicto.com/search/?ie=UTF-8&oe;=UTF-8&sourceid;=navclient&gfns;=1&rls;=yNByEWJA&q;="
FF - prefs.js..network.proxy.type: 0
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Fast Browser Search"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Fast Browser Search"
FF - prefs.js..browser.startup.homepage: "http://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official"

FF - user.js..browser.search.selectedEngine: "Search"
FF - user.js..keyword.URL: "http://www.sicto.com/search/?ie=UTF-8&oe;=UTF-8&sourceid;=navclient&gfns;=1&rls;=yNByEWJA&q;="

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/24 22:00:46 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/24 22:00:46 | 000,000,000 | —D | M]

[2008/08/26 13:35:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\Mozilla\Extensions
[2010/07/25 14:35:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\Mozilla\Firefox\Profiles\t4np606o.default\extensions
[2010/07/05 13:32:35 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Mattew Rigel\Application Data\Mozilla\Firefox\Profiles\t4np606o.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/02/17 09:17:51 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Mattew Rigel\Application Data\Mozilla\Firefox\Profiles\t4np606o.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/04/15 20:33:33 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Mattew Rigel\Application Data\Mozilla\Firefox\Profiles\t4np606o.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2010/07/04 13:13:52 | 000,000,000 | —D | M] (BitComet Video Downloader) – C:\Documents and Settings\Mattew Rigel\Application Data\Mozilla\Firefox\Profiles\t4np606o.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
[2010/07/04 13:13:52 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Mattew Rigel\Application Data\Mozilla\Firefox\Profiles\t4np606o.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}-trash
[2010/03/14 14:56:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\Mozilla\Firefox\Profiles\t4np606o.default\extensions\[removed]
[2010/03/14 14:41:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\Mozilla\Firefox\Profiles\t4np606o.default\extensions\[removed]
[2010/06/10 06:01:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\Mozilla\Firefox\Profiles\t4np606o.default\extensions\[removed]
[2010/07/25 14:35:44 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/02/21 03:22:32 | 000,712,704 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2009/08/31 05:11:18 | 000,873,976 | —- | M] (Ganymede Technologies) – C:\Program Files\Mozilla Firefox\plugins\NPCARDS.dll
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/11/16 17:23:30 | 000,120,296 | —- | M] ( ) – C:\Program Files\Mozilla Firefox\plugins\npganymedenet.dll
[2010/01/16 10:02:51 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll

O1 HOSTS File: ([2010/07/22 21:00:51 | 000,000,698 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.6.22.dll (BitComet)
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (Dictionary.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Need2Find Bar) - {4D1C4E89-A32A-416B-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL File not found
O3 - HKLM\..\Toolbar: (Dictionary.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Need2Find Bar) - {4D1C4E89-A32A-416B-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Dictionary.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [CarboniteSetupLite] C:\Program Files\Carbonite\CarbonitePreinstaller.exe (Carbonite, Inc.)
O4 - HKLM..\Run: [EssSpkPhone] C:\WINDOWS\essspk.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE (ATI Technologies Inc.)
O4 - HKCU..\Run: [ATI Launchpad] C:\Program Files\ATI Multimedia\main\launchpd.exe (ATI Technologies Inc.)
O4 - HKCU..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe (ATI Technologies Inc.)
O4 - HKCU..\Run: [BitComet] C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O4 - HKCU..\Run: [con] C:\WINDOWS\System32\__c002F340.exe File not found
O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe File not found
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [NBJ] C:\Program Files\Ahead\Nero BackItUp\NBJ.exe (Ahead Software AG)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [WinButler] C:\Documents and Settings\Mattew Rigel\Application Data\WinButler\WinButler.exe File not found
O4 - HKCU..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Mattew Rigel\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\Mattew Rigel\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
O4 - Startup: C:\Documents and Settings\Mattew Rigel\Start Menu\Programs\Startup\Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O8 - Extra context menu item: &D;&ownload; &with; BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D;&ownload; all video with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D;&ownload; all with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &Yahoo;! Search - C:\Program Files\Yahoo!\Common [2010/07/25 14:06:18 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &Dictionary; - C:\Program Files\Yahoo!\Common [2010/07/25 14:06:18 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &Maps; - C:\Program Files\Yahoo!\Common [2010/07/25 14:06:18 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &SMS; - C:\Program Files\Yahoo!\Common [2010/07/25 14:06:18 | 000,000,000 | —D | M]
O9 - Extra Button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL (ATI Technologies Inc.)
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.6.22.dll (BitComet)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Mattew Rigel\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Mattew Rigel\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/01/12 20:30:06 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2008/01/31 00:59:45 | 000,000,374 | R— | M] () - E:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DRAW - DVIDEO.DLL File not found
Drivers32: VIDC.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.VCR1 - ATIVCR1.DLL File not found
Drivers32: VIDC.VCR2 - ATIVCR2.DLL File not found
Drivers32: VIDC.YU12 - C:\WINDOWS\System32\atiyuv12.dll ()
Drivers32: VIDC.YUY2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YV12 - C:\WINDOWS\System32\atiyuv12.dll ()
Drivers32: VIDC.YVU9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 90 Days ==========

[2010/07/25 15:11:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Mattew Rigel\Application Data\WinRAR
[2010/07/25 12:01:01 | 000,000,000 | —D | C] – C:\Program Files\Windows Live Safety Center
[2010/07/25 11:53:32 | 000,000,000 | —D | C] – C:\Documents and Settings\Mattew Rigel\My Documents\programslog
[2010/07/24 21:53:23 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2010/07/24 21:50:48 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2010/07/24 21:50:43 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2010/07/24 21:50:31 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2010/07/22 22:48:30 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2010/07/22 21:47:37 | 000,000,000 | —D | C] – C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2010/07/22 19:49:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Mattew Rigel\Application Data\Malwarebytes
[2010/07/22 18:58:54 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/07/22 18:55:13 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/07/22 18:55:13 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/07/22 18:55:13 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/07/22 18:55:13 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/07/22 18:50:49 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/07/22 18:49:00 | 000,000,000 | —D | C] – C:\Qoobox
[2010/07/22 16:49:20 | 000,020,968 | —- | C] (Windows ® Win 7 DDK provider) – C:\WINDOWS\System32\drivers\cpuz133_x32.sys
[2010/07/22 16:49:19 | 000,000,000 | —D | C] – C:\Program Files\CPUID
[2010/07/22 14:11:10 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/07/22 14:10:50 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/07/22 13:45:11 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/22 13:45:11 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/07/20 14:28:57 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Yahoo
[2010/07/20 14:28:48 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\AskToolbar
[2010/07/20 14:28:41 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Winamp Toolbar
[2010/07/20 13:57:55 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/07/20 13:14:28 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/07/20 13:12:02 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/07/08 16:19:38 | 000,000,000 | —D | C] – C:\Documents and Settings\Mattew Rigel\My Documents\tina
[2010/07/05 07:44:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Mattew Rigel\Desktop\Angel
[2010/07/03 10:15:47 | 000,000,000 | —D | C] – C:\Documents and Settings\Mattew Rigel\Application Data\BitComet
[2010/06/29 10:01:31 | 000,038,848 | —- | C] (ALWIL Software) – C:\WINDOWS\avastSS.scr
[2010/06/21 19:24:08 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Yahoo!
[2010/06/06 11:31:01 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2010/05/31 21:30:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Mattew Rigel\Desktop\Illy with Matthew
[2010/05/29 16:46:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Mattew Rigel\My Documents\My Games
[2010/05/29 16:44:10 | 000,098,304 | —- | C] (Sony DADC Austria AG.) – C:\WINDOWS\System32\CmdLineExt.dll
[2010/05/29 16:12:04 | 000,000,000 | —D | C] – C:\Program Files\THQ
[2010/05/10 22:54:12 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/05/10 22:52:09 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/05/10 21:21:25 | 000,000,000 | —D | C] – C:\Program Files\Bonjour

========== Files - Modified Within 90 Days ==========

[2010/07/25 15:46:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/25 15:18:41 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/07/25 15:18:36 | 000,013,694 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/25 15:18:35 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/25 15:18:23 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/25 15:18:17 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/25 15:18:16 | 000,003,568 | —- | M] () – C:\WINDOWS\System32\ativvaxx.cap
[2010/07/25 15:17:06 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Mattew Rigel\ntuser.ini
[2010/07/25 15:17:05 | 005,767,168 | -H– | M] () – C:\Documents and Settings\Mattew Rigel\NTUSER.DAT
[2010/07/25 15:15:04 | 000,000,036 | —- | M] () – C:\Documents and Settings\Mattew Rigel\Local Settings\Application Data\housecall.guid.cache
[2010/07/25 14:49:50 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/07/25 14:01:00 | 000,000,248 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/07/25 09:31:16 | 000,002,265 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/07/25 09:29:27 | 000,016,112 | —- | M] () – C:\Documents and Settings\Mattew Rigel\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/07/24 21:57:00 | 000,110,192 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/07/24 21:54:28 | 000,531,002 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/07/24 21:54:28 | 000,462,498 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/07/24 21:54:28 | 000,078,318 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/07/24 13:39:04 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/07/22 22:46:46 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/07/22 21:00:51 | 000,000,698 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/07/22 19:44:31 | 000,035,262 | —- | M] () – C:\WINDOWS\Administrator.acl
[2010/07/22 18:59:01 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2010/07/22 16:49:20 | 000,000,726 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CPUID CPU-Z.lnk
[2010/07/22 14:11:12 | 000,000,705 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/19 19:24:18 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/07/15 05:14:20 | 000,001,889 | —- | M] () – C:\Documents and Settings\Mattew Rigel\Desktop\New Microsoft Wordjeramy pinch Document.doc
[2010/07/15 00:35:28 | 000,005,683 | —- | M] () – C:\Documents and Settings\Mattew Rigel\Desktop\lisa.doc
[2010/07/03 10:15:57 | 000,000,691 | —- | M] () – C:\Documents and Settings\All Users\Desktop\BitComet.lnk
[2010/06/29 10:01:51 | 000,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2010/06/28 13:57:33 | 000,038,848 | —- | M] (ALWIL Software) – C:\WINDOWS\avastSS.scr
[2010/06/28 13:57:12 | 000,165,032 | —- | M] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2010/06/28 13:37:52 | 000,046,672 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/06/28 13:37:30 | 000,165,456 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2010/06/28 13:33:13 | 000,023,376 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/06/28 13:32:45 | 000,100,176 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/06/28 13:32:42 | 000,094,544 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2010/06/28 13:32:33 | 000,017,744 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/06/28 13:32:16 | 000,028,880 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/06/27 16:50:26 | 000,000,151 | —- | M] () – C:\WINDOWS\PhotoSnapViewer.INI
[2010/06/12 16:02:01 | 000,001,629 | —- | M] () – C:\Documents and Settings\Mattew Rigel\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/06/12 16:02:00 | 000,001,611 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/06/10 15:24:50 | 000,000,827 | —- | M] () – C:\Documents and Settings\Mattew Rigel\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2010/06/10 15:24:50 | 000,000,809 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2010/06/01 18:32:02 | 002,111,540 | -H– | M] () – C:\Documents and Settings\Mattew Rigel\Local Settings\Application Data\IconCache.db
[2010/06/01 18:31:42 | 000,001,772 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Titan Quest - Immortal Throne.lnk
[2010/05/29 19:32:26 | 000,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/05/29 19:32:26 | 000,000,074 | —- | M] () – C:\Documents and Settings\Mattew Rigel\default.pls
[2010/05/29 16:44:10 | 000,098,304 | —- | M] (Sony DADC Austria AG.) – C:\WINDOWS\System32\CmdLineExt.dll
[2010/05/28 12:43:36 | 000,029,184 | —- | M] () – C:\Documents and Settings\Mattew Rigel\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/05/14 17:39:12 | 000,001,924 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/05/10 23:00:46 | 000,001,804 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/05/09 16:57:36 | 000,035,340 | —- | M] () – C:\WINDOWS\Mattew Rigel.acl
[2010/04/29 15:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 15:39:26 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/26 15:58:12 | 000,256,512 | —- | M] () – C:\WINDOWS\PEV.exe

========== Files Created - No Company Name ==========

[2010/07/25 15:15:04 | 000,000,036 | —- | C] () – C:\Documents and Settings\Mattew Rigel\Local Settings\Application Data\housecall.guid.cache
[2010/07/22 19:44:31 | 000,035,262 | —- | C] () – C:\WINDOWS\Administrator.acl
[2010/07/22 18:59:00 | 000,000,211 | —- | C] () – C:\Boot.bak
[2010/07/22 18:58:56 | 000,260,272 | —- | C] () – C:\cmldr
[2010/07/22 18:55:13 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/07/22 18:55:13 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/07/22 18:55:13 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/07/22 18:55:13 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/07/22 18:55:13 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/07/22 16:49:20 | 000,000,726 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CPUID CPU-Z.lnk
[2010/07/22 14:11:12 | 000,000,705 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/06/10 15:24:50 | 000,000,827 | —- | C] () – C:\Documents and Settings\Mattew Rigel\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2010/06/10 15:24:50 | 000,000,809 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2010/06/01 18:31:42 | 000,001,772 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Titan Quest - Immortal Throne.lnk
[2010/05/30 23:10:17 | 000,000,691 | —- | C] () – C:\Documents and Settings\All Users\Desktop\BitComet.lnk
[2010/05/30 11:44:44 | 000,005,683 | —- | C] () – C:\Documents and Settings\Mattew Rigel\Desktop\lisa.doc
[2010/05/29 16:33:12 | 000,040,960 | R— | C] () – C:\WINDOWS\System32\psfind.dll
[2010/05/14 17:39:12 | 000,001,924 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/05/10 23:00:46 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2008/09/08 12:04:28 | 000,000,000 | —- | C] () – C:\WINDOWS\ATIMMC.INI
[2008/09/08 11:05:14 | 000,354,816 | —- | C] () – C:\WINDOWS\System32\PsisDecd.dll
[2008/08/16 11:23:42 | 000,000,034 | —- | C] () – C:\WINDOWS\Blink.ini
[2008/06/15 06:00:00 | 000,000,127 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2008/04/06 16:20:00 | 000,021,840 | —- | C] () – C:\WINDOWS\System32\SIntfNT.dll
[2008/04/06 16:20:00 | 000,017,212 | —- | C] () – C:\WINDOWS\System32\SIntf32.dll
[2008/04/06 16:20:00 | 000,012,067 | —- | C] () – C:\WINDOWS\System32\SIntf16.dll
[2008/03/29 10:23:24 | 000,000,208 | —- | C] () – C:\WINDOWS\HPFTBX13.INI
[2007/10/26 15:22:17 | 000,000,000 | —- | C] () – C:\WINDOWS\pcfriend.INI
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2007/09/14 20:32:59 | 000,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2006/04/22 01:35:39 | 000,000,028 | —- | C] () – C:\WINDOWS\atid.ini
[2006/04/10 12:07:28 | 000,000,809 | —- | C] () – C:\WINDOWS\System32\install.ini
[2006/03/07 22:18:53 | 000,000,686 | —- | C] () – C:\WINDOWS\007DVDCopy.INI
[2006/02/05 17:53:35 | 000,000,210 | —- | C] () – C:\WINDOWS\System32\sr2spec.ini
[2006/02/05 17:42:52 | 000,000,611 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/01/20 08:20:17 | 000,000,151 | —- | C] () – C:\WINDOWS\PhotoSnapViewer.INI
[2006/01/15 18:58:41 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2006/01/13 16:04:00 | 000,000,192 | —- | C] () – C:\WINDOWS\winamp.ini
[2006/01/12 22:31:20 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2006/01/12 22:01:59 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\cmirmdrv.dll
[2006/01/12 22:01:51 | 000,000,092 | —- | C] () – C:\WINDOWS\CMISETUP.INI
[2006/01/12 22:01:50 | 000,000,026 | —- | C] () – C:\WINDOWS\CMCDPLAY.INI
[2006/01/12 22:01:48 | 000,000,000 | —- | C] () – C:\WINDOWS\Wininit.ini
[2006/01/12 22:01:32 | 000,132,864 | R— | C] () – C:\WINDOWS\Cmuda.ini
[2006/01/12 22:01:09 | 000,028,672 | —- | C] () – C:\WINDOWS\CMIRmDriver.dll
[2004/01/28 11:42:06 | 000,066,560 | —- | C] () – C:\WINDOWS\System32\atiyuv12.dll
[2004/01/28 11:42:06 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\Iyvu9_32.dll
[2004/01/28 11:42:06 | 000,013,601 | —- | C] () – C:\WINDOWS\System32\vctest.ini
[2003/08/07 12:01:50 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[1998/07/30 15:28:04 | 000,004,404 | —- | C] () – C:\WINDOWS\System32\HPFlnk13.ini
[1998/07/30 15:20:50 | 000,152,064 | —- | C] () – C:\WINDOWS\System32\HPFdat13.dll
[1998/07/30 15:18:44 | 000,181,248 | —- | C] () – C:\WINDOWS\System32\HPFscp13.dll
[1998/07/30 15:07:46 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\HPFhrl13.dll
[1998/07/30 15:07:42 | 000,271,360 | —- | C] () – C:\WINDOWS\System32\HPFsrl13.dll
[1998/07/30 15:07:38 | 000,297,472 | —- | C] () – C:\WINDOWS\System32\HPFmrl13.dll
[1998/07/30 15:07:32 | 001,080,320 | —- | C] () – C:\WINDOWS\System32\HPFtrl13.dll
[1998/07/30 15:03:08 | 000,194,048 | —- | C] () – C:\WINDOWS\System32\HPFcps13.dll
[1998/07/30 15:02:40 | 000,076,800 | —- | C] () – C:\WINDOWS\System32\HPF24r13.dll
[1998/07/30 15:01:28 | 000,044,544 | —- | C] () – C:\WINDOWS\System32\HPFtst13.dll
[1998/07/30 14:54:08 | 000,395,776 | —- | C] () – C:\WINDOWS\System32\HPFui13.dll
[1998/07/30 14:48:28 | 000,187,904 | —- | C] () – C:\WINDOWS\System32\HPFwin13.dll
[1998/07/30 14:45:06 | 000,037,376 | —- | C] () – C:\WINDOWS\System32\HPFmon13.dll
[1998/07/30 14:44:28 | 000,033,280 | —- | C] () – C:\WINDOWS\System32\HPFcbl13.dll
[1998/07/30 14:42:16 | 000,033,384 | —- | C] () – C:\WINDOWS\System32\HPFiop13.dll
[1998/07/30 14:42:04 | 000,069,284 | —- | C] () – C:\WINDOWS\System32\HPFpml13.dll
[1998/07/30 14:41:58 | 000,137,232 | —- | C] () – C:\WINDOWS\System32\HPFmlc13.dll
[1998/07/30 14:41:52 | 000,057,240 | —- | C] () – C:\WINDOWS\System32\HPFmem13.dll
[1998/07/30 14:41:48 | 000,048,292 | —- | C] () – C:\WINDOWS\System32\HPFlpm13.dll
[1998/07/30 14:41:36 | 000,072,368 | —- | C] () – C:\WINDOWS\System32\HPFcom13.dll
[1998/07/30 14:40:42 | 000,052,800 | —- | C] () – C:\WINDOWS\System32\drivers\HPFecp13.sys
[1998/07/30 14:39:52 | 000,029,184 | —- | C] () – C:\WINDOWS\System32\HPFrsu13.dll
[1998/07/30 14:39:22 | 000,117,760 | —- | C] () – C:\WINDOWS\System32\HPFrsa13.dll
[1998/07/30 14:34:46 | 001,777,664 | —- | C] () – C:\WINDOWS\System32\HPFimg13.dll
[1998/07/30 14:31:26 | 000,124,928 | —- | C] () – C:\WINDOWS\System32\HPFcnt13.dll
[1996/11/17 01:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\ODBCSTF.DLL
[1996/11/17 01:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\DOCOBJ.DLL
[1996/11/17 01:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL

========== LOP Check ==========

[2009/02/26 15:47:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\22148
[2009/07/17 07:07:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\2A119
[2010/04/16 21:11:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/01/24 09:46:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Electronic Arts
[2007/10/21 16:32:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2008/08/21 19:56:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OrbNetworks
[2010/01/16 10:04:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2009/10/01 09:04:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2006/04/22 02:06:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/06/01 15:09:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Winferno
[2010/04/13 02:02:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2007/12/19 03:04:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\7Wonders
[2006/04/22 07:14:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\Aim
[2010/07/03 10:15:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\BitComet
[2010/02/03 04:50:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\GanymedeNet
[2009/06/29 16:26:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\GetRightToGo
[2009/06/08 16:10:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\gtk-2.0
[2009/10/01 08:31:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\iWin
[2009/07/23 18:16:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\Mount&Blade;
[2007/10/21 16:31:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\NCH Swift Sound
[2006/04/21 22:40:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\Opera
[2010/01/17 04:16:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\Turbine
[2008/09/08 21:08:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\Windows Desktop Search
[2008/09/08 22:30:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\Windows Search
[2010/07/25 14:01:00 | 000,000,248 | —- | M] () – C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2007/03/13 01:34:36 | 007,684,787 | —- | M] () – C:\01 Battery.MP3
[2007/03/13 00:57:22 | 005,899,229 | —- | M] () – C:\03 Holier Than Thou.MP3
[2006/01/12 20:30:06 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2008/08/09 16:34:33 | 000,000,211 | —- | M] () – C:\Boot.bak
[2010/07/22 18:59:01 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | —- | M] () – C:\cmldr
[2010/07/22 22:48:29 | 000,037,999 | —- | M] () – C:\ComboFix.txt
[2006/01/12 20:30:06 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2007/04/11 16:45:04 | 000,004,717 | -H– | M] () – C:\ffastun.ffa
[2007/04/11 16:45:04 | 000,450,560 | -H– | M] () – C:\ffastun.ffl
[2007/04/11 16:45:04 | 000,122,880 | -H– | M] () – C:\ffastun.ffo
[2007/04/11 16:45:04 | 003,006,464 | -H– | M] () – C:\ffastun0.ffx
[2007/04/11 18:58:35 | 000,450,560 | —- | M] () – C:\ffastunT.ffl
[2009/11/29 15:19:37 | 002,052,546 | —- | M] () – C:\hrt.bmp
[2006/01/12 20:30:06 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2006/04/22 01:36:30 | 000,000,630 | -H– | M] () – C:\IPH.PH
[2008/09/08 11:19:00 | 000,000,361 | —- | M] () – C:\mmcInst.log
[2006/01/12 20:30:06 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/08/23 07:58:29 | 000,250,048 | RHS- | M] () – C:\ntldr
[2008/08/20 09:58:02 | 000,004,121 | —- | M] () – C:\ntldr.srm
[2008/12/17 14:22:39 | 000,262,144 | —- | M] () – C:\ntuser.dat
[2009/06/02 18:34:18 | 000,001,024 | -H– | M] () – C:\ntuser.dat.LOG
[2010/07/25 15:18:14 | 754,974,720 | -HS- | M] () – C:\pagefile.sys
[2009/02/26 15:36:57 | 000,013,030 | —- | M] () – C:\PDOXUSRS.NET
[2005/05/05 02:29:20 | 000,001,567 | —- | M] () – C:\ReadMeFirst.txt
[2007/03/13 01:33:08 | 000,002,365 | —- | M] () – C:\The Cool stuff.gxf
[2006/04/21 23:40:50 | 000,000,000 | —- | M] () – C:\tool1.exe
[2006/04/21 23:40:50 | 000,000,000 | —- | M] () – C:\tool2.exe
[2006/04/21 23:40:50 | 000,000,000 | —- | M] () – C:\tool3.exe
[2006/04/21 23:40:50 | 000,000,000 | —- | M] () – C:\tool4.exe
[2006/04/21 23:40:50 | 000,000,000 | —- | M] () – C:\tool5.exe
[2010/03/15 17:14:52 | 000,032,322 | —- | M] () – C:\winzip.log

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/01/12 20:29:36 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 05:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 03:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.scr >
[2010/06/28 13:57:33 | 000,038,848 | —- | M] (ALWIL Software) – C:\WINDOWS\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2008/08/20 20:27:51 | 000,001,594 | -H– | M] () – C:\Documents and Settings\Mattew Rigel\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >
[2006/04/21 23:48:39 | 000,000,000 | —- | M] () – C:\Program Files\secure32.html
[2008/09/08 21:16:42 | 000,000,000 | —- | M] () – C:\Program Files\temp01

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/07/31 21:33:54 | 000,425,984 | —- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 – C:\WINDOWS\system32\ATIDEMGX.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/01/12 12:14:08 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2006/01/12 12:14:08 | 000,634,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2006/01/12 12:14:08 | 000,880,640 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/13 17:12:08 | 000,578,560 | —- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B – C:\WINDOWS\system32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/13 17:12:10 | 000,082,432 | —- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A – C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/13 17:12:10 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 – C:\WINDOWS\system32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-25 04:55:33

========== Alternate Data Streams ==========

@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C8591AF9
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:51E02732
< End of report >

Extra's

OTL Extras logfile created on: 7/25/2010 3:44:21 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Mattew Rigel\My Documents\programslog
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 60.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 74.00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 66.09 Gb Total Space | 5.11 Gb Free Space | 7.73% Space Free | Partition Type: NTFS
Drive D: | 123.83 Gb Total Space | 116.35 Gb Free Space | 93.96% Space Free | Partition Type: NTFS
Drive E: | 351.60 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MATTEW
Current User Name: Mattew Rigel
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files\Winamp\Winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"8052:TCP" = 8052:TCP:*:Enabled:BitComet 8052 TCP
"8052:UDP" = 8052:UDP:*:Enabled:BitComet 8052 UDP

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\BitComet\BitComet.exe" = C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client – (www.BitComet.com)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Disabled:Pando Media Booster – ()

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{083F79E4-6FE9-46FB-A6C6-4F8862742947}" = ATI HYDRAVISION
"{0A146245-DB79-4197-BF5D-FE1A699A2CC7}" = Camera Window DS
"{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0
"{14298AFE-9001-9CFB-595E-38BB3DCB25D3}" = ccc-utility
"{146E206D-7D2C-493A-B431-1F1D16E822AF}" = MobileMe Control Panel
"{1BA6EE26-3358-B634-FD05-D07C964EE944}" = Skins
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"{26B878A8-5704-3B64-BDBC-4F0EACA38121}" = Google Talk Plugin
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{37C39957-B0B3-40DC-8BA4-2363241159ED}" = LightScribe [removed]
"{412B69AF-C352-4F6F-A318-B92B3CB9ACC6}" = Titan Quest
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{483616D1-867E-46F8-BEC7-3C6475933908}" = Adobe Photoshop Album Starter Edition
"{4DBBF091-FACD-422C-B43C-786335BD5398}" = MovieEdit Task
"{4F55E486-4EDE-A879-B6CC-0B07DD475540}" = Catalyst Control Center Graphics Light
"{50E25180-3BDC-4B6D-80A2-3F1F0C9CF39D}" = Camera Window DVC
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes
"{66F4C25D-B1FE-4316-BC63-79AD4E6724BF}" = ATI Multimedia Center
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6C3A75A6-9A90-44A3-A703-82AC1EA6A85D}" = Camera Window MC
"{746E4937-CC0E-C8A2-CEF3-41774D227847}" = Catalyst Control Center Graphics Full Existing
"{752CA503-E29F-4610-A1A4-B21CDC58EF8D}" = SAS10
"{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0
"{7FA4C99A-5B8A-4AF2-9F2B-BC9CE7386947}" = ATI Decoder
"{80A1F948-2D8E-7C25-87AA-6D8294334A5D}" = Catalyst Control Center Core Implementation
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{874E44F3-B9A7-4AA1-B4BA-83E5684ED9C6}" = PhotoStitch
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour
"{8A50284B-6426-2FDF-48BD-0895482344E8}" = CCC Help English
"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
"{8F36E44A-E6E7-41B7-B6F6-4637BF84EFA5}" = ATI Remote Wonder
"{901F8ED7-13E8-43EF-B738-2FE89B0588EB}" = Camera Access Library
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{99D34763-7E45-4FE5-8424-28DBC3A5F0BF}" = GUIDE PLUS+™ for Windows® System - ATI
"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support
"{A1D0D14A-B776-4907-BC00-5149F2298086}" = Camera Support Core Library
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A2EB8F2E-6D9B-4F8B-96EB-F976D33F416F}" = Camera Window DVC
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A59BB15D-51B7-F12B-4548-8C0368243441}" = EA Download Manager UI
"{A67BB21E-D419-45BB-AB86-7D87D14BBCE2}" = Safari
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AEC1D0F9-A34D-452E-B513-D997C4925E52}" = Temperature Converter
"{B5C5C17E-FEF6-4062-8151-A427AE8AF9D7}" = Titan Quest Immortal Throne
"{B74D4E10-6884-0000-0000-000000000103}" = Adobe Bridge 1.0
"{B93F0E87-FBDB-097E-5DCA-FF99110F26E0}" = Catalyst Control Center Graphics Previews Common
"{BAA43DA2-B6C5-46EC-B163-0E8EEAF975A4}" = RAW Image Task 2.2
"{BBBC2B89-E193-4348-A83C-C8DD8210A4AC}" = Canon PhotoRecord
"{C04ED833-89A3-BC13-BAE3-96FDD56933F9}" = Catalyst Control Center Graphics Full New
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}" = Canon ZoomBrowser EX (E)
"{C88E49AA-41C5-4420-A08D-BE1B6C5A3A74}" = DAO
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDC31D08-9789-2554-2670-C33BC49F0DD3}" = ccc-core-static
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"{FA3A247D-437A-455E-A88F-7EB6E5F9E799}" = Catalyst Control Center - Branding
"{FE2881D8-236B-6B25-2C5A-74CFB00F2756}" = ccc-core-preinstall
"007 DVD Copy_is1" = 007 DVD Copy 1.0
"15b35190-c6f9-11d9-9669-0800200c9a66_is1" = Dungeons & Dragons Online ®: Eberron Unlimited ™ v01.10.01.801
"Adobe Acrobat 4.0" = Adobe Acrobat 4.0
"Adobe AIR" = Adobe AIR
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"avast5" = avast! Free Antivirus
"BitComet" = BitComet 1.22
"Carbonite Setup Lite" = Carbonite Online Backup Setup
"Celestia_is1" = Celestia 1.5.1
"C-Media Audio" = C-Media 3D Audio
"C-Media Audio Driver" = C-Media WDM Audio Driver
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.54
"Diablo" = Diablo
"Diablo II" = Diablo II
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVD Shrink_is1" = DVD Shrink 3.2
"EA Download Manager" = EA Download Manager
"Flash DVD Ripper" = Flash DVD Ripper
"GameDesire-Pool & Snooker" = GameDesire-Pool & Snooker
"Gliderman" = Gliderman
"Google Chrome" = Google Chrome
"Google Updater" = Google Updater
"GXTranscoder v2" = GXTranscoder v2
"HP DeskJet 710C Series" = HP DeskJet 710C Series (Remove only)
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{0A146245-DB79-4197-BF5D-FE1A699A2CC7}" = Canon Camera Window DSLR 5 for ZoomBrowser EX
"InstallShield_{4DBBF091-FACD-422C-B43C-786335BD5398}" = Canon MovieEdit Task for ZoomBrowser EX
"InstallShield_{50E25180-3BDC-4B6D-80A2-3F1F0C9CF39D}" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"InstallShield_{66F4C25D-B1FE-4316-BC63-79AD4E6724BF}" = ATI Multimedia Center 9.061
"InstallShield_{6C3A75A6-9A90-44A3-A703-82AC1EA6A85D}" = Canon Camera Window MC 6 for ZoomBrowser EX
"InstallShield_{752CA503-E29F-4610-A1A4-B21CDC58EF8D}" = AuthorScript Engine 1.0
"InstallShield_{7FA4C99A-5B8A-4AF2-9F2B-BC9CE7386947}" = ATI Decoder
"InstallShield_{874E44F3-B9A7-4AA1-B4BA-83E5684ED9C6}" = Canon Utilities PhotoStitch 3.1
"InstallShield_{8F36E44A-E6E7-41B7-B6F6-4637BF84EFA5}" = ATI Remote Wonder 3.02
"InstallShield_{901F8ED7-13E8-43EF-B738-2FE89B0588EB}" = Canon Camera Access Library
"InstallShield_{A1D0D14A-B776-4907-BC00-5149F2298086}" = Canon Camera Support Core Library
"InstallShield_{A2EB8F2E-6D9B-4F8B-96EB-F976D33F416F}" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"InstallShield_{BAA43DA2-B6C5-46EC-B163-0E8EEAF975A4}" = Canon RAW Image Task for ZoomBrowser EX
"InstallShield_{C88E49AA-41C5-4420-A08D-BE1B6C5A3A74}" = DAO
"InterActual Player" = InterActual Player
"Lionheart_is1" = Lionheart: Legacy of the Crusader ™
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Matroska Pack" = Matroska Pack (remove only)
"MatroskaProp" = MatroskaProp (remove only)
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"Need2FindBar Uninstall" = Need2Find Bar
"NeroMultiInstaller!UninstallKey" = Nero Suite
"Network Stumbler" = Network Stumbler 0.4.0 (remove only)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Office8.0" = Microsoft Office 97, Professional Edition
"Orb" = Winamp Remote
"SiSLan" = SiS 900 PCI Fast Ethernet Adapter Driver
"Super Mario Pac_is1" = Super Mario Pac v1.1
"Switch" = Switch
"ViewpointMediaPlayer" = Viewpoint Media Player
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Winamp" = Winamp
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Customizations" = Yahoo! extras
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Search Defender" = Yahoo! Search Protection
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Diablo" = Diablo
"Diablo II" = Diablo II
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.8.1

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/25/2010 5:44:37 PM | Computer Name = MATTEW | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 7/25/2010 5:46:44 PM | Computer Name = MATTEW | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 7/25/2010 5:46:45 PM | Computer Name = MATTEW | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: A connection with the server could not be established

Error - 7/25/2010 5:46:45 PM | Computer Name = MATTEW | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 7/25/2010 5:46:45 PM | Computer Name = MATTEW | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 7/25/2010 5:58:36 PM | Computer Name = MATTEW | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 7/25/2010 5:58:36 PM | Computer Name = MATTEW | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 7/25/2010 5:58:37 PM | Computer Name = MATTEW | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: A connection with the server could not be established

Error - 7/25/2010 5:58:37 PM | Computer Name = MATTEW | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 7/25/2010 5:58:37 PM | Computer Name = MATTEW | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

[ System Events ]
Error - 7/25/2010 5:12:58 PM | Computer Name = MATTEW | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 7/25/2010 5:13:33 PM | Computer Name = MATTEW | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 7/25/2010 5:14:01 PM | Computer Name = MATTEW | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Aavmker4 AmdPPM aswSP aswTdi Fips

Error - 7/25/2010 5:14:42 PM | Computer Name = MATTEW | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 7/25/2010 5:19:13 PM | Computer Name = MATTEW | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 7/25/2010 5:20:12 PM | Computer Name = MATTEW | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 7/25/2010 5:21:55 PM | Computer Name = MATTEW | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 7/25/2010 5:22:02 PM | Computer Name = MATTEW | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 7/25/2010 5:22:59 PM | Computer Name = MATTEW | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Aavmker4 AmdPPM aswSP aswTdi Fips

Error - 7/25/2010 6:17:04 PM | Computer Name = MATTEW | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

< End of report >

jeff matthews

Post #24July 25, 2010, 11:40 PM UTC last edited July 26, 2010, 12:47 AM UTC

I was going to run kaspersky as well and post that log but now that there is no java installed, i can't run any online scanner either. Ok this isnt really changing any settings my self, but i right clicked on the connection and hit repair and it fixed it self, now i can install java and other software programs. I guess something keeps changing the darn internet settings causing the computer to have problems. In the log, i noticed this. IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5643 If that helps any. Im not trying to tell you how to do your job so don't get the wrong idea, i know im not an expert at this but i just simply was curious so i found proxy and it said overrde. What is that? I guess after doing the repair network connection, it fixed it for the time being anyway.

CatByte

Post #25July 26, 2010, 2:01 AM UTC

Hi,

Please do the following:

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5643
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Need2Find Bar) - {4D1C4E89-A32A-416B-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Need2Find Bar) - {4D1C4E89-A32A-416B-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL File not found
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [WinButler] C:\Documents and Settings\Mattew Rigel\Application Data\WinButler\WinButler.exe File not found
O4 - HKCU..\Run: [con] C:\WINDOWS\System32\__c002F340.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
[2009/10/01 08:31:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Mattew Rigel\Application Data\iWin

:Commands
[resethosts]
[emptyflash]
[purity]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the OTL log

NEXT

Open notepad and copy/paste the text in the quotebox below into it:

@echo off
dir /a /s "C:\Documents and Settings\All Users\Application Data\22148" >> log.txt
dir /a /s "C:\Documents and Settings\All Users\Application Data\2A119" >> log.txt
notepad log.txt
del %0

Save this as look.bat Choose to "Save type as - All Files"
It should look like this: [external image: Posted Image]

click on look.bat & allow it to run. Post the contents of the log which should appear.

jeff matthews

Post #26July 26, 2010, 4:39 AM UTC

ok both logs All processes killed ========== OTL ========== Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}\ not found. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found. HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully! HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{4D1C4E89-A32A-416B-BCDB-33B3EF3617D3} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416B-BCDB-33B3EF3617D3}\ deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4D1C4E89-A32A-416B-BCDB-33B3EF3617D3} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416B-BCDB-33B3EF3617D3}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\WinButler deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\con deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully. C:\Documents and Settings\Mattew Rigel\Application Data\iWin\BattleshipSA folder moved successfully. C:\Documents and Settings\Mattew Rigel\Application Data\iWin folder moved successfully. ========== COMMANDS ========== C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYFLASH] User: Administrator ->Flash cache emptied: 0 bytes User: All Users User: Default User ->Flash cache emptied: 0 bytes User: Guest User: LocalService User: Mattew Rigel ->Flash cache emptied: 886 bytes User: NetworkService ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0.00 mb [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 0 bytes User: Guest ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Mattew Rigel ->Temp folder emptied: 120516352 bytes ->Temporary Internet Files folder emptied: 2073230 bytes ->Java cache emptied: 128094 bytes ->FireFox cache emptied: 76065444 bytes ->Flash cache emptied: 0 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 300302 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 52324232 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 18684 bytes Total Files Cleaned = 240.00 mb OTL by OldTimer - Version 3.2.9.1 log created on 07252010_211941 Files\Folders moved on Reboot… Registry entries deleted on Reboot… Volume in drive C is DSK1_VOL1 Volume Serial Number is 30B9-AA80 Directory of C:\Documents and Settings\All Users\Application Data\22148 02/26/2009 03:47 PM . 02/26/2009 03:47 PM .. 12/01/2008 09:12 AM 2,242 {65195E7C-1398-4B26-B65A-BB3689CBC32A}.swf 1 File(s) 2,242 bytes Total Files Listed: 1 File(s) 2,242 bytes 2 Dir(s) 4,904,316,928 bytes free Volume in drive C is DSK1_VOL1 Volume Serial Number is 30B9-AA80 Directory of C:\Documents and Settings\All Users\Application Data\2A119 07/17/2009 07:07 AM . 07/17/2009 07:07 AM .. 12/01/2008 09:12 AM 2,242 {679AF28E-E3EE-45DE-A60F-C5E9CBB4ECFE}.swf 1 File(s) 2,242 bytes Total Files Listed: 1 File(s) 2,242 bytes 2 Dir(s) 4,904,312,832 bytes free

jeff matthews

Post #27July 26, 2010, 4:40 AM UTC last edited July 26, 2010, 5:10 AM UTC

He has alot of programs on this computer and other stuff that is so out of date from like years ago. Is there any other software i should delete from his list? I won't do anything untill you reply with the next steps. Btw after using OTL and posting those 2 logs, i ran a scan with kaspersky and was going to post a log but it didn't find anything. So i guess thats good, were starting to get closer. The "need2findbar" still remains in the programs list and i can't remove it. You want me to post a new program list, so you can check it over? Umm i also noticed something called freeze.com. Its actually redirecting his internet to this URL so im assuming thats something that needs to be deleted as well, but i won't touch nothing without your consent.

CatByte

Post #28July 26, 2010, 8:04 AM UTC

Hi

Please try using Revo uninstaller for that program, a necessary installation file or registry entry must have been removed so now it wont uninstall.

Download and install the Revo Uninstaller

Double click the new Revo Uninstaller icon on your desktop to start the program
Scroll through the listed programs and Right Click on the program you wish to uninstall (need2findbar)
From the pop out menu choose Uninstall
Click Yes to the confirmation dialogue
In the next window select the Advanced mode
Click Next to start uninstalling the program
Answer Yes to confirm the uninstall
When the program has completed the four steps, click Next to allow the program to search for leftovers
Once complete, click Next, then Finish
Repeat the above steps for any other programs you wish to remove.

Uninstall the Ask toolbar as well

what is the path to freeze.com that you are mentioning? I don't see it in the logs?

NEXT

delete the copy of ComboFix that you have on your desktop and download a fresh copy from the link below

be sure to disable the security programs and run it - post the resulting log:

Link 1

jeff matthews

Post #29July 26, 2010, 8:18 AM UTC last edited July 26, 2010, 8:21 AM UTC

Ok i did all of the following, how do i delete the current combo fix. Don't you have to use a special software for removing that completely.

what is the path to freeze.com that you are mentioning? I don't see it in the logs?

Actually i found it when trying to look for the "need2findbar" in C://Program files.

After all this, do you want me to run any more software scans to ensure a complete clean?

Also from your perspective, what is the status of this machine. Does it look like its almost clean to you or is there still some finalizing, im just curious. Cause this machine had alot of issues. How can you be sure that the machine is completly virus and maleware free. I guess you know what your doing though.

CatByte

Post #30July 26, 2010, 8:26 AM UTC

right click on the ComboFix icon > choose delete

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

An extremly infected machine!

✨ Ask AI

Ask AI