Spyware / Malware / Virus Removal

All search engines redirecting me, have tried to remove.

8 min read

Looking for the outcome? Ask AI

Vilya Topic Starter

Post #1July 29, 2010, 11:46 PM UTC

Hi. For a week I've been having all of my search engines on Firefox redirecting me. Yahoo search, google search, MSN search … I've tried the instructions here: http://forums.whatthetech.com/index.php?showtopic=112732 Yet it is still doing it. So, I figure at this point I need serious help from an expert.

Here's my Hijack this log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:46:03 PM, on 7/29/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Smith Micro\StuffIt11\ArcNameService.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\dlbucoms.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Tiffany.CIARAN\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKLM\..\Policies\Explorer\Run: [OCRFOC] rundll32 "C:\WINDOWS\system32\vjoyg.dll",ONTWOM
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…20Installer.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {2042B57E-6336-459E-B7CE-2A0F6C9E6AF8} (IEPlayInterface Class) - file:///E:/win/setup/iaieplay.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1173310928812
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {8B67B37E-1AE2-4B99-B8CF-55AF4D58DF0D} (IAMCE Class) - file:///E:/win/setup/iamce.dll
O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} (Windows Live SkyDrive Upload Tool) - http://shared.live.com/0AWo70tq93pEHO1Wfbb….RichUpload.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/…024/mcfscan.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - Unknown owner - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Stuffit Archive Name Service - Smith Micro Software, Inc. - C:\Program Files\Smith Micro\StuffIt11\ArcNameService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 13141 bytes

hammerman

Post #2July 30, 2010, 9:56 AM UTC

Hello and welcome to WhattheTech

I'm hammerman and I'm going to help you fix your problem.

Before we begin, here are some guidelines which will help us both in fixing your problem.

Malware removal is not instantaneous and will take a number of steps to complete. Please continue to carry out the steps requested until I let you know that your computer appears clean.
Please do no attach logs or post them in Quote/Code boxes unless requested.
I suggest you print or save any instructions I give you for easy reference. We may be using Safe mode and you will not always be able to access this thread. You can copy and paste these instructions into Notepad and then save the text file to your Desktop. If you need any help with this or further clarification, please let me know.
When posting logs, please ensure Word Wrap is turned off in Notepad. Open Notepad, select Format on the menu bar and make sure that Word Wrap is unchecked.
Please follow the steps exactly in the same order posted. If you can't perform a certain step, or you're unsure on what to do, please stop and let me know.
If in doubt about anything, please ask.

Please follow these steps.

– Step 1 –

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Custom Scan box paste this in

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

– Step 2 –

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked. UNCHECK the following boxes
- Sections
- IAT/EAT
- Drives/Partition other than System drive (typically C:\)
- Show all (important)
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

Vilya

Post #3July 30, 2010, 1:42 PM UTC

Hey, thanks for the reply.

OTL.txt:

OTL logfile created on: 7/30/2010 9:34:10 AM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Tiffany.CIARAN\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 441.00 Mb Available Physical Memory | 43.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 228.11 Gb Total Space | 95.79 Gb Free Space | 41.99% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CIARAN
Current User Name: Tiffany
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Tiffany.CIARAN\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools)
PRC - C:\Program Files\PC Tools Firewall Plus\FWService.exe (PC Tools)
PRC - C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)
PRC - C:\Program Files\Smith Micro\StuffIt11\ArcNameService.exe (Smith Micro Software, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe (Viewpoint Corporation)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\WINDOWS\system32\snmp.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe ()
PRC - C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe ()
PRC - C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell Photo AIO Printer 942\memcard.exe ()
PRC - C:\WINDOWS\system32\dlbucoms.exe (Dell)
PRC - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe ()
PRC - C:\WINDOWS\system32\CTHELPER.EXE (Creative Technology Ltd)
PRC - C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
PRC - C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDET.exe (Creative Technology Ltd)
PRC - C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe (Logitech Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Tiffany.CIARAN\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\ctagent.dll (Creative Technology Ltd)

========== Win32 Services (SafeList) ==========

SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe File not found
SRV - (avg9emc) – C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (PCToolsFirewallPlus) – C:\Program Files\PC Tools Firewall Plus\FWService.exe (PC Tools)
SRV - (Stuffit Archive Name Service) – C:\Program Files\Smith Micro\StuffIt11\ArcNameService.exe (Smith Micro Software, Inc.)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (SNMP) – C:\WINDOWS\system32\snmp.exe (Microsoft Corporation)
SRV - (LPDSVC) – C:\WINDOWS\system32\tcpsvcs.exe (Microsoft Corporation)
SRV - (W3SVC) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (SMTPSVC) Simple Mail Transfer Protocol (SMTP) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (IISADMIN) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (dlbu_device) – C:\WINDOWS\System32\dlbucoms.exe (Dell)
SRV - (spkrmon) – C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe ()

========== Driver Services (SafeList) ==========

DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys File not found
DRV - (mcdbus) – C:\WINDOWS\System32\DRIVERS\mcdbus.sys File not found
DRV - (InCDRm) – C:\WINDOWS\System32\drivers\InCDRm.sys File not found
DRV - (InCDPass) – C:\WINDOWS\System32\drivers\InCDPass.sys File not found
DRV - (InCDFs) – C:\WINDOWS\System32\drivers\InCDFs.sys File not found
DRV - (catchme) – C:\DOCUME~1\TIFFAN~1.CIA\LOCALS~1\Temp\catchme.sys File not found
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (AvgTdiX) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (MQAC) – C:\WINDOWS\system32\drivers\mqac.sys (Microsoft Corporation)
DRV - (WsAudio_DeviceS(1)) WsAudio_DeviceS(1) – C:\WINDOWS\system32\drivers\WsAudio_DeviceS(1).sys (Wondershare)
DRV - (PCTAppEvent) – C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools)
DRV - (pctplfw) – C:\WINDOWS\system32\drivers\pctplfw.sys (PC Tools)
DRV - (AsAudioDevice_351) – C:\WINDOWS\system32\drivers\AsAudioDevice_351.sys (Wondershare)
DRV - (pctgntdi) – C:\WINDOWS\system32\drivers\pctgntdi.sys (PC Tools)
DRV - (SFilter) – C:\WINDOWS\system32\drivers\pctfw.sys (PC Tools)
DRV - (RMCAST) – C:\WINDOWS\system32\drivers\rmcast.sys (Microsoft Corporation)
DRV - (BVRPMPR5) – C:\WINDOWS\system32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (CT20XUT.DLL) – C:\WINDOWS\System32\CT20XUT.DLL (Creative Technology Ltd.)
DRV - (CTHWIUT.DLL) – C:\WINDOWS\System32\CTHWIUT.DLL (Creative Technology Ltd.)
DRV - (CTEXFIFX.DLL) – C:\WINDOWS\System32\CTEXFIFX.DLL (Creative Technology Ltd.)
DRV - (CTEDSPSY.DLL) – C:\WINDOWS\System32\CTEDSPSY.DLL (Creative Technology Ltd)
DRV - (CTEDSPIO.DLL) – C:\WINDOWS\System32\CTEDSPIO.DLL (Creative Technology Ltd)
DRV - (CTEDSPFX.DLL) – C:\WINDOWS\System32\CTEDSPFX.DLL (Creative Technology Ltd)
DRV - (CTERFXFX.DLL) – C:\WINDOWS\System32\CTERFXFX.DLL (Creative Technology Ltd)
DRV - (CTEAPSFX.DLL) – C:\WINDOWS\System32\CTEAPSFX.DLL (Creative Technology Ltd)
DRV - (IrBus) – C:\WINDOWS\system32\drivers\irbus.sys (Microsoft Corporation)
DRV - (Aspi32) – C:\WINDOWS\system32\drivers\ASPI32.SYS (Adaptec)
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (iastor) – C:\WINDOWS\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (IntelC52) – C:\WINDOWS\system32\drivers\IntelC52.sys (Intel Corporation)
DRV - (IntelC51) – C:\WINDOWS\system32\drivers\IntelC51.sys (Intel Corporation)
DRV - (IntelC53) – C:\WINDOWS\system32\drivers\IntelC53.sys (Intel Corporation)
DRV - (mohfilt) – C:\WINDOWS\system32\drivers\mohfilt.sys (Intel Corporation)
DRV - (ctdvda2k) – C:\WINDOWS\system32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (hap16v2k) – C:\WINDOWS\system32\drivers\hap16v2k.sys (Creative Technology Ltd)
DRV - (ha10kx2k) – C:\WINDOWS\system32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (PfModNT) – C:\WINDOWS\system32\drivers\pfmodnt.sys (Creative Technology Ltd.)
DRV - (CTSBLFX.DLL) – C:\WINDOWS\System32\CTSBLFX.DLL (Creative Technology Ltd)
DRV - (CTAUDFX.DLL) – C:\WINDOWS\System32\CTAUDFX.DLL (Creative Technology Ltd)
DRV - (COMMONFX.DLL) – C:\WINDOWS\System32\COMMONFX.DLL (Creative Technology Ltd)
DRV - (emupia) – C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (PhilCam8116) Logitech QuickCam Pro 3000(PID_08B0) – C:\WINDOWS\system32\drivers\CamDrL21.sys (Philips Semiconductors)
DRV - (OMCI) – C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS (Dell Computer Corporation)
DRV - (MODEMCSA) – C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://my.msn.com/default.aspx?mypg=1"
FF - prefs.js..extensions.enabledItems: {1392b8d2-5c05-419f-a8f6-b9f15a596612}:2.5.6.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100119091315
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.845

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/07/21 09:36:59 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/27 10:02:40 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/24 22:35:10 | 000,000,000 | —D | M]

[2009/08/11 22:46:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Mozilla\Extensions
[2010/07/29 19:43:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Mozilla\Firefox\Profiles\0gx36beu.default\extensions
[2010/03/12 22:25:19 | 000,000,000 | —D | M] (Freecorder Toolbar) – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Mozilla\Firefox\Profiles\0gx36beu.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}
[2010/04/26 21:06:17 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Mozilla\Firefox\Profiles\0gx36beu.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/02/18 14:49:19 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Mozilla\Firefox\Profiles\0gx36beu.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/07/29 19:43:20 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/05/07 10:43:39 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/04/16 13:07:12 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
[2007/03/09 19:16:44 | 000,189,496 | —- | M] (Yahoo! Inc.) – C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll

O1 HOSTS File: ([2010/07/24 01:02:42 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [00PCTFW] C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AsioReg] C:\WINDOWS\System32\ctasio.dll (Creative Technology Ltd)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDET.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CTHELPER.EXE (Creative Technology Ltd)
O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTxfiHlp] C:\WINDOWS\System32\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Dell Photo AIO Printer 942] C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe ()
O4 - HKLM..\Run: [DellMCM] C:\Program Files\Dell Photo AIO Printer 942\memcard.exe ()
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe (Logitech Inc.)
O4 - HKLM..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe (Logitech Inc.)
O4 - HKLM..\Run: [MsmqIntCert] C:\WINDOWS\System32\mqrt.dll (Microsoft Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl File not found
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe ()
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe ()
O4 - Startup: C:\Documents and Settings\Tiffany.CIARAN\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\Tiffany.CIARAN\Start Menu\Programs\Startup\Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: OCRFOC = rundll32 "C:\WINDOWS\system32\vjoyg.dll",ONTWOM ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Yahoo;! Search - C:\Program Files\Yahoo!\Common [2009/08/13 13:59:31 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &Dictionary; - C:\Program Files\Yahoo!\Common [2009/08/13 13:59:31 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &Maps; - C:\Program Files\Yahoo!\Common [2009/08/13 13:59:31 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &SMS; - C:\Program Files\Yahoo!\Common [2009/08/13 13:59:31 | 000,000,000 | —D | M]
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe File not found
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} https://activatemydsl.verizon.net/sdcCommon…20Installer.cab (Support.com Configuration Class)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/F/D…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2042B57E-6336-459E-B7CE-2A0F6C9E6AF8} file:///E:/win/setup/iaieplay.dll (IEPlayInterface Class)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2…78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/Facebo…otoUploader.cab (Reg Error: Key error.)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1173310928812 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8B67B37E-1AE2-4B99-B8CF-55AF4D58DF0D} file:///E:/win/setup/iamce.dll (IAMCE Class)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} http://shared.live.com/0AWo70tq93pEHO1Wfbb….RichUpload.cab (Windows Live SkyDrive Upload Tool)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/…024/mcfscan.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\Documents and Settings\Tiffany.CIARAN\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Tiffany.CIARAN\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/03/03 11:15:14 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.VP60 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: wave1 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16620634377289728)

========== Files/Folders - Created Within 30 Days ==========

[2010/07/30 09:31:24 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Tiffany.CIARAN\Desktop\OTL.exe
[2010/07/29 19:45:09 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Tiffany.CIARAN\Desktop\HiJackThis.exe
[2010/07/27 09:58:32 | 000,000,000 | —D | C] – C:\Program Files\Alcohol Soft
[2010/07/27 09:47:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Documents\DAEMON Tools Images
[2010/07/27 09:46:19 | 000,000,000 | —D | C] – C:\Program Files\DAEMON Tools Lite
[2010/07/27 09:45:25 | 009,591,104 | —- | C] (DT Soft Ltd.) – C:\Documents and Settings\Tiffany.CIARAN\My Documents\DTLite4356-0091.exe
[2010/07/24 01:12:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\FrontLine Registry Cleaner
[2010/07/24 01:12:51 | 000,000,000 | —D | C] – C:\Program Files\Frontline Registry Cleaner
[2010/07/24 01:12:33 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/07/24 00:46:06 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/07/24 00:39:46 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/07/24 00:39:46 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/07/24 00:39:46 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/07/24 00:39:45 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/07/16 21:29:07 | 000,012,536 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2010/07/15 04:33:10 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\My Documents\gyllenhaal videos
[2010/07/10 16:21:02 | 000,000,000 | —D | C] – C:\Program Files\Free FLAC to MP3 Converter
[2010/07/10 16:13:16 | 000,000,000 | —D | C] – C:\Program Files\FLAC to MP3 Converter
[2010/06/06 22:13:45 | 000,065,536 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll
[2004/08/25 12:22:08 | 000,151,552 | —- | C] ( ) – C:\WINDOWS\System32\ATIDEMGR.dll
[9 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[24 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/30 09:31:58 | 000,284,915 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\Desktop\gmer.zip
[2010/07/30 09:31:20 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Tiffany.CIARAN\Desktop\OTL.exe
[2010/07/30 09:15:08 | 062,757,562 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/07/30 07:04:36 | 000,000,000 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\Local Settings\Application Data\prvlcl.dat
[2010/07/30 01:27:21 | 000,000,520 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\Shortcut to HiJackThis.lnk
[2010/07/29 19:45:08 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Tiffany.CIARAN\Desktop\HiJackThis.exe
[2010/07/29 19:29:03 | 000,000,639 | —- | M] () – C:\WINDOWS\dellstat.ini
[2010/07/27 17:27:55 | 000,015,364 | -H– | M] () – C:\Documents and Settings\All Users.WINDOWS\Documents\.DS_Store
[2010/07/27 10:00:12 | 001,475,584 | R— | M] () – C:\Documents and Settings\All Users.WINDOWS\Documents\ESBK.mbb
[2010/07/27 10:00:11 | 000,808,960 | R— | M] () – C:\Documents and Settings\All Users.WINDOWS\Documents\ESBK.mb
[2010/07/27 09:55:04 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/27 09:54:50 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/27 09:53:25 | 012,320,768 | -H– | M] () – C:\Documents and Settings\Tiffany.CIARAN\NTUSER.DAT
[2010/07/27 09:53:24 | 000,031,560 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000004-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/07/27 09:53:24 | 000,031,560 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000004-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/07/27 09:53:24 | 000,031,440 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000004-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/07/27 09:53:24 | 000,031,440 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000004-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/07/27 09:53:24 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settingsbkup.sfm
[2010/07/27 09:53:24 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settings.sfm
[2010/07/27 09:53:24 | 000,000,288 | —- | M] () – C:\WINDOWS\System32\DVCStateBkp-{00000004-00000000-00000002-00001102-00000004-10031102}.dat
[2010/07/27 09:53:24 | 000,000,288 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000004-00000000-00000002-00001102-00000004-10031102}.dat
[2010/07/27 09:52:53 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Tiffany.CIARAN\ntuser.ini
[2010/07/27 09:52:12 | 004,481,358 | —- | M] () – C:\WINDOWS\{00000004-00000000-00000002-00001102-00000004-10031102}.CDF
[2010/07/27 09:52:00 | 000,697,328 | —- | M] () – C:\WINDOWS\System32\drivers\sptd.sys
[2010/07/27 09:45:33 | 009,591,104 | —- | M] (DT Soft Ltd.) – C:\Documents and Settings\Tiffany.CIARAN\My Documents\DTLite4356-0091.exe
[2010/07/26 12:19:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/07/25 03:00:03 | 000,000,440 | —- | M] () – C:\WINDOWS\tasks\FrontLine Registry Cleaner Scheduled Scan - Tiffany.job
[2010/07/24 02:48:21 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/24 01:03:00 | 000,000,246 | —- | M] () – C:\WINDOWS\system.ini
[2010/07/24 01:02:42 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/07/24 00:46:13 | 000,000,279 | RHS- | M] () – C:\boot.ini
[2010/07/20 00:44:56 | 000,000,034 | —- | M] () – C:\WINDOWS\cdplayer.ini
[2010/07/17 20:35:21 | 016,689,632 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\Desktop\shoebox_project_pdf.zip
[2010/07/16 21:29:09 | 000,243,024 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/07/16 21:29:07 | 000,012,536 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2010/07/16 21:29:00 | 000,216,400 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/07/15 04:33:26 | 000,162,816 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/10 16:15:54 | 000,088,576 | RHS- | M] () – C:\WINDOWS\System32\vjoyg.dll
[2010/07/08 00:34:12 | 063,470,650 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\Desktop\BBC_Radio_with_Jared_Leto_7-7-2010.mp3
[2010/07/05 17:10:28 | 000,020,269 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\UntitledScreenplay.sws
[2010/07/05 17:10:28 | 000,016,485 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\UntitledScreenplay.sws1
[9 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[24 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/30 09:31:59 | 000,284,915 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\Desktop\gmer.zip
[2010/07/30 01:27:21 | 000,000,520 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\Shortcut to HiJackThis.lnk
[2010/07/27 17:23:54 | 000,015,364 | -H– | C] () – C:\Documents and Settings\All Users.WINDOWS\Documents\.DS_Store
[2010/07/24 01:13:00 | 000,000,440 | —- | C] () – C:\WINDOWS\tasks\FrontLine Registry Cleaner Scheduled Scan - Tiffany.job
[2010/07/24 00:39:46 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/07/24 00:39:46 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/07/24 00:39:46 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/07/24 00:39:46 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/07/24 00:39:46 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/07/17 20:35:11 | 016,689,632 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\Desktop\shoebox_project_pdf.zip
[2010/07/10 16:15:54 | 000,088,576 | RHS- | C] () – C:\WINDOWS\System32\vjoyg.dll
[2010/07/08 00:24:04 | 063,470,650 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\Desktop\BBC_Radio_with_Jared_Leto_7-7-2010.mp3
[2010/06/06 22:13:56 | 000,000,180 | —- | C] () – C:\WINDOWS\System32\kill.ini
[2010/06/06 22:13:55 | 000,005,515 | —- | C] () – C:\WINDOWS\System32\ENSDEF.INI
[2010/03/13 00:48:23 | 000,000,031 | —- | C] () – C:\WINDOWS\ultimatecd.ini
[2009/08/13 00:22:18 | 000,000,033 | —- | C] () – C:\WINDOWS\LVMMail.INI
[2008/09/07 00:52:08 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\impborl.dll
[2008/04/21 18:32:50 | 000,000,250 | —- | C] () – C:\WINDOWS\gmer.ini
[2008/04/21 18:32:49 | 000,819,200 | —- | C] () – C:\WINDOWS\gmer.dll
[2008/03/24 02:59:33 | 000,000,398 | —- | C] () – C:\WINDOWS\AudioConverter.INI
[2007/12/15 21:05:31 | 000,000,112 | —- | C] () – C:\WINDOWS\ActiveSkin.INI
[2007/08/24 13:44:07 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/08/13 11:57:20 | 000,000,067 | —- | C] () – C:\WINDOWS\#1 DVD Audio Ripper.INI
[2007/06/23 06:18:27 | 000,000,118 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2007/05/13 19:17:04 | 000,697,328 | —- | C] () – C:\WINDOWS\System32\drivers\sptd.sys
[2007/05/07 13:59:50 | 000,000,034 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2007/04/22 19:59:32 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/04/12 09:10:28 | 000,105,728 | —- | C] () – C:\WINDOWS\System32\APOMgrH.dll
[2007/04/09 12:55:14 | 000,097,785 | —- | C] () – C:\WINDOWS\System32\instwdm.ini
[2007/04/09 12:55:14 | 000,000,030 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2007/04/09 12:33:50 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CTBurst.dll
[2007/03/21 14:19:18 | 000,000,241 | —- | C] () – C:\WINDOWS\QSync.INI
[2007/03/21 14:18:57 | 000,005,187 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2007/03/08 19:16:39 | 000,143,360 | R— | C] () – C:\WINDOWS\System32\dlbucoin.dll
[2007/03/08 19:16:39 | 000,131,072 | R— | C] () – C:\WINDOWS\System32\dlbusnls.dll
[2007/03/08 19:12:43 | 000,000,639 | —- | C] () – C:\WINDOWS\dellstat.ini
[2007/03/08 18:34:08 | 000,000,231 | —- | C] () – C:\WINDOWS\AC3API.INI
[2007/03/08 18:33:42 | 000,066,807 | —- | C] () – C:\WINDOWS\System32\Aud2_Del.ini
[2007/03/08 18:31:56 | 000,000,136 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2007/03/06 19:49:52 | 000,021,791 | —- | C] () – C:\WINDOWS\System32\smtpctrs.ini
[2007/03/06 19:49:51 | 000,001,037 | —- | C] () – C:\WINDOWS\System32\ntfsdrct.ini
[2007/03/06 19:49:39 | 000,038,576 | —- | C] () – C:\WINDOWS\System32\w3ctrs.ini
[2007/03/06 19:49:39 | 000,010,225 | —- | C] () – C:\WINDOWS\System32\axperf.ini
[2007/03/06 19:49:38 | 000,011,435 | —- | C] () – C:\WINDOWS\System32\infoctrs.ini
[2007/03/06 19:49:34 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2007/03/06 19:23:18 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2007/03/05 22:06:58 | 000,000,799 | —- | C] () – C:\WINDOWS\orun32.ini
[2007/01/22 07:19:00 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\dlbucfg.dll
[2005/08/05 15:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/06/16 10:17:16 | 000,071,680 | —- | C] () – C:\WINDOWS\System32\ctmmactl.dll
[2005/05/25 13:07:26 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\dlbucnv4.dll
[2004/08/06 14:23:06 | 000,114,688 | —- | C] () – C:\WINDOWS\System32\dlbucur.dll
[2004/08/06 14:22:12 | 000,557,056 | —- | C] () – C:\WINDOWS\System32\dlbujswr.dll
[2004/08/06 14:07:24 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\dlbucu.dll
[2004/08/06 14:01:42 | 000,401,408 | —- | C] () – C:\WINDOWS\System32\dlbuutil.dll
[2004/03/26 18:59:00 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/10/08 10:09:46 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\dlbuvs.dll
[2000/09/08 18:53:50 | 000,073,839 | —- | C] () – C:\WINDOWS\System32\KodakOneTouch.dll
[1997/11/10 15:18:48 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2008/04/16 22:48:51 | 000,000,310 | -H– | M] () – C:\aaw7boot.cmd
[2007/03/03 11:15:14 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/03/15 18:27:24 | 000,000,279 | —- | M] () – C:\Boot.bak
[2010/07/24 00:46:13 | 000,000,279 | RHS- | M] () – C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | —- | M] () – C:\cmldr
[2010/07/24 01:11:25 | 000,025,944 | —- | M] () – C:\ComboFix.txt
[2007/03/03 11:15:14 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2007/03/07 21:07:50 | 000,000,760 | —- | M] () – C:\dlbt.log
[2007/03/08 19:12:34 | 000,000,100 | —- | M] () – C:\dlbu.log
[2007/08/13 11:53:34 | 3110,487,100 | —- | M] () – C:\flaskOut.avi
[2007/12/15 21:05:34 | 000,001,283 | —- | M] () – C:\INSTALL.LOG
[2007/03/03 11:15:14 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2008/01/08 18:17:15 | 000,002,002 | -H– | M] () – C:\IPH.PH
[2007/03/21 14:17:16 | 000,000,090 | —- | M] () – C:\LogiSetup.log
[2010/05/03 16:47:16 | 000,000,109 | —- | M] () – C:\mbam-error.txt
[2007/03/03 11:15:14 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2009/08/13 12:37:42 | 000,000,217 | —- | M] () – C:\NTDClient.log
[2004/08/10 08:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2004/08/10 08:00:00 | 000,250,032 | RHS- | M] () – C:\ntldr
[2010/07/27 09:54:40 | 1610,612,736 | -HS- | M] () – C:\pagefile.sys
[2009/02/06 23:11:20 | 000,000,268 | -H– | M] () – C:\sqmdata00.sqm
[2009/02/12 09:30:38 | 000,000,268 | -H– | M] () – C:\sqmdata01.sqm
[2009/02/12 09:35:31 | 000,000,268 | -H– | M] () – C:\sqmdata02.sqm
[2009/02/13 18:03:10 | 000,000,268 | -H– | M] () – C:\sqmdata03.sqm
[2009/02/13 19:19:54 | 000,000,268 | -H– | M] () – C:\sqmdata04.sqm
[2009/02/20 14:36:22 | 000,000,268 | -H– | M] () – C:\sqmdata05.sqm
[2009/02/20 19:35:19 | 000,000,268 | -H– | M] () – C:\sqmdata06.sqm
[2009/03/05 15:52:31 | 000,000,268 | -H– | M] () – C:\sqmdata07.sqm
[2009/03/05 15:54:29 | 000,000,268 | -H– | M] () – C:\sqmdata08.sqm
[2009/03/10 20:11:04 | 000,000,268 | -H– | M] () – C:\sqmdata09.sqm
[2009/03/10 20:13:35 | 000,000,268 | -H– | M] () – C:\sqmdata10.sqm
[2009/03/10 22:25:44 | 000,000,268 | -H– | M] () – C:\sqmdata11.sqm
[2009/03/10 22:31:45 | 000,000,268 | -H– | M] () – C:\sqmdata12.sqm
[2009/03/11 23:01:33 | 000,000,268 | -H– | M] () – C:\sqmdata13.sqm
[2009/03/11 23:02:41 | 000,000,268 | -H– | M] () – C:\sqmdata14.sqm
[2009/03/14 07:57:00 | 000,000,268 | -H– | M] () – C:\sqmdata15.sqm
[2009/03/14 07:58:13 | 000,000,268 | -H– | M] () – C:\sqmdata16.sqm
[2009/03/17 13:25:56 | 000,000,232 | -H– | M] () – C:\sqmdata17.sqm
[2009/03/17 13:26:06 | 000,000,232 | -H– | M] () – C:\sqmdata18.sqm
[2009/03/17 22:15:41 | 000,000,268 | -H– | M] () – C:\sqmdata19.sqm
[2009/02/06 23:11:19 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2009/02/12 09:30:37 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2009/02/12 09:35:31 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2009/02/13 18:03:08 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2009/02/13 19:19:54 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2009/02/20 14:36:21 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2009/02/20 19:35:19 | 000,000,244 | -H– | M] () – C:\sqmnoopt06.sqm
[2009/03/05 15:52:30 | 000,000,244 | -H– | M] () – C:\sqmnoopt07.sqm
[2009/03/05 15:54:29 | 000,000,244 | -H– | M] () – C:\sqmnoopt08.sqm
[2009/03/10 20:11:02 | 000,000,244 | -H– | M] () – C:\sqmnoopt09.sqm
[2009/03/10 20:13:35 | 000,000,244 | -H– | M] () – C:\sqmnoopt10.sqm
[2009/03/10 22:25:43 | 000,000,244 | -H– | M] () – C:\sqmnoopt11.sqm
[2009/03/10 22:31:45 | 000,000,244 | -H– | M] () – C:\sqmnoopt12.sqm
[2009/03/11 23:01:32 | 000,000,244 | -H– | M] () – C:\sqmnoopt13.sqm
[2009/03/11 23:02:41 | 000,000,244 | -H– | M] () – C:\sqmnoopt14.sqm
[2009/03/14 07:57:00 | 000,000,244 | -H– | M] () – C:\sqmnoopt15.sqm
[2009/03/14 07:58:13 | 000,000,244 | -H– | M] () – C:\sqmnoopt16.sqm
[2009/03/17 13:25:56 | 000,000,244 | -H– | M] () – C:\sqmnoopt17.sqm
[2009/03/17 13:26:06 | 000,000,244 | -H– | M] () – C:\sqmnoopt18.sqm
[2009/03/17 22:15:41 | 000,000,244 | -H– | M] () – C:\sqmnoopt19.sqm
[2005/10/31 11:56:00 | 000,700,416 | —- | M] (LimeWire) – C:\StubInstaller.exe
[2010/07/25 22:42:59 | 000,046,236 | —- | M] () – C:\TDSSKiller.2.4.0.0_25.07.2010_22.42.24_log.txt
[2001/01/10 13:23:58 | 000,162,304 | —- | M] () – C:\UNWISE.EXE
[2007/03/07 13:39:02 | 000,000,179 | —- | M] () – C:\Yahoo! Photos.url
[2007/12/26 03:27:28 | 000,448,390 | —- | M] () – C:\YServer.txt

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2007/03/05 21:53:50 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2004/07/26 17:11:56 | 000,075,264 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\DLBUPP5C.DLL
[2008/07/06 08:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 06:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/02/28 09:04:12 | 002,293,848 | —- | M] () – C:\Program Files\FLV PlayerFCSetup.exe
[2007/03/08 15:29:03 | 000,237,568 | —- | M] (Morpheus) – C:\Program Files\Uninstall Morpheus Toolbar.dll

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2010/02/11 00:46:14 | 000,442,368 | —- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 – C:\WINDOWS\system32\ATIDEMGX.dll
[2005/07/26 00:39:44 | 001,267,200 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\comsvcs.dll
[2010/07/10 16:15:54 | 000,088,576 | RHS- | M] () Unable to obtain MD5 – C:\WINDOWS\system32\vjoyg.dll
[24 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2007/03/05 16:37:16 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2007/03/05 16:37:16 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2007/03/05 16:37:16 | 000,921,600 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-13 22:49:42

========== Alternate Data Streams ==========

@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C31F31E6
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:8B2A3070
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6EB57FE6
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D5813BA5
< End of report >

Extras.txt:

OTL Extras logfile created on: 7/30/2010 9:34:10 AM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Tiffany.CIARAN\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 441.00 Mb Available Physical Memory | 43.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 228.11 Gb Total Space | 95.79 Gb Free Space | 41.99% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CIARAN
Current User Name: Tiffany
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\usmt\migwiz.exe" = C:\WINDOWS\system32\usmt\migwiz.exe:*:Enabled:Files and Settings Transfer Wizard – (Microsoft Corporation)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server – (Yahoo! Inc.)
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger – (America Online, Inc.)
"C:\StubInstaller.exe" = C:\StubInstaller.exe:*:Enabled:LimeWire swarmed installer – (LimeWire)
"C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe" = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater – ()
"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe" = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare – ()
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test – (Microsoft Corporation)
"C:\WINDOWS\system32\fxsclnt.exe" = C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console – (Microsoft Corporation)
"C:\WINDOWS\system32\dplaysvr.exe" = C:\WINDOWS\system32\dplaysvr.exe:*:Disabled:Microsoft DirectPlay Helper – (Microsoft Corporation)
"C:\Program Files\Infogrames Interactive\Scrabble Complete\ScrabbleComplete.exe" = C:\Program Files\Infogrames Interactive\Scrabble Complete\ScrabbleComplete.exe:*:Enabled:Scrabble Complete – (Infogrames Interactive)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\AVG\AVG9\avgemc.exe" = C:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe – (AVG Technologies CZ, s.r.o.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}" = Notifier
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{03ADC8AB-C130-0C3D-1FF9-2C385DF25689}" = CCC Help Czech
"{03EDED24-8375-407D-A721-4643D9768BE1}" = kgchlwn
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{059689BF-89A3-4FE5-B459-6EAB2903124F}" = Hoyle Puzzle Games 2007
"{07021185-008D-ABF9-7716-475AC035F8B3}" = CCC Help Spanish
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{073F22CE-9A5B-4A40-A604-C7270AC6BF34}" = ESSSONIC
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0F8D0406-7755-AC37-6529-73AD649DBE32}" = Catalyst Control Center Graphics Previews Common
"{11F3F858-4131-4FFA-A560-3FE282933B6E}" = kgchday
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{154508C0-07C5-4659-A7A0-E49968750D21}" = HLPPDOCK
"{1A2A15C2-6780-49c1-B296-503230E9DE00}" = The Sims™ 2 Mansion and Garden Stuff
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{20FA8AEE-E785-4F79-98EB-2067A8F395F4}" = Monopoly
"{22072CC8-7230-96F8-52F4-05EAF3F906B6}" = CCC Help Polish
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2368ADBD-6FDF-4B9F-FE41-E20B4D78E79E}" = CCC Help Chinese Standard
"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"{25EF0DC4-B072-2E04-4581-A13C91423CE6}" = CCC Help Portuguese
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Dell Media Experience
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 20
"{26F7855C-443B-00A6-F7B8-A97A5403F617}" = CCC Help Danish
"{2CB4A925-48A7-DA65-DCEE-D4DE224B7D84}" = CCC Help English
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{306D75B9-7FFF-FF65-0C76-57F2FE4FE1D6}" = Catalyst Control Center Core Implementation
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java™ 6 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{32B12FE4-5A51-751A-1FB6-A14E97EBDD5C}" = CCC Help German
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{351512E5-01BD-E878-6F57-AA3E517D9ECE}" = Skins
"{354A387E-0374-21A3-6832-335674A6D7D1}" = CCC Help French
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C00BEE9-26D0-D9E0-A2D1-62F70D412A12}" = CCC Help Turkish
"{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353}" = OTtBPSDK
"{3F99D180-34C3-4151-8C6C-86FC5D7BDFBD}" = Hoyle Casino
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{40AB54C3-DD4B-467A-847E-162035CD252C}" = Logitech ImageStudio
"{4346F7AA-3D56-0941-424C-4454E04D37F6}" = CCC Help Italian
"{4781569D-5404-1F26-4B2B-6DF444441031}" = Nero 7 Premium
"{4817189D-1785-4627-A33C-39FD90919300}" = The Sims 2 Pets
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CAE2F2C-75CD-A0DE-7520-449BCBBCC833}" = CCC Help Korean
"{52D56C42-8C69-4882-A661-39695537C9CF}" = DellConnect
"{56F3E1FF-54FE-4384-A153-6CCABA097814}" = Creative MediaSource
"{57F7F0A5-8F22-8E63-E819-803B5C9CA3A5}" = CCC Help Dutch
"{5C648FDB-0138-4619-B66E-230EF53E8E2C}" = The Sims™ 2 Teen Style Stuff
"{5EA437D2-7A57-B60E-E8F2-76BFAC0895A5}" = CCC Help Chinese Traditional
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{61AF4E75-050E-0304-3417-8BC16417FEB1}" = CCC Help Greek
"{632005DA-C291-5275-284C-5EE96B05C714}" = Catalyst Control Center HydraVision Full
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{6522C636-B04C-4333-9BEB-9E0C0B6350D6}" = The Sims™ 2 Kitchen & Bath Interior Design Stuff
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.3
"{693C08A7-9E76-43FF-B11E-9A58175474C4}" = kgckids
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6C72BE0C-3E25-CACD-0070-2FD9C02ABA14}" = ccc-core-preinstall
"{6E17F9751-F056-4335-B718-8AF1B1092AFB}" = The Sims™ 2 IKEA® Home Stuff
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = The Sims 2
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = The Sims 2 Open For Business
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8424EF22-44CF-4DD4-B702-FADA3998F4BA}" = StuffIt 11
"{84DDE556-43EF-43ed-B2DF-37AF9E5DDD75}" = The Sims™ 2 H&M;® Fashion Stuff
"{87843A41-7808-4F2E-B13F-25C1E67CF2FD}" = ESShelp
"{87F6C83D-F949-4d14-B5CB-DC8C75F8932D}" = The Sims™ 2 FreeTime
"{880BB617-914E-17E8-D877-A96BAC5794D2}" = Catalyst Control Center Graphics Full New
"{8897CF22-DB6C-8248-895C-12BFA2677F51}" = CCC Help Hungarian
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8A8664E1-84C8-4936-891C-BC1F07797549}" = kgcvday
"{8C5766F2-81D9-4B5A-8AD5-A8BD6361EF0A}" = Hoyle Card Games
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
"{8FD3F4BA-A4A6-4380-00A6-CC6853AB2DC2}" = The Sims 2 University
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BD54685-1496-46A5-AB62-357CD140ED8B}" = kgcinvt
"{9CDBC303-3EED-40b0-8E41-A7C65AA96C26}" = The Sims 2 Glamour Life Stuff
"{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}" = ESScore
"{9E1BAB75-EB78-440D-94C0-A3857BE2E733}" = System Requirements Lab
"{A1588373-1D86-4D44-86C9-78ABD190F9CC}" = kgcmove
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A260B422-70E1-41E2-957D-F76FA21266D5}" = Apple Software Update
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A54C01BD-1277-4722-B42B-EC9800A90B1E}_is1" = Free FLAC to MP3 Converter 1.0
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.3
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{AF710FDE-2815-8C8D-5281-8004C2654AA6}" = CCC Help Russian
"{AFF2D965-C6F2-A210-FBF7-532612AA1D23}" = CCC Help Swedish
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B21336EE-4AEF-9940-4AC7-EDB89854B8D3}" = CCC Help Thai
"{B36649A3-D0DD-4706-B042-F5B384529C7A}" = Scrabble Complete
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B6F5B704-06D3-4687-90F3-6195304AD755}" = The Sims™ 2 Apartment Life
"{B74D4E10-6884-0000-0000-000000000103}" = Adobe Bridge 1.0
"{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}" = KSU
"{BB406CEB-6207-4512-9BB2-89950DC9D6B6}_is1" = ConvertXtoDVD 2.2.3.258h
"{BBA69346-61A1-BD34-E75A-4D81232DB1FE}" = Catalyst Control Center Localization All
"{BCE72AED-3332-4863-9567-C5DCB9052CA2}" = Netflix Movie Viewer
"{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom Gigabit Integrated Controller
"{BFD5ED08-F066-92D5-BE67-3B9AE5DCFF0C}" = CCC Help Japanese
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4609F15-FB3C-D97E-BAA1-4F10815039C2}" = Catalyst Control Center Graphics Full Existing
"{C6A7AF96-4EB1-4AAE-8318-1AB393C64F88}" = Microsoft Plus! Digital Media Edition
"{C8F7C1E5-0150-11D6-A96C-00D05908F85D}" = USB Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0}" = Jasc Paint Shop Photo Album
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D01FAC3D-86B4-3A19-9D10-9156A0EB3EBE}" = CCC Help Finnish
"{D1696920-9794-4BBC-8A30-7A88763DE5A2}" = ABBYY FineReader 5.0 Sprint Plus
"{D1973749-F5E7-40EB-B528-F2B78685B9FF}" = essvcpt
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{D5A9DA4B-E4F9-FB49-017D-769FC540F1F0}" = EA Download Manager UI
"{D73722C8-3F65-C75B-A631-5D36894DAB92}" = ccc-core-static
"{D78653C3-A8FF-415F-92E6-D774E634FF2D}" = Dell ResourceCD
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{DDAD33B6-8C00-428D-087B-A7088355B9BE}" = Catalyst Control Center Graphics Light
"{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}" = The Sims™ 2 Seasons
"{E18B549C-5D15-45DA-8D8F-8FD2BD946344}" = kgcbaby
"{E333F074-FC7F-596D-3D61-44F0EC28E8C0}" = ccc-utility
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E82BF103-904F-49C0-B77F-6EC110B71E87}" = Sound Blaster Audigy 2
"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0
"{EA2BD6CF-2EB7-4BE4-9CAC-471F351BF24D}" = Hoyle Board Games 2007
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}" = kgcbase
"{F248ADFA-64E0-4b03-8A83-059078BED6A0}" = The Sims™ 2 Bon Voyage
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F71760CD-0F8B-4DCC-B7B7-6B223CC3843C}" = OTtBP
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = The Sims 2 Nightlife
"{F843C6A3-224D-4615-94F8-3C461BD9AEA0}" = Jasc Paint Shop Pro 9
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FA38F9E4-BED7-E021-B660-8FDFF7EC6E1A}" = CCC Help Norwegian
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"{FDC8065B-80DE-4466-B90B-2581F6D77DFF}" = Image Plugin
"{FDF9943A-3D5C-46B3-9679-586BD237DDEE}" = SKIN0001
"12133444-BF36-4d4e-B7FB-A3424C645DE4" = GemMaster Mystic
"7-Zip" = 7-Zip 4.65
"AbacastNode:11" = Abacast Distributed On-Demand
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"Adobe Shockwave Player" = Adobe Shockwave Player
"All ATI Software" = ATI - Software Uninstall Utility
"AOL Instant Messenger" = AOL Instant Messenger
"ATI Display Driver" = ATI Display Driver
"AVG9Uninstall" = AVG Free 9.0
"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto
"BroadJump Client Foundation" = BroadJump Client Foundation
"CCleaner" = CCleaner
"CEP - Colour Enable Packages_is1" = CEP - Color Enable Package
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"Dell Photo AIO Printer 942" = Dell Photo AIO Printer 942
"DirectXMediaRuntime" = DirectX Media Runtime 5.1
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX Setup
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVD Ripper Platinum 4" = DVD Ripper Platinum 4
"DVD Shrink_is1" = DVD Shrink 3.2
"EA Download Manager" = EA Download Manager
"FFXIII-Screensaver" = FFXIII-Screensaver
"HijackThis" = HijackThis 2.0.2
"Homepage" = Homepage Screen Saver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ImTOO iPod Movie Converter" = ImTOO iPod Movie Converter
"InstallShield_{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom Gigabit Integrated Controller
"Intel® 537EP V9x DF PCI Modem" = Intel® 537EP V9x DF PCI Modem
"Logitech Print Service" = Logitech Print Service
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PC Tools Firewall Plus" = PC Tools Firewall Plus 5.0
"PokerStars.net" = PokerStars.net
"SimPE_is1" = SimPE 0.72 (alpha)
"Sims2Pack Clean Installer " = Sims2Pack Clean Installer
"The Game Of Life" = The Game Of Life
"TS3 Install Helper Monkey" = TS3 Install Helper Monkey
"ViewpointMediaPlayer" = Viewpoint Media Player
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Customizations" = Yahoo! Browser Services
"Yahoo! Internet Mail" = Yahoo! Internet Mail
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Photos Drag-Drop Uploader 1v7" = Yahoo! Photos Easy Upload Tool 1v7
"Yahoo! Toolbar" = Yahoo! Toolbar
"YInstHelper" = Yahoo! Install Manager

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/30/2010 5:43:14 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 5:43:14 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 6:40:16 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 6:40:16 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 7:13:15 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 7:13:15 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 8:29:16 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 8:29:16 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 8:59:15 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 8:59:15 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

[ Application Events ]
Error - 7/30/2010 5:43:14 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 5:43:14 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 6:40:16 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 6:40:16 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 7:13:15 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 7:13:15 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 8:29:16 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 8:29:16 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 8:59:15 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 7/30/2010 8:59:15 AM | Computer Name = CIARAN | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

[ System Events ]
Error - 7/25/2010 10:48:33 PM | Computer Name = CIARAN | Source = Service Control Manager | ID = 7000
Description = The Bonjour Service service failed to start due to the following error:
%%3

Error - 7/25/2010 10:48:33 PM | Computer Name = CIARAN | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126

Error - 7/25/2010 10:48:33 PM | Computer Name = CIARAN | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
SASKUTIL

Error - 7/26/2010 2:46:06 PM | Computer Name = CIARAN | Source = ipnathlp | ID = 32003
Description = The Network Address Translator (NAT) was unable to request an operation
of
the kernel-mode translation module. This may indicate misconfiguration, insufficient
resources, or an internal error. The data is the error code.

Error - 7/27/2010 9:41:00 AM | Computer Name = CIARAN | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126

Error - 7/27/2010 9:57:33 AM | Computer Name = CIARAN | Source = Service Control Manager | ID = 7000
Description = The Bonjour Service service failed to start due to the following error:
%%3

Error - 7/27/2010 9:57:33 AM | Computer Name = CIARAN | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126

Error - 7/27/2010 9:57:45 AM | Computer Name = CIARAN | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
SASKUTIL

Error - 7/27/2010 5:14:04 PM | Computer Name = CIARAN | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126

Error - 7/29/2010 11:50:24 AM | Computer Name = CIARAN | Source = DCOM | ID = 10010
Description = The server {2692A9D5-61DF-46D5-A5A1-A6CCA921D578} did not register
with DCOM within the required timeout.

< End of report >

Will post gmer.txt in next post.

Vilya

Post #4July 30, 2010, 7:07 PM UTC

Sorry this took so long, I thought the gmer scan would finish before I had to leave the house, but it didn't. Anyway, here is the gmer log:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-07-30 15:06:37
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\TIFFAN~1.CIA\LOCALS~1\Temp\uxtdqpob.sys

—- System - GMER 1.0.15 —-

SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwAllocateVirtualMemory [0xAD360B94]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwAssignProcessToJobObject [0xAD360586]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwConnectPort [0xAD3605DA]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwCreateFile [0xAD360640]
SSDT spro.sys ZwCreateKey [0xF760B0E0]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwCreateProcess [0xAD36072E]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwCreateProcessEx [0xAD3607BA]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwCreateThread [0xAD36084A]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwDebugActiveProcess [0xAD360980]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwDuplicateObject [0xAD3609D4]
SSDT spro.sys ZwEnumerateKey [0xF7625E4C]
SSDT spro.sys ZwEnumerateValueKey [0xF76261DA]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwLoadDriver [0xAD360A3A]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwOpenKey [0xAD360A8C]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwOpenSection [0xAD360AE4]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwOpenThread [0xAD360B3C]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwProtectVirtualMemory [0xAD360BFA]
SSDT spro.sys ZwQueryKey [0xF76262B2]
SSDT spro.sys ZwQueryValueKey [0xF7626132]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwRestoreKey [0xAD360C58]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwResumeThread [0xAD360CB6]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwSecureConnectPort [0xAD360D74]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwSetValueKey [0xAD360D08]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwSuspendProcess [0xAD360DDE]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwSystemDebugControl [0xAD360E30]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwTerminateProcess [0xAD360E90]
SSDT \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools App Monitor Driver/PC Tools) ZwWriteVirtualMemory [0xAD360EF4]

INT 0x62 ? 873D7C88
INT 0x74 ? 86D53C88
INT 0x84 ? 86D53C88
INT 0x94 ? 86D53C88
INT 0xA4 ? 86D53C88
INT 0xB4 ? 87369C88

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 873681F8
Device \FileSystem\Fastfat \FatCdrom 8551C470
Device \Driver\usbstor \Device\0000009b 86C01470

AttachedDevice \Driver\Tcpip \Device\Ip pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)

Device \Driver\usbuhci \Device\USBPDO-0 86D521F8
Device \Driver\usbuhci \Device\USBPDO-1 86D521F8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8736A1F8
Device \Driver\dmio \Device\DmControl\DmConfig 8736A1F8
Device \Driver\dmio \Device\DmControl\DmPnP 8736A1F8
Device \Driver\dmio \Device\DmControl\DmInfo 8736A1F8
Device \Driver\usbuhci \Device\USBPDO-2 86D521F8
Device \Driver\usbuhci \Device\USBPDO-3 86D521F8
Device \Driver\usbehci \Device\USBPDO-4 86D451F8

AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Ftdisk \Device\HarddiskVolume1 873D81F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 873D81F8
Device \Driver\Cdrom \Device\CdRom0 86C3A1F8
Device \Driver\Cdrom \Device\CdRom1 86C3A1F8
Device \Driver\iastor \Device\Ide\iaStor0 [F7518440] iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort0 873D71F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 873D71F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c 873D71F8
Device \Driver\iastor \Device\Ide\IAAStorageDevice-0 [F7518440] iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\Ftdisk \Device\HarddiskVolume3 873D81F8
Device \Driver\Cdrom \Device\CdRom2 86C3A1F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 86BFE470
Device \Driver\NetBT \Device\NetbiosSmb 86BFE470
Device \Driver\PCI_PNP3964 \Device\0000005b spro.sys

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\usbuhci \Device\USBFDO-0 86D521F8
Device \Driver\usbuhci \Device\USBFDO-1 86D521F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 86BEF1F8
Device \Driver\usbuhci \Device\USBFDO-2 86D521F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 86BEF1F8
Device \Driver\usbuhci \Device\USBFDO-3 86D521F8
Device \Driver\usbehci \Device\USBFDO-4 86D451F8
Device \Driver\Ftdisk \Device\FtControl 873D81F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{4AE8F2EB-6AE5-4A0C-B7F8-314DA2AA46C5} 86BFE470
Device \Driver\usbstor \Device\0000008c 86C01470
Device \Driver\abq6yool \Device\Scsi\abq6yool1Port2Path0Target0Lun0 86BC11F8
Device \Driver\abq6yool \Device\Scsi\abq6yool1 86BC11F8
Device \Driver\sptd \Device\830428964 spro.sys
Device \FileSystem\Fastfat \Fat 8551C470

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs 86209470

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x17 0x39 0xA2 0x9D …
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xE7 0x57 0x78 0xCC …
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x87 0xD7 0x73 0xDF …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x2B 0x43 0xA7 0x66 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x7D 0x35 0xC5 0x08 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xE7 0x5B 0x60 0xB5 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x17 0x39 0xA2 0x9D …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xE7 0x57 0x78 0xCC …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC6 0x21 0xD0 0x64 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x2B 0x43 0xA7 0x66 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x7D 0x35 0xC5 0x08 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x56 0xFF 0x31 0x29 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x17 0x39 0xA2 0x9D …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xE7 0x57 0x78 0xCC …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC6 0x21 0xD0 0x64 …

—- EOF - GMER 1.0.15 —-

hammerman

Post #5July 30, 2010, 8:43 PM UTC

Hi,

Please follow these steps.

– Step 1 –

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: OCRFOC = rundll32 "C:\WINDOWS\system32\vjoyg.dll",ONTWOM ()

:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
This fix will produce a report. Please add this to your reply.

– Step 2 –

Download the latest version of Java Runtime Environment (JRE) 6 Update 21.
Click the "Download JRE" button to the right.
Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
Click on Continue.
Click on the link to download Windows Offline Installation (jre-6u21-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u21-windows-i586.exe and select "Run as an Administrator.")

– Step 3 –

I notice you have run Combofix and TDSSKiller. Please post the last logs from these (C:\ComboFix.txt & C:\TDSSKiller.2.4.0.0_25.07.2010_22.42.24_log.txt)

Vilya

Post #6July 30, 2010, 9:36 PM UTC

OTL Log:

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\\OCRFOC deleted successfully.
C:\WINDOWS\System32\vjoyg.DLL moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: All Users.WINDOWS

User: bob
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 348 bytes

User: Bob.CIARAN
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 13305548 bytes
->Flash cache emptied: 46901 bytes

User: CIARAN

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User.WINDOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41620 bytes

User: Gail
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 53 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: NetworkService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Tiffany
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 4582 bytes

User: Tiffany.CIARAN
->Temp folder emptied: 1673049 bytes
->Temporary Internet Files folder emptied: 31120926 bytes
->Java cache emptied: 519658 bytes
->FireFox cache emptied: 66155140 bytes
->Flash cache emptied: 1985568 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1205958 bytes
%systemroot%\System32 .tmp files removed: 11476270 bytes
%systemroot%\System32\dllcache .tmp files removed: 3273728 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16639 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 26207476 bytes

Total Files Cleaned = 150.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: All Users.WINDOWS

User: bob
->Flash cache emptied: 0 bytes

User: Bob.CIARAN
->Flash cache emptied: 0 bytes

User: CIARAN

User: Default User

User: Default User.WINDOWS
->Flash cache emptied: 0 bytes

User: Gail

User: LocalService

User: LocalService.NT AUTHORITY
->Flash cache emptied: 0 bytes

User: NetworkService

User: NetworkService.NT AUTHORITY

User: Tiffany
->Flash cache emptied: 0 bytes

User: Tiffany.CIARAN
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.9.1 log created on 07302010_172131

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…

Combo Fix log:

ComboFix 10-07-23.02 - Tiffany 07/24/2010 0:50.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.350 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Tiffany.CIARAN\Desktop\cfscript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: PC Tools Firewall Plus *enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}

FILE ::
"c:\program files\AdvancedVirusRemover\PAVRM.exe"
"c:\windows\system32\AVR09.exe"
"c:\windows\system32\winhelper.dll"
"c:\windows\system32\winupdate.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Tiffany.CIARAN\Application Data\inst.exe
c:\documents and settings\Tiffany.CIARAN\GoToAssistDownloadHelper.exe

.
((((((((((((((((((((((((( Files Created from 2010-06-24 to 2010-07-24 )))))))))))))))))))))))))))))))
.

2010-07-17 01:29 . 2010-07-17 01:29 12536 -c–a-w- c:\windows\system32\avgrsstx.dll
2010-07-10 20:21 . 2010-07-10 20:21 ——– dc—-w- c:\program files\Free FLAC to MP3 Converter
2010-07-10 20:15 . 2010-07-10 20:15 88576 -csha-r- c:\windows\system32\vjoyg.dll
2010-07-10 20:13 . 2010-07-10 20:16 ——– dc—-w- c:\program files\FLAC to MP3 Converter

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-24 05:04 . 2009-06-17 01:54 0 -c–a-w- c:\documents and settings\Tiffany.CIARAN\Local Settings\Application Data\prvlcl.dat
2010-07-24 04:36 . 2007-06-20 01:38 ——– dc–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2010-07-24 04:32 . 2010-06-08 21:29 288 -c–a-w- c:\windows\system32\DVCStateBkp-{00000004-00000000-00000002-00001102-00000004-10031102}.dat
2010-07-24 04:32 . 2010-06-08 21:29 288 -c–a-w- c:\windows\system32\DVCState-{00000004-00000000-00000002-00001102-00000004-10031102}.dat
2010-07-17 01:29 . 2010-06-08 21:41 243024 -c–a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-17 01:29 . 2010-06-08 21:41 216400 -c–a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-12 01:58 . 2010-04-27 00:10 57344 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-07-12 01:58 . 2010-04-27 00:05 ——– dc—-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX
2010-07-12 01:58 . 2010-07-12 01:58 57715 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\Player\Uninstaller.exe
2010-07-12 01:58 . 2010-07-12 01:58 56765 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-07-12 01:58 . 2007-04-23 20:02 ——– dc—-w- c:\program files\DivX
2010-07-12 01:58 . 2010-07-12 01:58 54153 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\DFXPlugin\Uninstaller.exe
2010-07-12 01:57 . 2010-04-27 00:10 1062184 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\Setup\Resource.dll
2010-07-12 01:57 . 2010-04-27 00:10 895256 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\Setup\DivXSetup.exe
2010-07-06 03:18 . 2007-10-19 09:51 ——– dc—-w- c:\documents and settings\Tiffany.CIARAN\Application Data\Hoyle Card Games
2010-06-23 21:25 . 2010-06-23 21:25 ——– dc—-w- c:\program files\Windward Studios
2010-06-21 02:24 . 2007-10-19 09:49 ——– dc—-w- c:\documents and settings\Tiffany.CIARAN\Application Data\Hoyle Casino
2010-06-19 05:43 . 2007-10-06 23:25 ——– dc—-w- c:\program files\PokerStars.NET
2010-06-19 05:39 . 2010-03-21 15:11 153156 -c-ha-w- c:\windows\system32\mlfcache.dat
2010-06-19 05:13 . 2007-10-19 12:01 ——– dc—-w- c:\documents and settings\Tiffany.CIARAN\Application Data\Hoyle Blackjack
2010-06-16 20:54 . 2007-04-17 17:41 ——– dc—-w- c:\documents and settings\All Users.WINDOWS\Application Data\DVD Shrink
2010-06-14 14:30 . 2007-03-06 01:51 743936 -c–a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 01:13 . 2010-06-14 01:13 ——– dc—-w- c:\program files\Nero
2010-06-14 01:13 . 2007-04-17 18:18 ——– dc—-w- c:\program files\Common Files\Ahead
2010-06-14 00:40 . 2010-06-14 00:40 ——– dc—-w- c:\program files\Microsoft.NET
2010-06-08 21:43 . 2010-06-08 21:41 29584 -c–a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-06-08 21:37 . 2009-11-02 16:29 ——– dc—-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg9
2010-06-08 21:28 . 2007-07-09 21:21 ——– dc—-w- c:\documents and settings\Tiffany.CIARAN\Application Data\Media Player Classic
2010-06-07 04:13 . 2007-05-01 16:57 ——– dc—-w- c:\documents and settings\Tiffany.CIARAN\Application Data\Vso
2010-06-07 04:10 . 2007-05-01 16:57 47360 -c–a-w- c:\windows\system32\drivers\pcouffin.sys
2010-06-07 04:10 . 2007-05-01 16:57 47360 -c–a-w- c:\documents and settings\Tiffany.CIARAN\Application Data\pcouffin.sys
2010-06-07 04:10 . 2007-05-01 16:57 47360 -c–a-w- c:\documents and settings\Tiffany.CIARAN\Application Data\pcouffin.sys
2010-06-07 04:09 . 2010-06-07 04:09 ——– dc—-w- c:\program files\VSO
2010-06-07 01:27 . 2010-06-07 01:27 409600 -c–a-w- c:\windows\system32\wrap_oal.dll
2010-06-04 16:01 . 2009-09-17 18:02 ——– dc—-w- c:\program files\Common Files\DivX Shared
2010-06-04 16:01 . 2010-06-04 16:01 56997 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\WebPlayer\Uninstaller.exe
2010-06-04 16:01 . 2010-06-04 16:01 53600 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\Update\Uninstaller.exe
2010-06-04 16:00 . 2010-06-04 16:00 54128 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\Converter\Uninstaller.exe
2010-06-04 16:00 . 2010-06-04 16:00 54644 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\TranscodeEngine\Uninstaller.exe
2010-06-04 16:00 . 2010-06-04 16:00 54101 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\MPEG2Plugin\Uninstaller.exe
2010-06-04 02:14 . 2010-04-01 18:54 ——– dc—-w- c:\program files\Microsoft Silverlight
2010-06-04 02:05 . 2007-03-03 15:54 ——– dc-h–w- c:\program files\InstallShield Installation Information
2010-06-04 02:05 . 2010-05-22 23:01 ——– dc—-w- c:\program files\Electronic Arts
2010-06-01 07:36 . 2007-03-07 01:20 1324 -c–a-w- c:\windows\system32\d3d9caps.dat
2010-05-29 20:53 . 2010-05-29 20:43 ——– dc—-w- c:\documents and settings\Tiffany.CIARAN\Application Data\DAEMON Tools Lite
2010-05-29 20:44 . 2010-05-29 20:43 ——– dc—-w- c:\program files\DAEMON Tools Lite
2010-05-29 20:43 . 2007-05-13 23:17 691696 —-a-w- c:\windows\system32\drivers\sptd.sys
2010-05-29 20:43 . 2010-05-29 20:43 ——– dc—-w- c:\documents and settings\All Users.WINDOWS\Application Data\DAEMON Tools Lite
2010-05-29 20:43 . 2007-05-13 23:21 ——– dc—-w- c:\program files\DAEMON Tools
2010-05-27 22:49 . 2010-01-04 21:35 ——– dc—-w- c:\program files\CCleaner
2010-05-27 20:47 . 2007-03-30 00:37 ——– dc—-w- c:\documents and settings\Tiffany.CIARAN\Application Data\uTorrent
2010-05-27 01:36 . 2010-05-27 01:36 503808 -c–a-w- c:\documents and settings\Bob.CIARAN\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-230757cb-n\msvcp71.dll
2010-05-27 01:36 . 2010-05-27 01:36 499712 -c–a-w- c:\documents and settings\Bob.CIARAN\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-230757cb-n\jmc.dll
2010-05-27 01:36 . 2010-05-27 01:36 12800 -c–a-w- c:\documents and settings\Bob.CIARAN\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1985248f-n\decora-d3d.dll
2010-05-27 01:36 . 2010-05-27 01:36 348160 -c–a-w- c:\documents and settings\Bob.CIARAN\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-230757cb-n\msvcr71.dll
2010-05-27 01:36 . 2010-05-27 01:36 61440 -c–a-w- c:\documents and settings\Bob.CIARAN\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1985248f-n\decora-sse.dll
2010-05-22 15:35 . 2010-05-22 15:35 503808 -c–a-w- c:\documents and settings\Tiffany.CIARAN\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-54c3fcd6-n\msvcp71.dll
2010-05-22 15:35 . 2010-05-22 15:35 499712 -c–a-w- c:\documents and settings\Tiffany.CIARAN\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-54c3fcd6-n\jmc.dll
2010-05-22 15:35 . 2010-05-22 15:35 348160 -c–a-w- c:\documents and settings\Tiffany.CIARAN\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-54c3fcd6-n\msvcr71.dll
2010-05-22 15:35 . 2010-05-22 15:35 61440 -c–a-w- c:\documents and settings\Tiffany.CIARAN\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-260215c5-n\decora-sse.dll
2010-05-22 15:35 . 2010-05-22 15:35 12800 -c–a-w- c:\documents and settings\Tiffany.CIARAN\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-260215c5-n\decora-d3d.dll
2010-05-20 12:52 . 2007-03-25 20:17 220792 -c–a-w- c:\documents and settings\Bob.CIARAN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-18 01:57 . 2010-05-18 01:57 0 -c–a-w- c:\windows\ativpsrm.bin
2010-05-18 01:14 . 2010-05-23 10:51 38784 -c–a-w- c:\documents and settings\Bob.CIARAN\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-05-18 01:14 . 2010-05-18 01:13 38784 -c–a-w- c:\documents and settings\Tiffany.CIARAN\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-05-17 22:16 . 2010-05-17 22:16 10134 -c–a-r- c:\documents and settings\Tiffany.CIARAN\Application Data\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2010-05-17 15:09 . 2010-05-17 15:09 85504 -c–a-w- c:\documents and settings\Tiffany.CIARAN\Application Data\SystemRequirementsLab\srlproxy_cyri_4.1.71.0A.dll
2010-05-06 04:24 . 2010-05-06 04:24 36840 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Screentime\FFXIII-Screensaver\saver1.dll
2010-05-06 04:24 . 2010-05-06 04:24 258536 -c–a-w- c:\windows\system32\FFXIII-Screensaver.scr
2010-05-06 04:24 . 2010-05-06 04:24 20728 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Screentime\FFXIII-Screensaver\saver2.dll
2010-05-05 16:37 . 2010-05-05 16:37 84040 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\TransferWizard\Uninstaller.exe
2010-05-05 16:36 . 2010-05-05 16:36 57532 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\DSASPDecoder\Uninstaller.exe
2010-05-05 16:36 . 2010-05-05 16:36 54166 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\DSAVCDecoder\Uninstaller.exe
2010-05-05 16:36 . 2010-05-05 16:36 57409 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\ControlPanel\Uninstaller.exe
2010-05-04 17:20 . 2004-08-10 12:00 832512 -c–a-w- c:\windows\system32\wininet.dll
2010-05-04 17:20 . 2009-03-20 15:51 78336 -c–a-w- c:\windows\system32\ieencode.dll
2010-05-04 17:20 . 2004-08-10 12:00 17408 -c–a-w- c:\windows\system32\corpol.dll
2010-05-02 05:56 . 2004-08-10 12:00 1850880 -c–a-w- c:\windows\system32\win32k.sys
2010-04-29 19:39 . 2009-03-11 00:25 38224 -c–a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39 . 2009-03-11 00:25 20952 -c–a-w- c:\windows\system32\drivers\mbam.sys
2010-04-27 23:59 . 2010-04-27 20:56 24 -c–a-w- c:\windows\popcinfot.dat
2010-04-27 20:56 . 2010-04-27 20:56 0 -c–a-w- c:\windows\popcreg.dat
2010-04-27 00:07 . 2010-04-27 00:07 57054 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\DSDesktopComponents\Uninstaller.exe
2010-04-27 00:07 . 2010-04-27 00:07 56458 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-04-27 00:07 . 2010-04-27 00:07 54174 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\DSAACDecoder\Uninstaller.exe
2010-04-27 00:07 . 2010-04-27 00:07 52963 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-04-27 00:06 . 2010-04-27 00:06 54073 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\Qt4.5\Uninstaller.exe
2010-04-27 00:06 . 2010-04-27 00:06 56969 -c–a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\ASPEncoder\Uninstaller.exe
2008-02-28 13:04 . 2008-02-28 13:03 2293848 -c–a-w- c:\program files\FLV PlayerFCSetup.exe
2007-03-08 19:29 . 2007-04-02 03:34 237568 -c–a-w- c:\program files\Uninstall Morpheus Toolbar.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="c:\program files\AIM\aim.exe" [2006-08-01 67112]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"MsmqIntCert"="mqrt.dll" [2009-06-25 177152]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-08-23 57344]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
"Dell Photo AIO Printer 942"="c:\program files\Dell Photo AIO Printer 942\dlbubmgr.exe" [2004-08-31 294912]
"DellMCM"="c:\program files\Dell Photo AIO Printer 942\memcard.exe" [2004-07-27 262144]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver\LVCOMS.EXE" [2002-06-10 102400]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-06-20 155648]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-06-20 45056]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-02-25 2652056]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-11 61440]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"AsioReg"="CTASIO.DLL" [2003-02-20 110592]
"CTHelper"="CTHELPER.EXE" [2003-02-20 28672]
"CTxfiHlp"="CTXFIHLP.EXE" [2007-04-09 19968]
"CTSysVol"="c:\program files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2002-10-29 49152]
"CTDVDDet"="c:\program files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2002-09-30 45056]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-17 2065760]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"OCRFOC"="c:\windows\system32\vjoyg.dll" [2010-07-10 88576]

c:\documents and settings\Tiffany.CIARAN\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2006-6-15 180224]
KODAK Software Updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-2-13 16423]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-17 01:29 12536 -c–a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Infogrames Interactive\\Scrabble Complete\\ScrabbleComplete.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [6/8/2010 5:41 PM 216400]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [6/8/2010 5:41 PM 243024]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [1/17/2009 1:07 PM 159600]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [7/16/2010 9:29 PM 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/16/2010 9:29 PM 308136]
R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [1/17/2009 1:07 PM 73840]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/8/2008 5:58 PM 24652]
R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [1/17/2009 1:07 PM 95640]
S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys –> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]
S3 AsAudioDevice_351;AsAudioDevice_351;c:\windows\system32\drivers\AsAudioDevice_351.sys [9/5/2009 11:54 AM 16640]
S3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [9/5/2009 11:59 AM 16640]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [5/13/2007 7:17 PM 691696]
.
Contents of the 'Scheduled Tasks' folder

2010-07-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-01-10 20:42]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
DPF: {8B67B37E-1AE2-4B99-B8CF-55AF4D58DF0D} - file:///E:/win/setup/iamce.dll
DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} - hxxp://shared.live.com/0AWo70tq93pEHO1WfbbTIA/etc/Microsoft.Live.Folders.RichUpload.cab
FF - ProfilePath - c:\documents and settings\Tiffany.CIARAN\Application Data\Mozilla\Firefox\Profiles\0gx36beu.default\
FF - prefs.js: browser.startup.homepage - hxxp://my.msn.com/default.aspx?mypg=1
FF - component: c:\documents and settings\Tiffany.CIARAN\Application Data\Mozilla\Firefox\Profiles\0gx36beu.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Tiffany.CIARAN\Application Data\Mozilla\Firefox\Profiles\0gx36beu.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\components\RadioWMPCore.dll
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
BHO-{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
Toolbar-{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
WebBrowser-{1392B8D2-5C05-419F-A8F6-B9F15A596612} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-24 01:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTxfiHlp = CTXFIHLP.EXE?

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1048)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-07-24 01:11:24
ComboFix-quarantined-files.txt 2010-07-24 05:11
ComboFix2.txt 2010-03-15 23:24

Pre-Run: 107,970,924,544 bytes free
Post-Run: 108,028,571,648 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

- - End Of File - - 571AEA66CA38DCCEE495F4C9DFB0340D

TDSSKiller log:

2010/07/25 22:42:24.0239 TDSS rootkit removing tool 2.4.0.0 Jul 22 2010 16:09:49
2010/07/25 22:42:24.0239 ================================================================================
2010/07/25 22:42:24.0239 SystemInfo:
2010/07/25 22:42:24.0239
2010/07/25 22:42:24.0239 OS Version: 5.1.2600 ServicePack: 2.0
2010/07/25 22:42:24.0239 Product type: Workstation
2010/07/25 22:42:24.0239 ComputerName: CIARAN
2010/07/25 22:42:24.0239 UserName: Tiffany
2010/07/25 22:42:24.0239 Windows directory: C:\WINDOWS
2010/07/25 22:42:24.0239 System windows directory: C:\WINDOWS
2010/07/25 22:42:24.0239 Processor architecture: Intel x86
2010/07/25 22:42:24.0239 Number of processors: 1
2010/07/25 22:42:24.0239 Page size: 0x1000
2010/07/25 22:42:24.0239 Boot type: Normal boot
2010/07/25 22:42:24.0239 ================================================================================
2010/07/25 22:42:25.0523 Initialize success
2010/07/25 22:42:30.0599 ================================================================================
2010/07/25 22:42:30.0599 Scan started
2010/07/25 22:42:30.0599 Mode: Manual;
2010/07/25 22:42:30.0599 ================================================================================
2010/07/25 22:42:31.0272 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/07/25 22:42:31.0351 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2010/07/25 22:42:31.0492 aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys
2010/07/25 22:42:31.0648 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
2010/07/25 22:42:31.0789 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
2010/07/25 22:42:32.0165 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2010/07/25 22:42:32.0275 AsAudioDevice_351 (23020385d34e35dfc2d6503fa67d3ffc) C:\WINDOWS\system32\drivers\AsAudioDevice_351.sys
2010/07/25 22:42:32.0604 Aspi32 (54ab078660e536da72b21a27f56b035b) C:\WINDOWS\system32\drivers\aspi32.sys
2010/07/25 22:42:32.0745 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/07/25 22:42:32.0870 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
2010/07/25 22:42:33.0121 ati2mtag (c0b86ecb324e50f6bbd529f9d5c6b24b) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2010/07/25 22:42:33.0481 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/07/25 22:42:33.0591 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2010/07/25 22:42:33.0732 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\WINDOWS\system32\Drivers\avgldx86.sys
2010/07/25 22:42:33.0904 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\WINDOWS\system32\Drivers\avgmfx86.sys
2010/07/25 22:42:33.0998 AvgTdiX (22e3b793c3e61720f03d3a22351af410) C:\WINDOWS\system32\Drivers\avgtdix.sys
2010/07/25 22:42:34.0092 b57w2k (4826fcf97c47b361a2e2f68cd487a19e) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
2010/07/25 22:42:34.0233 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2010/07/25 22:42:34.0343 BVRPMPR5 (248dfa5762dde38dfddbbd44149e9d7a) C:\WINDOWS\system32\drivers\BVRPMPR5.SYS
2010/07/25 22:42:34.0625 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2010/07/25 22:42:34.0703 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2010/07/25 22:42:34.0860 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2010/07/25 22:42:34.0985 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
2010/07/25 22:42:35.0079 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/07/25 22:42:35.0298 COMMONFX.DLL (ffa7915d9f157b1176717057957779d6) C:\WINDOWS\System32\COMMONFX.DLL
2010/07/25 22:42:35.0486 CT20XUT.DLL (6191a973461852a09d643609e1d5f7c6) C:\WINDOWS\System32\CT20XUT.DLL
2010/07/25 22:42:35.0627 ctac32k (4c638290979600ae2ae329d1608ad2ec) C:\WINDOWS\system32\drivers\ctac32k.sys
2010/07/25 22:42:35.0705 ctaud2k (cf5662375781f741513c169cd4094100) C:\WINDOWS\system32\drivers\ctaud2k.sys
2010/07/25 22:42:35.0799 CTAUDFX.DLL (998fface7dfb702db57d490d61eb6273) C:\WINDOWS\System32\CTAUDFX.DLL
2010/07/25 22:42:35.0878 ctdvda2k (437f2b31ba8b6b264d38b4fe6682faec) C:\WINDOWS\system32\drivers\ctdvda2k.sys
2010/07/25 22:42:35.0987 CTEAPSFX.DLL (6a57f82009563aee8826f117e1d3c72c) C:\WINDOWS\System32\CTEAPSFX.DLL
2010/07/25 22:42:36.0113 CTEDSPFX.DLL (c8ac1ffaeadd655193d7b1811a572d8d) C:\WINDOWS\System32\CTEDSPFX.DLL
2010/07/25 22:42:36.0254 CTEDSPIO.DLL (44495d9daf675257d00b25b041ee6667) C:\WINDOWS\System32\CTEDSPIO.DLL
2010/07/25 22:42:36.0348 CTEDSPSY.DLL (8e90b1762cb42e2fc76dac9210c83c66) C:\WINDOWS\System32\CTEDSPSY.DLL
2010/07/25 22:42:36.0426 CTERFXFX.DLL (d3fbd9983325435b06795f29cb57ed3d) C:\WINDOWS\System32\CTERFXFX.DLL
2010/07/25 22:42:36.0645 CTEXFIFX.DLL (2c48e9d8ca703964463f27ae341115b7) C:\WINDOWS\System32\CTEXFIFX.DLL
2010/07/25 22:42:36.0912 CTHWIUT.DLL (f7657c598e7c29c6683c1e4a8dd68884) C:\WINDOWS\System32\CTHWIUT.DLL
2010/07/25 22:42:37.0021 ctprxy2k (678849d1af0750f68dbdc185252d5926) C:\WINDOWS\system32\drivers\ctprxy2k.sys
2010/07/25 22:42:37.0147 CTSBLFX.DLL (d77b981ec2f619d622c8573fe44dfa70) C:\WINDOWS\System32\CTSBLFX.DLL
2010/07/25 22:42:37.0225 ctsfm2k (3a076ebfbbbd6879a78863944980da32) C:\WINDOWS\system32\drivers\ctsfm2k.sys
2010/07/25 22:42:37.0413 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
2010/07/25 22:42:37.0491 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
2010/07/25 22:42:37.0554 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
2010/07/25 22:42:37.0632 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2010/07/25 22:42:37.0711 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
2010/07/25 22:42:37.0836 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
2010/07/25 22:42:37.0961 emupia (f7511cf63ef82f7227c03028a3abadb5) C:\WINDOWS\system32\drivers\emupia2k.sys
2010/07/25 22:42:38.0055 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
2010/07/25 22:42:38.0165 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\drivers\Fdc.sys
2010/07/25 22:42:38.0259 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
2010/07/25 22:42:38.0306 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\drivers\Flpydisk.sys
2010/07/25 22:42:38.0415 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2010/07/25 22:42:38.0525 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/07/25 22:42:38.0572 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/07/25 22:42:38.0666 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
2010/07/25 22:42:38.0713 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/07/25 22:42:38.0823 ha10kx2k (f24dd43adc784177b28984043bc022ab) C:\WINDOWS\system32\drivers\ha10kx2k.sys
2010/07/25 22:42:38.0917 hap16v2k (ff65c807ea641ff7310a61be4dec6479) C:\WINDOWS\system32\drivers\hap16v2k.sys
2010/07/25 22:42:39.0042 HidIr (07577916997e89563ed508c2ab6ff415) C:\WINDOWS\system32\DRIVERS\hidir.sys
2010/07/25 22:42:39.0152 hidusb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/07/25 22:42:39.0355 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
2010/07/25 22:42:39.0543 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\drivers\i8042prt.sys
2010/07/25 22:42:39.0637 iastor (f26bfd48b1c314e0f23bf77acfa75940) C:\WINDOWS\system32\DRIVERS\iaStor.sys
2010/07/25 22:42:39.0684 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
2010/07/25 22:42:39.0935 IntelC51 (7509c548400f4c9e0211e3f6e66abbe6) C:\WINDOWS\system32\DRIVERS\IntelC51.sys
2010/07/25 22:42:40.0076 IntelC52 (9584ffdd41d37f2c239681d0dac2513e) C:\WINDOWS\system32\DRIVERS\IntelC52.sys
2010/07/25 22:42:40.0201 IntelC53 (de2686c0e012e6ae24acd6e79eb7ff5d) C:\WINDOWS\system32\DRIVERS\IntelC53.sys
2010/07/25 22:42:40.0327 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys
2010/07/25 22:42:40.0452 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2010/07/25 22:42:40.0515 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2010/07/25 22:42:40.0609 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/07/25 22:42:40.0702 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/07/25 22:42:40.0812 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/07/25 22:42:40.0937 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/07/25 22:42:41.0047 IrBus (0461e205fa8870f9020ffe7c64721e75) C:\WINDOWS\system32\DRIVERS\IrBus.sys
2010/07/25 22:42:41.0141 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
2010/07/25 22:42:41.0219 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/07/25 22:42:41.0329 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/07/25 22:42:41.0454 kbdhid (e182fa8e49e8ee41b4adc53093f3c7e6) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2010/07/25 22:42:41.0564 klmd24 (6485ad0a17a0d6286b4d44c652adabb2) C:\WINDOWS\system32\drivers\klmd.sys
2010/07/25 22:42:41.0658 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
2010/07/25 22:42:41.0783 KSecDD (674d3e5a593475915dc6643317192403) C:\WINDOWS\system32\drivers\KSecDD.sys
2010/07/25 22:42:42.0034 MHNDRV (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys
2010/07/25 22:42:42.0191 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2010/07/25 22:42:42.0347 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
2010/07/25 22:42:42.0457 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
2010/07/25 22:42:42.0535 mohfilt (59b8b11ff70728eec60e72131c58b716) C:\WINDOWS\system32\DRIVERS\mohfilt.sys
2010/07/25 22:42:42.0645 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/07/25 22:42:42.0739 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/07/25 22:42:42.0786 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
2010/07/25 22:42:42.0880 MQAC (eee50bf24caeedb515a8f3b22756d3bb) C:\WINDOWS\system32\drivers\mqac.sys
2010/07/25 22:42:43.0084 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/07/25 22:42:43.0287 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/07/25 22:42:43.0397 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
2010/07/25 22:42:43.0491 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/07/25 22:42:43.0585 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/07/25 22:42:43.0679 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
2010/07/25 22:42:43.0804 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/07/25 22:42:43.0882 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
2010/07/25 22:42:44.0008 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
2010/07/25 22:42:44.0102 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2010/07/25 22:42:44.0211 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
2010/07/25 22:42:44.0321 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2010/07/25 22:42:44.0431 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/07/25 22:42:44.0572 Ndisuio (eefa1ce63805d2145978621be5c6d955) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/07/25 22:42:44.0681 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/07/25 22:42:44.0807 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
2010/07/25 22:42:44.0916 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
2010/07/25 22:42:45.0010 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
2010/07/25 22:42:45.0183 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2010/07/25 22:42:45.0261 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
2010/07/25 22:42:45.0355 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
2010/07/25 22:42:45.0512 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2010/07/25 22:42:45.0590 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/07/25 22:42:45.0684 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/07/25 22:42:45.0762 NwlnkIpx (79ea3fcda7067977625b3363a2657c80) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
2010/07/25 22:42:45.0840 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
2010/07/25 22:42:45.0934 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
2010/07/25 22:42:46.0028 ohci1394 (0951db8e5823ea366b0e408d71e1ba2a) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2010/07/25 22:42:46.0138 OMCI (cec7e2c6c1fa00c7ab2f5434f848ae51) C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS
2010/07/25 22:42:46.0279 ossrv (f0184fe6069be1541a3d18c02a73d161) C:\WINDOWS\system32\drivers\ctoss2k.sys
2010/07/25 22:42:46.0404 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
2010/07/25 22:42:46.0514 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
2010/07/25 22:42:46.0608 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2010/07/25 22:42:46.0686 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
2010/07/25 22:42:46.0874 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\drivers\PCIIde.sys
2010/07/25 22:42:46.0968 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
2010/07/25 22:42:47.0078 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\WINDOWS\system32\Drivers\pcouffin.sys
2010/07/25 22:42:47.0203 PCTAppEvent (3379e7a840de135fb7a829e03bc9cc25) C:\WINDOWS\system32\drivers\PCTAppEvent.sys
2010/07/25 22:42:47.0282 pctgntdi (bf770a5817fa8fba1402b2286a7f394c) C:\WINDOWS\system32\drivers\pctgntdi.sys
2010/07/25 22:42:47.0438 pctplfw (0eec24affc5ab0a2bbe4a6a886230aa5) C:\WINDOWS\system32\drivers\pctplfw.sys
2010/07/25 22:42:48.0002 PfModNT (c8a2d6ff660ac601b7bb9a9b16a5c25e) C:\WINDOWS\system32\drivers\PfModNT.sys
2010/07/25 22:42:48.0112 PhilCam8116 (a3a4d50051ddbcf390e5918c43c167ef) C:\WINDOWS\system32\DRIVERS\CamDrL21.sys
2010/07/25 22:42:48.0268 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/07/25 22:42:48.0347 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
2010/07/25 22:42:48.0472 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/07/25 22:42:48.0582 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2010/07/25 22:42:49.0146 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/07/25 22:42:49.0224 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/07/25 22:42:49.0271 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/07/25 22:42:49.0365 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2010/07/25 22:42:49.0522 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/07/25 22:42:49.0647 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/07/25 22:42:49.0725 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2010/07/25 22:42:49.0866 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
2010/07/25 22:42:49.0992 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/07/25 22:42:50.0101 RMCAST (d18208ed6c768663b08c972eaa7a8b60) C:\WINDOWS\system32\drivers\RMCast.sys
2010/07/25 22:42:50.0211 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
2010/07/25 22:42:50.0368 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/07/25 22:42:50.0540 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
2010/07/25 22:42:50.0618 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
2010/07/25 22:42:50.0759 SFilter (975f4e44fd48c36beed30c96a115b2b8) C:\WINDOWS\system32\DRIVERS\pctfw.sys
2010/07/25 22:42:50.0853 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
2010/07/25 22:42:51.0041 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2010/07/25 22:42:51.0166 smwdm (4aa922332433cdeb8b82c072c212e32e) C:\WINDOWS\system32\drivers\smwdm.sys
2010/07/25 22:42:51.0323 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
2010/07/25 22:42:51.0448 sptd (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\system32\Drivers\sptd.sys
2010/07/25 22:42:51.0589 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
2010/07/25 22:42:51.0730 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
2010/07/25 22:42:51.0934 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2010/07/25 22:42:52.0059 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
2010/07/25 22:42:52.0153 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
2010/07/25 22:42:52.0420 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
2010/07/25 22:42:52.0529 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/07/25 22:42:52.0623 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
2010/07/25 22:42:52.0749 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
2010/07/25 22:42:52.0827 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/07/25 22:42:52.0984 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
2010/07/25 22:42:53.0187 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
2010/07/25 22:42:53.0375 USBAAPL (1df89c499bf45d878b87ebd4421d462d) C:\WINDOWS\system32\Drivers\usbaapl.sys
2010/07/25 22:42:53.0485 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
2010/07/25 22:42:53.0563 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2010/07/25 22:42:53.0626 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2010/07/25 22:42:53.0704 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/07/25 22:42:53.0782 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2010/07/25 22:42:53.0892 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/07/25 22:42:53.0970 usbstor (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/07/25 22:42:54.0096 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2010/07/25 22:42:54.0174 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
2010/07/25 22:42:54.0346 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
2010/07/25 22:42:54.0425 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/07/25 22:42:54.0613 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
2010/07/25 22:42:54.0738 WsAudio_DeviceS(1) (a75dc063c9f0b787cce296c8ccad9c30) C:\WINDOWS\system32\drivers\WsAudio_DeviceS(1).sys
2010/07/25 22:42:54.0848 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2010/07/25 22:42:54.0957 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2010/07/25 22:42:55.0083 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2010/07/25 22:42:55.0114 ================================================================================
2010/07/25 22:42:55.0114 Scan finished
2010/07/25 22:42:55.0114 ================================================================================
2010/07/25 22:42:59.0735 Deinitialize success

hammerman

Post #7July 30, 2010, 9:50 PM UTC

Hi,

Could you please give me an update on how your computer's running.

Please follow these steps.

– Step 1 –

Run Malwarebytes' Anti-Malware.

Select the Update tab and then click Check for Updates. If an update is found, it will download and install the latest version.
Select the Scanner tab, select "Perform Quick Scan", then click Scan
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

– Step 2 –

Run OTL and select Minimal Output. Use the Quick Scan button to start a scan.
Please post the OTL report in your reply.

Vilya

Post #8July 30, 2010, 10:44 PM UTC

I just tried multiple searches on Google and Yahoo (mostly the pages giving me problems before) they all seem to work. I ran the MBAM, as I have been doing for weeks (never finds anything.) But heres the log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4372

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

7/30/2010 6:35:30 PM
mbam-log-2010-07-30 (18-35-30).txt

Scan type: Quick scan
Objects scanned: 214119
Time elapsed: 13 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

OTL:

OTL logfile created on: 7/30/2010 6:37:03 PM - Run 2
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Tiffany.CIARAN\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 143.00 Mb Available Physical Memory | 14.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 68.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 228.11 Gb Total Space | 95.65 Gb Free Space | 41.93% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CIARAN
Current User Name: Tiffany
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Tiffany.CIARAN\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools)
PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Program Files\PC Tools Firewall Plus\FWService.exe (PC Tools)
PRC - C:\Program Files\Smith Micro\StuffIt11\ArcNameService.exe (Smith Micro Software, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe (Viewpoint Corporation)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\WINDOWS\system32\snmp.exe (Microsoft Corporation)
PRC - C:\Program Files\AIM\aim.exe (America Online, Inc.)
PRC - C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe ()
PRC - C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe ()
PRC - C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell Photo AIO Printer 942\memcard.exe ()
PRC - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe ()
PRC - C:\WINDOWS\system32\CTHELPER.EXE (Creative Technology Ltd)
PRC - C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
PRC - C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDET.exe (Creative Technology Ltd)
PRC - C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe (Logitech Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Tiffany.CIARAN\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\ctagent.dll (Creative Technology Ltd)

========== Win32 Services (SafeList) ==========

SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe File not found
SRV - (avg9emc) – C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (PCToolsFirewallPlus) – C:\Program Files\PC Tools Firewall Plus\FWService.exe (PC Tools)
SRV - (Stuffit Archive Name Service) – C:\Program Files\Smith Micro\StuffIt11\ArcNameService.exe (Smith Micro Software, Inc.)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (SNMP) – C:\WINDOWS\system32\snmp.exe (Microsoft Corporation)
SRV - (LPDSVC) – C:\WINDOWS\system32\tcpsvcs.exe (Microsoft Corporation)
SRV - (W3SVC) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (SMTPSVC) Simple Mail Transfer Protocol (SMTP) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (IISADMIN) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (dlbu_device) – C:\WINDOWS\System32\dlbucoms.exe (Dell)
SRV - (spkrmon) – C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe ()

========== Driver Services (SafeList) ==========

DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys File not found
DRV - (mcdbus) – C:\WINDOWS\System32\DRIVERS\mcdbus.sys File not found
DRV - (InCDRm) – C:\WINDOWS\System32\drivers\InCDRm.sys File not found
DRV - (InCDPass) – C:\WINDOWS\System32\drivers\InCDPass.sys File not found
DRV - (InCDFs) – C:\WINDOWS\System32\drivers\InCDFs.sys File not found
DRV - (catchme) – C:\DOCUME~1\TIFFAN~1.CIA\LOCALS~1\Temp\catchme.sys File not found
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (AvgTdiX) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (MQAC) – C:\WINDOWS\system32\drivers\mqac.sys (Microsoft Corporation)
DRV - (WsAudio_DeviceS(1)) WsAudio_DeviceS(1) – C:\WINDOWS\system32\drivers\WsAudio_DeviceS(1).sys (Wondershare)
DRV - (PCTAppEvent) – C:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools)
DRV - (pctplfw) – C:\WINDOWS\system32\drivers\pctplfw.sys (PC Tools)
DRV - (AsAudioDevice_351) – C:\WINDOWS\system32\drivers\AsAudioDevice_351.sys (Wondershare)
DRV - (pctgntdi) – C:\WINDOWS\system32\drivers\pctgntdi.sys (PC Tools)
DRV - (SFilter) – C:\WINDOWS\system32\drivers\pctfw.sys (PC Tools)
DRV - (RMCAST) – C:\WINDOWS\system32\drivers\rmcast.sys (Microsoft Corporation)
DRV - (BVRPMPR5) – C:\WINDOWS\system32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (CT20XUT.DLL) – C:\WINDOWS\System32\CT20XUT.DLL (Creative Technology Ltd.)
DRV - (CTHWIUT.DLL) – C:\WINDOWS\System32\CTHWIUT.DLL (Creative Technology Ltd.)
DRV - (CTEXFIFX.DLL) – C:\WINDOWS\System32\CTEXFIFX.DLL (Creative Technology Ltd.)
DRV - (CTEDSPSY.DLL) – C:\WINDOWS\System32\CTEDSPSY.DLL (Creative Technology Ltd)
DRV - (CTEDSPIO.DLL) – C:\WINDOWS\System32\CTEDSPIO.DLL (Creative Technology Ltd)
DRV - (CTEDSPFX.DLL) – C:\WINDOWS\System32\CTEDSPFX.DLL (Creative Technology Ltd)
DRV - (CTERFXFX.DLL) – C:\WINDOWS\System32\CTERFXFX.DLL (Creative Technology Ltd)
DRV - (CTEAPSFX.DLL) – C:\WINDOWS\System32\CTEAPSFX.DLL (Creative Technology Ltd)
DRV - (IrBus) – C:\WINDOWS\system32\drivers\irbus.sys (Microsoft Corporation)
DRV - (Aspi32) – C:\WINDOWS\system32\drivers\ASPI32.SYS (Adaptec)
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (iastor) – C:\WINDOWS\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (IntelC52) – C:\WINDOWS\system32\drivers\IntelC52.sys (Intel Corporation)
DRV - (IntelC51) – C:\WINDOWS\system32\drivers\IntelC51.sys (Intel Corporation)
DRV - (IntelC53) – C:\WINDOWS\system32\drivers\IntelC53.sys (Intel Corporation)
DRV - (mohfilt) – C:\WINDOWS\system32\drivers\mohfilt.sys (Intel Corporation)
DRV - (ctdvda2k) – C:\WINDOWS\system32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (hap16v2k) – C:\WINDOWS\system32\drivers\hap16v2k.sys (Creative Technology Ltd)
DRV - (ha10kx2k) – C:\WINDOWS\system32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (PfModNT) – C:\WINDOWS\system32\drivers\pfmodnt.sys (Creative Technology Ltd.)
DRV - (CTSBLFX.DLL) – C:\WINDOWS\System32\CTSBLFX.DLL (Creative Technology Ltd)
DRV - (CTAUDFX.DLL) – C:\WINDOWS\System32\CTAUDFX.DLL (Creative Technology Ltd)
DRV - (COMMONFX.DLL) – C:\WINDOWS\System32\COMMONFX.DLL (Creative Technology Ltd)
DRV - (emupia) – C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (PhilCam8116) Logitech QuickCam Pro 3000(PID_08B0) – C:\WINDOWS\system32\drivers\CamDrL21.sys (Philips Semiconductors)
DRV - (OMCI) – C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS (Dell Computer Corporation)
DRV - (MODEMCSA) – C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://my.msn.com/default.aspx?mypg=1"
FF - prefs.js..extensions.enabledItems: {1392b8d2-5c05-419f-a8f6-b9f15a596612}:2.5.6.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100119091315
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.845
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/07/21 09:36:59 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/27 10:02:40 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/24 22:35:10 | 000,000,000 | —D | M]

[2009/08/11 22:46:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Mozilla\Extensions
[2010/07/30 17:35:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Mozilla\Firefox\Profiles\0gx36beu.default\extensions
[2010/03/12 22:25:19 | 000,000,000 | —D | M] (Freecorder Toolbar) – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Mozilla\Firefox\Profiles\0gx36beu.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}
[2010/04/26 21:06:17 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Mozilla\Firefox\Profiles\0gx36beu.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/02/18 14:49:19 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Mozilla\Firefox\Profiles\0gx36beu.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/07/30 17:35:42 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/07/30 17:35:03 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/07/30 17:34:50 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/04/16 13:07:12 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
[2007/03/09 19:16:44 | 000,189,496 | —- | M] (Yahoo! Inc.) – C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll

O1 HOSTS File: ([2010/07/24 01:02:42 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [00PCTFW] C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AsioReg] C:\WINDOWS\System32\ctasio.dll (Creative Technology Ltd)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDET.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CTHELPER.EXE (Creative Technology Ltd)
O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTxfiHlp] C:\WINDOWS\System32\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Dell Photo AIO Printer 942] C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe ()
O4 - HKLM..\Run: [DellMCM] C:\Program Files\Dell Photo AIO Printer 942\memcard.exe ()
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe (Logitech Inc.)
O4 - HKLM..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe (Logitech Inc.)
O4 - HKLM..\Run: [MsmqIntCert] C:\WINDOWS\System32\mqrt.dll (Microsoft Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl File not found
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe ()
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe ()
O4 - Startup: C:\Documents and Settings\Tiffany.CIARAN\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\Tiffany.CIARAN\Start Menu\Programs\Startup\Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Yahoo;! Search - C:\Program Files\Yahoo!\Common [2009/08/13 13:59:31 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &Dictionary; - C:\Program Files\Yahoo!\Common [2009/08/13 13:59:31 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &Maps; - C:\Program Files\Yahoo!\Common [2009/08/13 13:59:31 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &SMS; - C:\Program Files\Yahoo!\Common [2009/08/13 13:59:31 | 000,000,000 | —D | M]
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe File not found
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} https://activatemydsl.verizon.net/sdcCommon…20Installer.cab (Support.com Configuration Class)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/F/D…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2042B57E-6336-459E-B7CE-2A0F6C9E6AF8} file:///E:/win/setup/iaieplay.dll (IEPlayInterface Class)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2…78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/Facebo…otoUploader.cab (Reg Error: Key error.)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1173310928812 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8B67B37E-1AE2-4B99-B8CF-55AF4D58DF0D} file:///E:/win/setup/iamce.dll (IAMCE Class)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} http://shared.live.com/0AWo70tq93pEHO1Wfbb….RichUpload.cab (Windows Live SkyDrive Upload Tool)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/…024/mcfscan.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\Documents and Settings\Tiffany.CIARAN\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Tiffany.CIARAN\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/03/03 11:15:14 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/07/30 17:35:18 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/07/30 17:21:31 | 000,000,000 | —D | C] – C:\_OTL
[2010/07/30 09:31:24 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Tiffany.CIARAN\Desktop\OTL.exe
[2010/07/29 19:45:09 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Tiffany.CIARAN\Desktop\HiJackThis.exe
[2010/07/27 09:58:32 | 000,000,000 | —D | C] – C:\Program Files\Alcohol Soft
[2010/07/27 09:47:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Documents\DAEMON Tools Images
[2010/07/27 09:46:19 | 000,000,000 | —D | C] – C:\Program Files\DAEMON Tools Lite
[2010/07/27 09:45:25 | 009,591,104 | —- | C] (DT Soft Ltd.) – C:\Documents and Settings\Tiffany.CIARAN\My Documents\DTLite4356-0091.exe
[2010/07/24 01:12:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\FrontLine Registry Cleaner
[2010/07/24 01:12:51 | 000,000,000 | —D | C] – C:\Program Files\Frontline Registry Cleaner
[2010/07/24 01:12:33 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/07/24 00:46:06 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/07/24 00:39:46 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/07/24 00:39:46 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/07/24 00:39:46 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/07/24 00:39:45 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/07/16 21:29:07 | 000,012,536 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2010/07/15 04:33:10 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\My Documents\gyllenhaal videos
[2010/07/10 16:21:02 | 000,000,000 | —D | C] – C:\Program Files\Free FLAC to MP3 Converter
[2010/07/10 16:13:16 | 000,000,000 | —D | C] – C:\Program Files\FLAC to MP3 Converter
[2010/06/23 17:25:31 | 000,000,000 | —D | C] – C:\Program Files\Windward Studios
[2010/06/23 17:24:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\My Documents\Page2Stage
[2010/06/13 21:13:24 | 000,000,000 | —D | C] – C:\Program Files\Nero
[2010/06/13 20:40:02 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2010/06/10 14:20:35 | 000,000,000 | —D | C] – C:\26d845deb79aca57874a774519365e
[2010/06/09 03:13:20 | 000,000,000 | —D | C] – C:\$AVG
[2010/06/08 17:41:24 | 000,243,024 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/06/08 17:41:17 | 000,216,400 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/06/08 17:41:15 | 000,029,584 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/06/08 17:41:07 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\Avg
[2010/06/08 17:18:27 | 002,131,808 | —- | C] (AVG Technologies) – C:\Documents and Settings\Tiffany.CIARAN\My Documents\avg_free_stb_all_9_114_cnet.exe
[2010/06/07 00:09:57 | 000,000,000 | —D | C] – C:\Program Files\VSO
[2010/06/06 22:13:57 | 000,176,128 | —- | C] (Creative Technology Limited) – C:\WINDOWS\READREG.EXE
[2010/06/06 22:13:55 | 000,077,824 | —- | C] (Creative Labs) – C:\WINDOWS\System32\eaxac3.dll
[2010/06/06 22:13:45 | 000,065,536 | —- | C] ( ) – C:\WINDOWS\System32\dllcache\a3d.dll
[2010/06/06 22:13:45 | 000,065,536 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll
[2010/06/06 21:27:15 | 000,409,600 | —- | C] (Creative Labs) – C:\WINDOWS\System32\wrap_oal.dll
[2010/06/01 21:44:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\My Documents\Electronic Arts
[2010/05/30 17:06:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\My Documents\filelib
[2010/05/29 16:43:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\DAEMON Tools Lite
[2010/05/29 16:43:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\DAEMON Tools Lite
[2010/05/28 21:35:33 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\My Documents\Updater
[2010/05/24 20:57:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\My Documents\My Archives
[2010/05/24 19:47:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\My Documents\My Received Files
[2010/05/23 17:04:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Electronic Arts
[2010/05/23 07:03:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\My Documents\World Adventures
[2010/05/22 19:01:32 | 000,000,000 | —D | C] – C:\Program Files\Electronic Arts
[2010/05/22 15:07:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\Local Settings\Application Data\hdysblken
[2010/05/20 11:53:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\Local Settings\Application Data\mrxyfknhn
[2010/05/18 12:33:14 | 000,000,000 | —D | C] – C:\Program Files\Mad Scientist Productions
[2010/05/17 21:59:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\Local Settings\Application Data\ATI
[2010/05/17 21:59:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\ATI
[2010/05/17 21:59:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\ATI
[2010/05/17 21:30:04 | 000,000,000 | —D | C] – C:\ATI
[2010/05/17 21:13:36 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2010/05/17 18:21:04 | 000,000,000 | —D | C] – C:\ProgramData
[2010/05/17 18:16:25 | 000,000,000 | —D | C] – C:\Program Files\Microsoft WSE
[2010/05/17 16:09:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\My Documents\Sims 3
[2010/05/17 14:09:53 | 000,000,000 | —D | C] – C:\3490a9f5a3d9d0acd7dbc8fcae
[2010/05/17 11:09:54 | 000,000,000 | —D | C] – C:\Program Files\SystemRequirementsLab
[2010/05/17 11:09:43 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\SystemRequirementsLab
[2010/05/06 00:24:24 | 000,258,536 | —- | C] (ScreenTime Media) – C:\WINDOWS\System32\FFXIII-Screensaver.scr
[2010/05/06 00:24:24 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Screentime
[2010/05/06 00:23:56 | 000,000,000 | —D | C] – C:\Documents and Settings\Tiffany.CIARAN\Local Settings\Application Data\Screentime
[2004/08/25 12:22:08 | 000,151,552 | —- | C] ( ) – C:\WINDOWS\System32\ATIDEMGR.dll

========== Files - Modified Within 90 Days ==========

[2010/07/30 18:34:44 | 000,000,000 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\Local Settings\Application Data\prvlcl.dat
[2010/07/30 17:29:09 | 001,475,584 | R— | M] () – C:\Documents and Settings\All Users.WINDOWS\Documents\ESBK.mbb
[2010/07/30 17:29:08 | 000,808,960 | R— | M] () – C:\Documents and Settings\All Users.WINDOWS\Documents\ESBK.mb
[2010/07/30 17:25:08 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/30 17:24:59 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/30 17:23:41 | 012,320,768 | -H– | M] () – C:\Documents and Settings\Tiffany.CIARAN\NTUSER.DAT
[2010/07/30 17:23:41 | 000,031,560 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000004-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/07/30 17:23:41 | 000,031,560 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000004-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/07/30 17:23:41 | 000,031,440 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000004-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/07/30 17:23:41 | 000,031,440 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000004-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/07/30 17:23:41 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settingsbkup.sfm
[2010/07/30 17:23:41 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settings.sfm
[2010/07/30 17:23:41 | 000,000,288 | —- | M] () – C:\WINDOWS\System32\DVCStateBkp-{00000004-00000000-00000002-00001102-00000004-10031102}.dat
[2010/07/30 17:23:41 | 000,000,288 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000004-00000000-00000002-00001102-00000004-10031102}.dat
[2010/07/30 17:23:18 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Tiffany.CIARAN\ntuser.ini
[2010/07/30 09:31:20 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Tiffany.CIARAN\Desktop\OTL.exe
[2010/07/30 09:15:08 | 062,757,562 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/07/30 01:27:21 | 000,000,520 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\Shortcut to HiJackThis.lnk
[2010/07/29 19:45:08 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Tiffany.CIARAN\Desktop\HiJackThis.exe
[2010/07/29 19:29:03 | 000,000,639 | —- | M] () – C:\WINDOWS\dellstat.ini
[2010/07/27 17:27:55 | 000,015,364 | -H– | M] () – C:\Documents and Settings\All Users.WINDOWS\Documents\.DS_Store
[2010/07/27 09:52:00 | 000,697,328 | —- | M] () – C:\WINDOWS\System32\drivers\sptd.sys
[2010/07/27 09:45:33 | 009,591,104 | —- | M] (DT Soft Ltd.) – C:\Documents and Settings\Tiffany.CIARAN\My Documents\DTLite4356-0091.exe
[2010/07/26 12:19:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/07/25 03:00:03 | 000,000,440 | —- | M] () – C:\WINDOWS\tasks\FrontLine Registry Cleaner Scheduled Scan - Tiffany.job
[2010/07/24 02:48:21 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/24 01:03:00 | 000,000,246 | —- | M] () – C:\WINDOWS\system.ini
[2010/07/24 01:02:42 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/07/24 00:46:13 | 000,000,279 | RHS- | M] () – C:\boot.ini
[2010/07/20 00:44:56 | 000,000,034 | —- | M] () – C:\WINDOWS\cdplayer.ini
[2010/07/17 20:35:21 | 016,689,632 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\Desktop\shoebox_project_pdf.zip
[2010/07/16 21:29:09 | 000,243,024 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/07/16 21:29:07 | 000,012,536 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2010/07/16 21:29:00 | 000,216,400 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/07/15 04:33:26 | 000,162,816 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/08 00:34:12 | 063,470,650 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\Desktop\BBC_Radio_with_Jared_Leto_7-7-2010.mp3
[2010/07/05 17:10:28 | 000,020,269 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\UntitledScreenplay.sws
[2010/07/05 17:10:28 | 000,016,485 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\UntitledScreenplay.sws1
[2010/06/26 18:02:47 | 000,000,754 | —- | M] () – C:\WINDOWS\WORDPAD.INI
[2010/06/19 01:39:58 | 000,153,156 | -H– | M] () – C:\WINDOWS\System32\mlfcache.dat
[2010/06/19 00:34:26 | 000,136,486 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\Donnie_Darko___Frank_Avatar.gif
[2010/06/18 00:47:17 | 000,000,832 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\Desktop\Hoyle Card.lnk
[2010/06/13 21:14:28 | 000,002,337 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart.lnk
[2010/06/10 23:23:43 | 000,001,996 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\The Sims™ 2 Mansion and Garden Stuff.lnk
[2010/06/10 23:00:56 | 000,586,326 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/10 23:00:56 | 000,502,762 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/10 23:00:56 | 000,092,272 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/10 15:39:21 | 000,622,024 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/08 17:43:36 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/06/08 17:41:29 | 000,001,507 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\AVG Free 9.0.lnk
[2010/06/08 17:41:15 | 000,113,461 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2010/06/08 17:17:47 | 002,131,808 | —- | M] (AVG Technologies) – C:\Documents and Settings\Tiffany.CIARAN\My Documents\avg_free_stb_all_9_114_cnet.exe
[2010/06/07 00:10:09 | 000,047,360 | —- | M] (VSO Software) – C:\Documents and Settings\Tiffany.CIARAN\Application Data\pcouffin.sys
[2010/06/07 00:10:09 | 000,007,887 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\Application Data\pcouffin.cat
[2010/06/07 00:10:09 | 000,001,144 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\Application Data\pcouffin.inf
[2010/06/06 22:08:15 | 000,000,136 | —- | M] () – C:\WINDOWS\SBWIN.INI
[2010/06/06 21:27:15 | 000,409,600 | —- | M] (Creative Labs) – C:\WINDOWS\System32\wrap_oal.dll
[2010/06/03 22:12:09 | 003,703,508 | -H– | M] () – C:\Documents and Settings\Tiffany.CIARAN\Local Settings\Application Data\IconCache.db
[2010/06/01 21:39:37 | 000,001,723 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\The Sims™ 3.lnk
[2010/06/01 03:36:38 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/05/28 20:50:40 | 000,000,147 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\Application Data\burnaware.ini
[2010/05/26 00:11:36 | 008,170,910 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\pazaakcantina.zip
[2010/05/23 17:45:44 | 000,001,907 | —- | M] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\EA Download Manager.lnk
[2010/05/17 21:57:26 | 000,000,000 | —- | M] () – C:\WINDOWS\ativpsrm.bin
[2010/05/10 17:52:33 | 000,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/05/06 00:24:24 | 000,258,536 | —- | M] (ScreenTime Media) – C:\WINDOWS\System32\FFXIII-Screensaver.scr

========== Files Created - No Company Name ==========

[2010/07/30 09:43:23 | 000,293,376 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\Desktop\gmer.exe
[2010/07/30 01:27:21 | 000,000,520 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\Shortcut to HiJackThis.lnk
[2010/07/27 17:23:54 | 000,015,364 | -H– | C] () – C:\Documents and Settings\All Users.WINDOWS\Documents\.DS_Store
[2010/07/24 01:13:00 | 000,000,440 | —- | C] () – C:\WINDOWS\tasks\FrontLine Registry Cleaner Scheduled Scan - Tiffany.job
[2010/07/24 00:39:46 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/07/24 00:39:46 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/07/24 00:39:46 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/07/24 00:39:46 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/07/24 00:39:46 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/07/17 20:35:11 | 016,689,632 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\Desktop\shoebox_project_pdf.zip
[2010/07/08 00:24:04 | 063,470,650 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\Desktop\BBC_Radio_with_Jared_Leto_7-7-2010.mp3
[2010/06/23 18:37:17 | 000,016,485 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\UntitledScreenplay.sws1
[2010/06/23 18:33:15 | 000,020,269 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\UntitledScreenplay.sws
[2010/06/19 00:34:26 | 000,136,486 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\Donnie_Darko___Frank_Avatar.gif
[2010/06/18 00:47:17 | 000,000,832 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\Desktop\Hoyle Card.lnk
[2010/06/08 17:41:29 | 000,001,507 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\AVG Free 9.0.lnk
[2010/06/08 17:41:14 | 000,113,461 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2010/06/08 17:41:07 | 062,757,562 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/06/08 17:29:44 | 000,031,560 | —- | C] () – C:\WINDOWS\System32\BMXStateBkp-{00000004-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/06/08 17:29:44 | 000,031,560 | —- | C] () – C:\WINDOWS\System32\BMXState-{00000004-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/06/08 17:29:44 | 000,031,440 | —- | C] () – C:\WINDOWS\System32\BMXCtrlState-{00000004-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/06/08 17:29:44 | 000,031,440 | —- | C] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000004-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/06/08 17:29:44 | 000,001,080 | —- | C] () – C:\WINDOWS\System32\settingsbkup.sfm
[2010/06/08 17:29:44 | 000,001,080 | —- | C] () – C:\WINDOWS\System32\settings.sfm
[2010/06/08 17:29:44 | 000,000,288 | —- | C] () – C:\WINDOWS\System32\DVCStateBkp-{00000004-00000000-00000002-00001102-00000004-10031102}.dat
[2010/06/08 17:29:44 | 000,000,288 | —- | C] () – C:\WINDOWS\System32\DVCState-{00000004-00000000-00000002-00001102-00000004-10031102}.dat
[2010/06/06 22:18:39 | 004,481,358 | —- | C] () – C:\WINDOWS\{00000004-00000000-00000002-00001102-00000004-10031102}.CDF
[2010/06/06 22:14:03 | 000,232,723 | —- | C] () – C:\WINDOWS\System32\ctstatic.dat
[2010/06/06 22:14:02 | 000,190,842 | —- | C] () – C:\WINDOWS\System32\ctdlang.dat
[2010/06/06 22:14:02 | 000,138,716 | —- | C] () – C:\WINDOWS\System32\ctbas2w.dat
[2010/06/06 22:14:02 | 000,110,720 | —- | C] () – C:\WINDOWS\System32\CTBASICW.DAT
[2010/06/06 22:14:02 | 000,053,674 | —- | C] () – C:\WINDOWS\System32\ctdaught.dat
[2010/06/06 22:13:57 | 000,184,320 | —- | C] () – C:\WINDOWS\PSCONV.EXE
[2010/06/06 22:13:57 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\regplib.exe
[2010/06/06 22:13:56 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\killapps.exe
[2010/06/06 22:13:56 | 000,000,180 | —- | C] () – C:\WINDOWS\System32\kill.ini
[2010/06/06 22:13:55 | 000,005,515 | —- | C] () – C:\WINDOWS\System32\ENSDEF.INI
[2010/06/06 22:13:55 | 000,000,059 | —- | C] () – C:\WINDOWS\System32\default8.sfm
[2010/06/06 22:13:55 | 000,000,059 | —- | C] () – C:\WINDOWS\System32\default4.sfm
[2010/06/06 22:13:55 | 000,000,059 | —- | C] () – C:\WINDOWS\System32\default.sfm
[2010/06/06 22:13:53 | 002,259,067 | —- | C] () – C:\WINDOWS\System32\DEFAULT.ECW
[2010/06/06 22:13:49 | 004,481,358 | —- | C] () – C:\WINDOWS\CTDVAUDY.CDF
[2010/06/06 22:13:46 | 002,167,684 | —- | C] () – C:\WINDOWS\System32\CT2MGM.SF2
[2010/06/06 22:13:45 | 001,048,576 | —- | C] () – C:\WINDOWS\System32\CT1MGM.ROM
[2010/06/06 22:07:34 | 000,017,350 | —- | C] () – C:\WINDOWS\System32\CTDetect.hlp
[2010/06/06 22:07:34 | 000,000,641 | —- | C] () – C:\WINDOWS\System32\CTDetect.cnt
[2010/06/01 21:39:37 | 000,001,723 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\The Sims™ 3.lnk
[2010/05/28 20:50:39 | 000,000,147 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\Application Data\burnaware.ini
[2010/05/26 00:11:17 | 008,170,910 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\pazaakcantina.zip
[2010/05/17 21:57:26 | 000,000,000 | —- | C] () – C:\WINDOWS\ativpsrm.bin
[2010/05/17 18:16:49 | 000,001,907 | —- | C] () – C:\Documents and Settings\Tiffany.CIARAN\My Documents\EA Download Manager.lnk
[2010/03/13 00:48:23 | 000,000,031 | —- | C] () – C:\WINDOWS\ultimatecd.ini
[2009/08/13 00:22:18 | 000,000,033 | —- | C] () – C:\WINDOWS\LVMMail.INI
[2008/09/07 00:52:08 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\impborl.dll
[2008/04/21 18:32:50 | 000,000,250 | —- | C] () – C:\WINDOWS\gmer.ini
[2008/04/21 18:32:49 | 000,819,200 | —- | C] () – C:\WINDOWS\gmer.dll
[2008/03/24 02:59:33 | 000,000,398 | —- | C] () – C:\WINDOWS\AudioConverter.INI
[2007/12/15 21:05:31 | 000,000,112 | —- | C] () – C:\WINDOWS\ActiveSkin.INI
[2007/08/24 13:44:07 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/08/13 11:57:20 | 000,000,067 | —- | C] () – C:\WINDOWS\#1 DVD Audio Ripper.INI
[2007/06/23 06:18:27 | 000,000,118 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2007/05/13 19:17:04 | 000,697,328 | —- | C] () – C:\WINDOWS\System32\drivers\sptd.sys
[2007/05/07 13:59:50 | 000,000,034 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2007/04/22 19:59:32 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/04/12 09:10:28 | 000,105,728 | —- | C] () – C:\WINDOWS\System32\APOMgrH.dll
[2007/04/09 12:55:14 | 000,097,785 | —- | C] () – C:\WINDOWS\System32\instwdm.ini
[2007/04/09 12:55:14 | 000,000,030 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2007/04/09 12:33:50 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CTBurst.dll
[2007/03/21 14:19:18 | 000,000,241 | —- | C] () – C:\WINDOWS\QSync.INI
[2007/03/21 14:18:57 | 000,005,187 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2007/03/08 19:16:39 | 000,143,360 | R— | C] () – C:\WINDOWS\System32\dlbucoin.dll
[2007/03/08 19:16:39 | 000,131,072 | R— | C] () – C:\WINDOWS\System32\dlbusnls.dll
[2007/03/08 19:12:43 | 000,000,639 | —- | C] () – C:\WINDOWS\dellstat.ini
[2007/03/08 18:34:08 | 000,000,231 | —- | C] () – C:\WINDOWS\AC3API.INI
[2007/03/08 18:33:42 | 000,066,807 | —- | C] () – C:\WINDOWS\System32\Aud2_Del.ini
[2007/03/08 18:31:56 | 000,000,136 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2007/03/06 19:49:52 | 000,021,791 | —- | C] () – C:\WINDOWS\System32\smtpctrs.ini
[2007/03/06 19:49:51 | 000,001,037 | —- | C] () – C:\WINDOWS\System32\ntfsdrct.ini
[2007/03/06 19:49:39 | 000,038,576 | —- | C] () – C:\WINDOWS\System32\w3ctrs.ini
[2007/03/06 19:49:39 | 000,010,225 | —- | C] () – C:\WINDOWS\System32\axperf.ini
[2007/03/06 19:49:38 | 000,011,435 | —- | C] () – C:\WINDOWS\System32\infoctrs.ini
[2007/03/06 19:49:34 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2007/03/06 19:23:18 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2007/03/05 22:06:58 | 000,000,799 | —- | C] () – C:\WINDOWS\orun32.ini
[2007/01/22 07:19:00 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\dlbucfg.dll
[2005/08/05 15:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/06/16 10:17:16 | 000,071,680 | —- | C] () – C:\WINDOWS\System32\ctmmactl.dll
[2005/05/25 13:07:26 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\dlbucnv4.dll
[2004/08/06 14:23:06 | 000,114,688 | —- | C] () – C:\WINDOWS\System32\dlbucur.dll
[2004/08/06 14:22:12 | 000,557,056 | —- | C] () – C:\WINDOWS\System32\dlbujswr.dll
[2004/08/06 14:07:24 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\dlbucu.dll
[2004/08/06 14:01:42 | 000,401,408 | —- | C] () – C:\WINDOWS\System32\dlbuutil.dll
[2004/03/26 18:59:00 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/10/08 10:09:46 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\dlbuvs.dll
[2000/09/08 18:53:50 | 000,073,839 | —- | C] () – C:\WINDOWS\System32\KodakOneTouch.dll
[1997/11/10 15:18:48 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll

========== LOP Check ==========

[2010/06/08 17:37:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\avg9
[2010/03/13 01:01:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Canneverbe Limited
[2010/05/29 16:43:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\DAEMON Tools Lite
[2010/05/23 17:45:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Electronic Arts
[2010/07/24 01:12:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\FrontLine Registry Cleaner
[2007/06/19 21:37:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\iWin Games
[2009/09/15 12:27:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\NBC Direct
[2010/04/27 16:57:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\PopCap Games
[2010/05/06 00:24:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Screentime
[2007/04/24 17:19:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\SlySoft
[2007/08/24 14:12:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\SMSI
[2008/05/26 08:44:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Snap-On Business Solutions
[2010/07/30 17:26:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
[2008/01/08 17:58:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Viewpoint
[2007/12/24 03:42:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\vsosdk
[2007/04/09 17:37:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\WildTangent
[2007/05/14 17:15:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\WinZip
[2009/12/15 22:28:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2008/05/22 16:22:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\148221328_RipIt4Me
[2007/04/11 21:19:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\acccore
[2007/03/07 13:38:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Aim
[2010/03/13 01:01:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Canneverbe Limited
[2010/05/29 16:53:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\DAEMON Tools Lite
[2007/03/21 14:18:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\FotoWire
[2008/10/04 19:19:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\funkitron
[2010/06/19 01:13:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Hoyle Blackjack
[2010/07/05 23:18:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Hoyle Card Games
[2010/06/20 22:24:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Hoyle Casino
[2009/04/28 21:52:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Hoyle FaceCreator
[2007/11/30 23:02:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Hoyle Puzzle and Board Games
[2009/08/31 12:33:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\IDM
[2007/04/08 20:38:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\iWin
[2007/12/31 16:11:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\lalasync
[2007/04/21 18:13:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Leadertech
[2008/04/28 22:15:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\LimeWire
[2007/03/09 17:09:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\MSNInstaller
[2009/09/15 12:27:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\NBC Direct
[2008/04/22 18:24:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\PCToolsFirewallPlus
[2007/04/16 15:28:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\SAM
[2007/05/30 16:06:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\SecondLife
[2010/05/17 11:09:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\SystemRequirementsLab
[2010/05/27 16:47:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\uTorrent
[2007/03/25 17:19:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Viewpoint
[2010/06/07 00:13:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Tiffany.CIARAN\Application Data\Vso
[2010/07/25 03:00:03 | 000,000,440 | —- | M] () – C:\WINDOWS\Tasks\FrontLine Registry Cleaner Scheduled Scan - Tiffany.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C31F31E6
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:8B2A3070
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6EB57FE6
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D5813BA5
< End of report >

Was there something in there? I'm trying to figure out what it was and why AVG, MBAM and nothing else was removing it.

hammerman

Post #9July 30, 2010, 10:52 PM UTC

Hi,

Please do an online scan with Kaspersky WebScanner

Click on Accept

You may be promted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on Settings
In the scan settings, select the following:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
- Scan Options:
Scan spyware, adware, diallers and other riskware
Scan Archives
Scan E-mail databases
Click Save
Now under ScanSelect My Computer
This will start the scanning of your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on View Report and then Save Report
Save the file to your desktop as a text file.
Copy and paste that information in your next post.

Vilya

Post #10July 31, 2010, 11:40 AM UTC

Saturday, July 31, 2010 Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Friday, July 30, 2010 22:02:59 Records in database: 4191399 Scan settings scan using the following database extended Scan archives yes Scan e-mail databases yes Scan area My Computer C:\ D:\ E:\ F:\ G:\ Scan statistics Objects scanned 156860 Threats found 0 Infected objects found 0 Suspicious objects found 0 Scan duration 08:52:57 No threats found. Scanned area is clean. Selected area has been scanned.

hammerman

Post #11July 31, 2010, 9:25 PM UTC

hi, Can you please give me an update on how your computer's running.

Vilya

Post #12July 31, 2010, 9:27 PM UTC

The search hasn't redirected me yet, everything else seems fine. Was there an infection in there?

hammerman

Post #13August 1, 2010, 7:21 AM UTC

Hi,

The OTL fix removed an infected file.

Please download mbr.exe and save in your root folder C:\
Click on start then Run…
In the Open: window, type cmd and OK
In the command window, enter the following

cd C:\ (followed by Enter)
mbr -t > %userprofile%\Desktop\mbr_log.txt (followed by Enter)

This will produce a log file mbr_log.txt on your desktop. Please copy/paste the contents of that file in your reply

Vilya

Post #14August 1, 2010, 3:11 PM UTC

Is it supposed to take a while? Because it's not posting anything to my desktop.

I could only find mbr.txt in my C:\ folder. This is it:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys spqj.sys hal.dll
kernel: MBR read successfully
user & kernel MBR OK

hammerman

Post #15August 1, 2010, 3:17 PM UTC

Hi,

Congratulations, your computer appears clean

Let's remove the tools we've been using.

Please follow these steps.

– Step 1 –

Follow these steps to uninstall Combofix and tools used in the removal of malware

Click START then RUN
Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
🖼Click to load external image (Posted Image)

– Step 2 –

Download OTC to your desktop and run it
Click Yes to beginning the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.

Here are some measures you can take to ensure that your computer remains clean.

1. Updates

Windows Updates

It is essential that you regularly check and install the latest Windows Updates. Vulnerabilities within Windows can leave your computer open to infection. Regular updates are released to fix these security vulnerabilities. It is recommended that you set Windows to check, download and install your updates automatically.

Click Start
Select Control Panel
Click on Automatic (recommended)
Set the day and time for the update check. Set this to a time when your computer will normally be on and connected to the internet.
Click Apply then OK.

Java Updates

As with Windows, Java also needs to be regularly updated to fix security vulnerabilites. You can download the latest version of the Java Runtime Environment (JRE) from here. Download, install and reboot your computer. You also need to uininstall older versions of Java.

Click Start
Select Control Panel
Select Add or Remove Programs
Remove all Java updates except the latest one you have just installed.

Adobe Updates

Your Adobe reader needs updating. You should ensure you use the latest Adobe Acrobat Reader and install any security updates that are released. You can download the latest reader and updates from here.

Other Updates

Regularly check for updates for all your security programs including firewall, antivirus, antispyware etc

2. Security Programs

Here is a list of security programs that I would recommend.

Firewall

A firewall is essential to stop hackers infiltrating your computer. The following firewalls are free for personal use. Do not install more than one firewall.

Zone Alarm is an excellent free basic firewall which is very easy to use.
Online-Armor Free is a more advanced firewall which includes a Host Intrusion Protection System (HIPS). This ensures that unrecognised programs will not run unless you give permission.

Antivirus

An antivirus program is essential. The following antivirus programs are free for personal use. Do not use more than one antivirus and always update virus definitions regularly.

AVG
Avira Free
Avast

Anti-Malware

Malwarebytes Anti-Malware MBAM is an excellent anti-malware tool that should be updated and a Quick Scan performed regularly. A Full Scan does not have to be carried out on such a regular basis as the developers aim to detect the vast majority of malware with the Quick Scan. The scanner is free for on-demand scans only.

Ad-Aware, Spybot, SuperAntispyware and A-Squared Free are also very good anti-malware programs that are free for on-demand scans. Spybot has a real-time protection feature called TeaTimer.

Prevention

SpywareBlaster is an excellent free tool for preventing the installation of spyware.
SpywareGuard offers real-time protection so that spyware is detected and blocked before it can do any harm.

Cleaner

ATF Cleaner removes temporary Internet Explorer, Firefox and Windows files.

Browser

Firefox is an alternative browser to Internet Explorer and is more secure.
NoScript is an add-on for Firefox and prevents execution of malicious scripts.
MVPS is a HOSTS file to replace your existing file. This prevents you connecting to a list of well-known ad sites.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

All search engines redirecting me, have tried to remove.

✨ Ask AI

Ask AI