What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

AntiVir Solution Pro

25 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I was sloppy and was tricked by this virus/trojan/worm. I was able to open the web through Mozilla (Chrome and IE shut down) and through a google search (while fighting off pop-ups) I ID'ed the problem and downloaded Malwarebytes Anti-Malware, which I ran in safe mode. It found two "Rogue.AntivirusSuite.Gen" that I removed. I have reopened in normal mode. IE and Chrome are still down but Firefox is working. I ran HiJack this but it asked me to run in Admin mode and I don't know if I did it right. I'm having trouble running it a second time. It says "HiJack This is already running" whenever I try. Here is the log I was able to get. This thing looks tough, and I know it can't be gone yet. Please help!! Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 8:14:44 PM, on 8/5/2010 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18470) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Dell\DellDock\DellDock.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\DellTPad\Apoint.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\System32\WLTRAY.EXE C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Dell\MediaDirect\PCMService.exe C:\Program Files\Common Files\aol\1221177210\ee\aolsoftware.exe C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTSNMPAgent.exe C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardService.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe C:\Program Files\DellTPad\HidFind.exe C:\Windows\V0380Mon.exe C:\Program Files\DellTPad\Apntex.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Windows\ehome\ehtray.exe C:\Windows\System32\spool\drivers\w32x86\3\E_FATICEA.EXE C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\PIXELA\ImageMixer 3 SE Ver.5\Transfer Utility\CameraMonitor.exe C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardTools.exe C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Windows\ehome\ehmsas.exe C:\Users\Carolyn\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe C:\Program Files\AOL 9.0\waol.exe C:\Program Files\SMART Technologies\SMART Board Drivers\Aware.exe C:\Program Files\SMART Technologies\SMART Board Drivers\Marker.exe C:\Program Files\AOL 9.0\shellmon.exe C:\Program Files\Internet Explorer\ieuser.exe c:\PROGRA~1\mcafee\msc\mcuimgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\wuauclt.exe C:\Users\Carolyn\Downloads\HiJackThis.exe O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe O23 - Service: Google Update Service (gupdate1c99a6f84977b54) (gupdate1c99a6f84977b54) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe – End of file - 5491 bytes
Post #2
Here is another HJT with version 2.0.4, run as the administrator.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:45:05 AM, on 8/6/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18470)
Boot mode: Normal

Running processes:
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Dell\DellDock\DellDock.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Common Files\aol\1221177210\ee\aolsoftware.exe
C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTSNMPAgent.exe
C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardService.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Windows\V0380Mon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\System32\spool\drivers\w32x86\3\E_FATICEA.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\PIXELA\ImageMixer 3 SE Ver.5\Transfer Utility\CameraMonitor.exe
C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardTools.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\Carolyn\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\SMART Technologies\SMART Board Drivers\Aware.exe
C:\Program Files\SMART Technologies\SMART Board Drivers\Marker.exe
C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
C:\Program Files\Java\jre6\bin\java.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6522
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: SMART Notebook Download Plugin - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Program Files\SMART Technologies\Notebook Software\NotebookPlugin.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1221177210\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SMARTSNMPAgent.exe] C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTSNMPAgent.exe -e
O4 - HKLM\..\Run: [SMART Board Service] C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardService.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [V0380Mon.exe] C:\Windows\V0380Mon.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Carolyn\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [EPSON Stylus CX8400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICEA.EXE /FU "C:\Windows\TEMP\E_SDB21.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0\AOL.EXE" -b
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: ImageMixer 3 SE Camera Monitor Ver.5.lnk = ?
O4 - Global Startup: SMART Board Tools.lnk = C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardTools.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/…_2/axofupld.cab
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Creative Camera VF0380 APO service application (AEV0380) - Creative Technology Ltd. - C:\Windows\system32\V0380Aps.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Update Service (gupdate1c99a6f84977b54) (gupdate1c99a6f84977b54) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 13758 bytes
Post #3
Hi jhess23a,

:welcome:

My name is NightWizard and I will be your helper. :)

While I go through your log, I would very much appreciate it if you read the following.

  • I aim provide you with the best instructions possible to resolve your issue. However, I ask that you understand that malware is complex and the process usually takes a few attempts before successfully cleaning everything out. In severe cases cleaning may not be possible and a reformat may be our only option.
  • If you are unresponsive to this thread within three days, the thread will be locked due to inactivity. However, if you will be away, let us know and we will be sure to keep the thread open.
  • Please do not make any new threads about this issue here or any other malware removal forum; it wastes other helpers' time and it can be dangerous for your PC.
  • If you don't understand a set of instructions or you are having trouble performing some of the fix, don't panic! Let me know and I will be happy to help in any way I can.
  • Please remember that the absence of symptoms does not mean you are clean. I request that you stick to this log until the very end - I will inform you when your system is clean.
  • Please do not use any tools other than the ones I instruct you to use. Some of the tools available can be dangerous if used incorrectly.

Please be advised that I am still in training at this forum. My posts will be checked by experts before I post in this thread. This is to ensure you get the best possible help available. This may cause delay however I will do my best to limit the time gaps between posts.


Thanks for choosing WhatTheTech and I will be back with a fix shortly! :)


-NightWizard
Post #4 last edited
]Please download OTL from one of the following links
  • LINK 1
  • LINK 2
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Under the Custom Scan box paste this in;

    netsvcs
    drivers32 /all
    %SYSTEMDRIVE%\*.*
    %systemroot%\system32\*.wt
    %systemroot%\system32\*.ruy
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\system32\spool\prtprocs\w32x86\*.tmp
    %systemroot%\system32\Spool\prtprocs\w32x86\*.dll
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\user32.dll /md5
    %systemroot%\system32\ws2_32.dll /md5
    %systemroot%\system32\ws2help.dll /md5
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them if you need to start a new topic.
Post #5
pardon my lack of banter holding my 10 mo daughter


OTL logfile created on: 8/7/2010 5:56:11 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Carolyn\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 53.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 220.58 Gb Total Space | 100.43 Gb Free Space | 45.53% Space Free | Partition Type: NTFS
Drive D: | 9.77 Gb Total Space | 4.98 Gb Free Space | 51.02% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CAROLYN-PC
Current User Name: Carolyn
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/08/07 17:53:39 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\Carolyn\Downloads\OTL.exe
PRC - [2010/07/03 18:13:40 | 000,030,192 | —- | M] (Google) – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
PRC - [2010/06/18 20:17:27 | 000,134,808 | —- | M] (Google Inc.) – C:\Users\Carolyn\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe
PRC - [2010/06/16 17:14:51 | 000,134,808 | —- | M] (Google Inc.) – C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
PRC - [2010/04/17 12:22:09 | 000,307,704 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/08/31 12:25:16 | 000,623,960 | —- | M] (Research In Motion Limited) – C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
PRC - [2009/02/26 15:24:50 | 000,097,680 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
PRC - [2008/11/15 17:28:45 | 002,356,088 | —- | M] (Adobe Systems Incorporated) – C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
PRC - [2008/10/29 02:29:41 | 002,927,104 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/10/24 10:14:36 | 000,206,112 | —- | M] (Macrovision Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
PRC - [2008/09/24 23:10:56 | 000,253,952 | —- | M] (PIXELA CORPORATION) – C:\Program Files\PIXELA\ImageMixer 3 SE Ver.5\Transfer Utility\CameraMonitor.exe
PRC - [2008/08/29 20:50:31 | 000,068,856 | —- | M] (Google Inc.) – C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2008/05/13 17:33:10 | 001,058,088 | —- | M] (Stardock Corporation) – C:\Program Files\Dell\DellDock\DellDock.exe
PRC - [2008/05/04 05:25:32 | 000,040,960 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\DellTPad\hidfind.exe
PRC - [2008/05/04 05:25:26 | 000,167,936 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\DellTPad\Apoint.exe
PRC - [2008/05/04 05:25:26 | 000,050,736 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\DellTPad\ApMsgFwd.exe
PRC - [2008/05/04 05:25:26 | 000,049,152 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\DellTPad\ApntEx.exe
PRC - [2008/04/28 17:56:28 | 000,161,048 | —- | M] (Stardock Corporation) – C:\Program Files\Dell\DellDock\DockLogin.exe
PRC - [2008/04/03 04:14:42 | 001,008,936 | —- | M] (SMART Technologies Inc.) – C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTSNMPAgent.exe
PRC - [2008/04/03 04:14:12 | 007,197,992 | —- | M] (SMART Technologies Inc.) – C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardTools.exe
PRC - [2008/04/03 04:13:58 | 005,469,480 | —- | M] (SMART Technologies Inc.) – C:\Program Files\SMART Technologies\SMART Board Drivers\Marker.exe
PRC - [2008/04/03 04:13:52 | 002,258,216 | —- | M] (SMART Technologies Inc.) – C:\Program Files\SMART Technologies\SMART Board Drivers\Aware.exe
PRC - [2008/04/03 04:13:48 | 002,106,664 | —- | M] (SMART Technologies) – C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardService.exe
PRC - [2008/01/25 02:38:12 | 002,458,128 | —- | M] (McAfee, Inc.) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
PRC - [2008/01/20 22:25:32 | 000,198,656 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
PRC - [2008/01/20 22:25:31 | 000,300,032 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
PRC - [2008/01/20 22:23:40 | 000,244,224 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wisptis.exe
PRC - [2008/01/09 17:50:22 | 000,767,976 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\MSC\mcmscsvc.exe
PRC - [2007/12/21 11:58:06 | 000,184,320 | —- | M] (CyberLink Corp.) – C:\Program Files\Dell\MediaDirect\PCMService.exe
PRC - [2007/12/11 13:33:42 | 000,358,224 | —- | M] (McAfee, Inc.) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
PRC - [2007/12/05 11:04:10 | 000,695,624 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe
PRC - [2007/11/26 11:46:14 | 000,023,880 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\MSK\msksrver.exe
PRC - [2007/11/12 07:07:20 | 000,102,400 | —- | M] (IDT, Inc.) – C:\Windows\System32\stacsv.exe
PRC - [2007/11/12 07:07:16 | 000,073,728 | —- | M] (Andrea Electronics Corporation) – C:\Windows\System32\AEstSrv.exe
PRC - [2007/11/01 20:12:38 | 000,582,992 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2007/11/01 20:12:38 | 000,265,040 | —- | M] (McAfee, Inc.) – c:\Program Files\McAfee\MSC\mcuimgr.exe
PRC - [2007/07/24 13:02:14 | 000,144,704 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\VirusScan\Mcshield.exe
PRC - [2007/07/18 16:54:42 | 000,856,864 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\MPF\MpfSrv.exe
PRC - [2007/06/07 15:01:38 | 000,155,648 | —- | M] (Creative Technology Ltd.) – C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
PRC - [2007/05/29 23:50:06 | 000,073,728 | —- | M] (Creative Technology Ltd.) – C:\Windows\System32\V0380Aps.exe
PRC - [2007/04/05 02:08:08 | 000,032,768 | —- | M] (Creative Technology Ltd.) – C:\Windows\V0380Mon.exe
PRC - [2007/03/21 14:00:04 | 000,355,096 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007/03/21 14:00:00 | 000,174,872 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2006/11/10 08:12:08 | 000,054,832 | —- | M] (AOL, LLC.) – C:\Program Files\AOL 9.0\shellmon.exe
PRC - [2006/11/10 08:11:58 | 000,039,472 | —- | M] (AOL, LLC.) – C:\Program Files\AOL 9.0\waol.exe
PRC - [2006/11/03 19:02:14 | 000,050,688 | —- | M] (Avanquest Software ) – C:\Program Files\Digital Line Detect\DLG.exe
PRC - [2006/10/23 08:50:35 | 000,046,640 | R— | M] (AOL LLC) – C:\Program Files\Common Files\aol\acs\AOLacsd.exe
PRC - [2006/09/25 20:52:48 | 000,050,736 | —- | M] (America Online, Inc.) – C:\Program Files\Common Files\aol\1221177210\ee\aolsoftware.exe


========== Modules (SafeList) ==========

MOD - [2010/08/07 17:53:39 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\Carolyn\Downloads\OTL.exe
MOD - [2008/01/20 22:25:29 | 000,380,416 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
MOD - [2008/01/20 22:24:37 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msscript.ocx
MOD - [2008/01/20 22:23:44 | 001,684,480 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/07/03 18:13:40 | 000,030,192 | —- | M] (Google) [On_Demand | Stopped] – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe – (GoogleDesktopManager-051210-111108)
SRV - [2010/03/18 13:16:28 | 000,753,504 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe – (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2008/08/29 20:57:40 | 000,016,680 | —- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe – (GoToAssist)
SRV - [2008/04/28 17:56:28 | 000,161,048 | —- | M] (Stardock Corporation) [Auto | Running] – C:\Program Files\Dell\DellDock\DockLogin.exe – (DockLoginService)
SRV - [2008/01/25 02:38:12 | 002,458,128 | —- | M] (McAfee, Inc.) [Auto | Running] – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe – (McNASvc)
SRV - [2008/01/20 22:23:32 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2008/01/09 17:50:22 | 000,767,976 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\MSC\mcmscsvc.exe – (mcmscsvc)
SRV - [2007/12/11 13:33:42 | 000,358,224 | —- | M] (McAfee, Inc.) [Auto | Running] – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe – (McProxy)
SRV - [2007/12/05 11:04:10 | 000,695,624 | —- | M] (McAfee, Inc.) [On_Demand | Running] – C:\Program Files\McAfee\VirusScan\mcsysmon.exe – (McSysmon)
SRV - [2007/11/26 11:46:14 | 000,023,880 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\MSK\MskSrver.exe – (MSK80Service)
SRV - [2007/11/12 07:07:20 | 000,102,400 | —- | M] (IDT, Inc.) [Auto | Running] – C:\Windows\System32\stacsv.exe – (STacSV)
SRV - [2007/11/12 07:07:16 | 000,073,728 | —- | M] (Andrea Electronics Corporation) [Auto | Running] – C:\Windows\System32\AEstSrv.exe – (AESTFilters)
SRV - [2007/11/07 10:35:40 | 000,378,184 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee\VirusScan\mcods.exe – (McODS)
SRV - [2007/07/24 13:02:14 | 000,144,704 | —- | M] (McAfee, Inc.) [Unknown | Running] – C:\Program Files\McAfee\VirusScan\Mcshield.exe – (McShield)
SRV - [2007/07/18 16:54:42 | 000,856,864 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\MPF\MPFSrv.exe – (MpfService)
SRV - [2007/05/29 23:50:06 | 000,073,728 | —- | M] (Creative Technology Ltd.) [Auto | Running] – C:\Windows\System32\V0380Aps.exe – (AEV0380)
SRV - [2007/03/21 14:00:04 | 000,355,096 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe – (IAANTMON) Intel®
SRV - [2006/10/23 08:50:35 | 000,046,640 | R— | M] (AOL LLC) [Auto | Running] – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe – (AOL ACS)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\BCM42RLY.sys – (BCM42RLY)
DRV - [2008/06/23 08:45:44 | 000,008,704 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)
DRV - [2008/06/23 08:45:40 | 000,980,992 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\HSX_DPV.sys – (HSF_DPV)
DRV - [2008/06/23 08:45:40 | 000,661,504 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\HSX_CNXT.sys – (winachsf)
DRV - [2008/06/23 08:45:38 | 000,208,384 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\HSXHWAZL.sys – (HSXHWAZL)
DRV - [2008/05/19 02:26:02 | 001,044,984 | —- | M] (Broadcom Corp.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\BCMWL6.SYS – (BCM43XX)
DRV - [2008/05/04 05:25:24 | 000,164,400 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Apfiltr.sys – (ApfiltrService)
DRV - [2008/04/03 01:54:42 | 000,014,120 | —- | M] (SMART Technologies ULC) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SMARTVHidMini2000x86.sys – (SMARTVHidMini2000x86)
DRV - [2008/04/03 01:54:38 | 000,011,048 | —- | M] (SMART Technologies ULC) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SMARTMouseFilterx86.sys – (SMARTMouseFilterx86)
DRV - [2008/04/03 01:54:34 | 000,016,808 | —- | M] (SMART Technologies ULC) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SMARTVTabletPCx86.sys – (SMARTVTabletPCx86)
DRV - [2008/03/06 03:58:44 | 000,111,616 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\IntcHdmi.sys – (IntcHdmiAddService) Intel®
DRV - [2008/03/06 03:58:12 | 002,016,256 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\igdkmd32.sys – (igfx)
DRV - [2008/01/20 22:23:27 | 000,386,616 | —- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasr.sys – (MegaSR)
DRV - [2008/01/20 22:23:27 | 000,149,560 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu320.sys – (adpu320)
DRV - [2008/01/20 22:23:27 | 000,031,288 | —- | M] (LSI Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasas.sys – (megasas)
DRV - [2008/01/20 22:23:26 | 000,101,432 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu160m.sys – (adpu160m)
DRV - [2008/01/20 22:23:26 | 000,074,808 | —- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid4.sys – (SiSRaid4)
DRV - [2008/01/20 22:23:26 | 000,040,504 | —- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\hpcisss.sys – (HpCISSs)
DRV - [2008/01/20 22:23:25 | 000,300,600 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpahci.sys – (adpahci)
DRV - [2008/01/20 22:23:25 | 000,220,672 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2008/01/20 22:23:25 | 000,089,656 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_sas.sys – (LSI_SAS)
DRV - [2008/01/20 22:23:24 | 001,122,360 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql2300.sys – (ql2300)
DRV - [2008/01/20 22:23:24 | 000,118,784 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\E1G60I32.sys – (E1G60) Intel®
DRV - [2008/01/20 22:23:24 | 000,079,928 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arcsas.sys – (arcsas)
DRV - [2008/01/20 22:23:23 | 000,235,064 | —- | M] (Intel Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iastorv.sys – (iaStorV)
DRV - [2008/01/20 22:23:23 | 000,130,616 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\vsmraid.sys – (vsmraid)
DRV - [2008/01/20 22:23:23 | 000,115,816 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata2.sys – (ulsata2)
DRV - [2008/01/20 22:23:23 | 000,096,312 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_scsi.sys – (LSI_SCSI)
DRV - [2008/01/20 22:23:23 | 000,096,312 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_fc.sys – (LSI_FC)
DRV - [2008/01/20 22:23:23 | 000,079,416 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arc.sys – (arc)
DRV - [2008/01/20 22:23:22 | 000,342,584 | —- | M] (Emulex) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\elxstor.sys – (elxstor)
DRV - [2008/01/20 22:23:21 | 000,422,968 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adp94xx.sys – (adp94xx)
DRV - [2008/01/20 22:23:21 | 000,102,968 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvraid.sys – (nvraid)
DRV - [2008/01/20 22:23:21 | 000,073,088 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\USBAUDIO.sys – (usbaudio) USB Audio Driver (WDM)
DRV - [2008/01/20 22:23:21 | 000,045,112 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvstor.sys – (nvstor)
DRV - [2008/01/20 22:23:20 | 000,238,648 | —- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\uliahci.sys – (uliahci)
DRV - [2008/01/20 22:23:00 | 000,020,024 | —- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\viaide.sys – (viaide)
DRV - [2008/01/20 22:23:00 | 000,019,000 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\cmdide.sys – (cmdide)
DRV - [2008/01/20 22:23:00 | 000,017,464 | —- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\aliide.sys – (aliide)
DRV - [2007/12/02 13:51:42 | 000,040,488 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mfesmfk.sys – (mfesmfk)
DRV - [2007/11/22 07:44:08 | 000,201,320 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\mfehidk.sys – (mfehidk)
DRV - [2007/11/22 07:44:08 | 000,079,304 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mfeavfk.sys – (mfeavfk)
DRV - [2007/11/22 07:44:08 | 000,035,240 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mfebopk.sys – (mfebopk)
DRV - [2007/11/22 07:44:04 | 000,033,832 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mferkdk.sys – (mferkdk)
DRV - [2007/11/12 07:07:28 | 000,330,240 | —- | M] (IDT, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2007/09/29 01:31:54 | 000,278,528 | —- | M] (Marvell) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\yk60x86.sys – (yukonwlh)
DRV - [2007/09/06 12:43:26 | 000,304,920 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\iastor.sys – (iaStor)
DRV - [2007/09/06 12:35:16 | 000,037,376 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rixdptsk.sys – (rismxdp)
DRV - [2007/09/06 12:35:14 | 000,039,936 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimmptsk.sys – (rimmptsk)
DRV - [2007/09/06 12:35:12 | 000,042,496 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimsptsk.sys – (rimsptsk)
DRV - [2007/07/13 07:21:12 | 000,125,728 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\Mpfp.sys – (MPFP)
DRV - [2007/07/02 21:00:02 | 000,273,152 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\V0380Vid.sys – (V0380Dev)
DRV - [2007/01/15 18:57:08 | 000,031,616 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\livecamv.sys – (RLDesignVirtualAudioCableWdm)
DRV - [2006/12/05 01:37:46 | 000,007,168 | —- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\V0380Vfx.sys – (V0380Vfx)
DRV - [2006/11/02 05:50:35 | 000,106,088 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql40xx.sys – (ql40xx)
DRV - [2006/11/02 05:50:35 | 000,098,408 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata.sys – (UlSata)
DRV - [2006/11/02 05:50:19 | 000,045,160 | —- | M] (IBM Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nfrd960.sys – (nfrd960)
DRV - [2006/11/02 05:50:17 | 000,041,576 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iirsp.sys – (iirsp)
DRV - [2006/11/02 05:50:11 | 000,071,272 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\djsvs.sys – (aic78xx)
DRV - [2006/11/02 05:50:09 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteraid.sys – (iteraid)
DRV - [2006/11/02 05:50:07 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteatapi.sys – (iteatapi)
DRV - [2006/11/02 05:50:05 | 000,035,944 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\symc8xx.sys – (Symc8xx)
DRV - [2006/11/02 05:50:03 | 000,034,920 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_u3.sys – (Sym_u3)
DRV - [2006/11/02 05:49:59 | 000,033,384 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\mraid35x.sys – (Mraid35x)
DRV - [2006/11/02 05:49:56 | 000,031,848 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_hi.sys – (Sym_hi)
DRV - [2006/11/02 04:25:24 | 000,071,808 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 04:24:47 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brusbser.sys – (BrUsbSer)
DRV - [2006/11/02 04:24:46 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltup.sys – (BrFiltUp)
DRV - [2006/11/02 04:24:45 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltlo.sys – (BrFiltLo)
DRV - [2006/11/02 04:24:44 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserwdm.sys – (BrSerWdm)
DRV - [2006/11/02 04:24:44 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brusbmdm.sys – (BrUsbMdm)
DRV - [2006/11/02 03:36:50 | 000,020,608 | —- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ntrigdigi.sys – (ntrigdigi)
DRV - [2006/11/02 03:36:43 | 002,028,032 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2006/11/01 16:18:15 | 000,033,588 | —- | M] (America Online, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wanatw4.sys – (wanatw) WAN Miniport (ATW)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cl…amp;ibd=1080830
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.1
FF - prefs.js..extensions.enabledItems: [removed]:7

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/06 07:04:19 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/17 12:22:25 | 000,000,000 | —D | M]

[2008/10/09 21:08:40 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\Mozilla\Extensions
[2010/08/06 20:31:44 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\Mozilla\Firefox\Profiles\7j5u7xrl.default\extensions
[2009/09/08 20:44:46 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Carolyn\AppData\Roaming\Mozilla\Firefox\Profiles\7j5u7xrl.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2008/10/12 09:00:19 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\Mozilla\Firefox\Profiles\7j5u7xrl.default\extensions\[removed]
[2009/03/27 18:27:52 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2008/11/04 13:20:41 | 000,000,000 | —D | M] (Smart Notebook Extension) – C:\Program Files\Mozilla Firefox\extensions\{D6D05E6F-D5C1-4e03-8E33-73F92B05E262}
[2008/09/15 11:52:06 | 000,376,832 | —- | M] ( ) – C:\Program Files\Mozilla Firefox\plugins\npsnapfish.dll

O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (McAfee Phishing Filter) - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\Program Files\McAfee\MSK\mcapbho.dll ()
O2 - BHO: (CIEDownload Object) - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Program Files\SMART Technologies\Notebook Software\NotebookPlugin.dll (SMART Technologies ULC.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\aol\1221177210\ee\aolsoftware.exe (America Online, Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SMART Board Service] C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardService.exe (SMART Technologies)
O4 - HKLM..\Run: [SMARTSNMPAgent.exe] C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTSNMPAgent.exe (SMART Technologies Inc.)
O4 - HKLM..\Run: [V0380Mon.exe] C:\Windows\V0380Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AOL Fast Start] C:\Program Files\AOL 9.0\AOL.EXE (AOL, LLC.)
O4 - HKCU..\Run: [Creative Live! Cam Manager] C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe (Creative Technology Ltd.)
O4 - HKCU..\Run: [EPSON Stylus CX8400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICEA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Users\Carolyn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Carolyn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} http://www.kodakgallery.com/downloads/BUM/…_2/axofupld.cab (Kodak Gallery Easy Upload Manager Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} http://www.photodex.com/pxplay.cab (Photodex Presenter AX control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\Carolyn\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Carolyn\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/10 12:27:33 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{5686ca39-9dbe-11dd-b951-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{5686ca39-9dbe-11dd-b951-00038a000015}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\{eea33814-aa81-11dd-b8a3-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{eea33814-aa81-11dd-b8a3-00038a000015}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer5 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave5 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 90 Days ==========

[2010/08/06 10:46:03 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/08/05 20:41:29 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2010/08/05 20:37:37 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/08/05 18:25:25 | 000,000,000 | —D | C] – C:\Users\Carolyn\Desktop\Virus Scans
[2010/08/05 16:43:03 | 000,000,000 | —D | C] – C:\Users\Carolyn\AppData\Roaming\Malwarebytes
[2010/08/05 16:42:37 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/08/05 16:42:36 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/08/05 16:42:36 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/08/05 16:42:35 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/08/05 15:46:05 | 000,000,000 | —D | C] – C:\Users\Carolyn\AppData\Local\lisaqmgsg
[2010/08/04 16:02:16 | 000,000,000 | —D | C] – C:\Program Files\MPC HomeCinema
[2010/07/26 15:59:28 | 000,000,000 | —D | C] – C:\Users\Carolyn\AppData\Roaming\Media Player Classic
[2010/07/10 10:27:43 | 000,000,000 | —D | C] – C:\Users\Carolyn\Documents\IMG_0239
[2010/07/01 20:42:13 | 000,000,000 | —D | C] – C:\Users\Carolyn\Documents\IMGP6763
[2010/06/21 15:50:18 | 000,000,000 | —D | C] – C:\Users\Carolyn\Documents\MarkandCarolynEngagementAnnouncement
[2010/05/29 22:06:58 | 000,000,000 | —D | C] – C:\Users\Carolyn\Documents\IMG_3592[1]
[3 C:\Users\Carolyn\Documents\*.tmp files -> C:\Users\Carolyn\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/08/07 18:00:55 | 002,359,296 | -HS- | M] () – C:\Users\Carolyn\NTUSER.DAT
[2010/08/07 17:51:42 | 000,703,388 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/08/07 17:51:42 | 000,604,502 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/08/07 17:51:42 | 000,104,170 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/08/07 17:50:40 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/08/07 17:43:01 | 000,003,744 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/08/07 17:43:01 | 000,003,744 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/08/07 17:22:00 | 000,000,916 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2805349893-152464557-784558142-1000UA.job
[2010/08/07 17:20:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/08/07 17:20:00 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/08/07 16:21:42 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/08/07 07:30:38 | 000,020,583 | —- | M] () – C:\Windows\System32\Config.MPF
[2010/08/07 07:27:37 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/08/07 07:27:31 | 3210,784,768 | -HS- | M] () – C:\hiberfil.sys
[2010/08/06 23:35:51 | 000,524,288 | -HS- | M] () – C:\Users\Carolyn\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2010/08/06 23:35:51 | 000,065,536 | -HS- | M] () – C:\Users\Carolyn\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/08/06 23:35:40 | 003,187,800 | -H– | M] () – C:\Users\Carolyn\AppData\Local\IconCache.db
[2010/08/06 20:44:41 | 000,010,410 | —- | M] () – C:\Users\Carolyn\Documents\Nanny E-mail.docx
[2010/08/06 20:22:00 | 000,000,864 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2805349893-152464557-784558142-1000Core.job
[2010/08/06 10:46:05 | 000,000,806 | —- | M] () – C:\Users\Carolyn\Desktop\CCleaner.lnk
[2010/08/05 20:52:54 | 000,002,527 | —- | M] () – C:\Users\Carolyn\Desktop\HiJackThis.lnk
[2010/08/05 16:42:40 | 000,000,820 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/04 21:57:06 | 000,023,103 | —- | M] () – C:\Users\Carolyn\Documents\Daily Routine.docx
[2010/08/04 16:02:18 | 000,000,772 | —- | M] () – C:\Users\Public\Desktop\Media Player Classic - Home Cinema.lnk
[2010/08/02 22:27:35 | 000,524,288 | -HS- | M] () – C:\Users\Carolyn\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/07/31 21:56:56 | 000,011,888 | —- | M] () – C:\Users\Carolyn\Documents\Lake House.docx
[2010/07/29 15:33:05 | 000,599,699 | —- | M] () – C:\Users\Carolyn\Documents\IMG00148.jpg
[2010/07/27 22:23:18 | 000,002,054 | —- | M] () – C:\Users\Carolyn\Desktop\Google Chrome.lnk
[2010/07/27 22:23:18 | 000,002,016 | —- | M] () – C:\Users\Carolyn\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/10 10:27:43 | 000,555,451 | —- | M] () – C:\Users\Carolyn\Documents\IMG_0239.zip
[2010/07/01 20:42:13 | 000,303,693 | —- | M] () – C:\Users\Carolyn\Documents\IMGP6763.zip
[2010/07/01 00:59:59 | 000,000,348 | —- | M] () – C:\Windows\tasks\McQcTask.job
[2010/06/30 14:23:46 | 000,151,552 | —- | M] () – C:\Users\Carolyn\Documents\LauraandBenjamin.doc
[2010/06/30 14:21:25 | 000,100,352 | —- | M] () – C:\Users\Carolyn\Documents\WesHitchcockprofilepics.doc
[2010/06/30 14:11:19 | 000,644,885 | —- | M] () – C:\Users\Carolyn\Documents\IMG00122.jpg
[2010/06/29 13:40:45 | 004,065,372 | —- | M] () – C:\Users\Carolyn\Documents\LoaderBackup-(2010-06-29).ipd
[2010/06/24 20:54:58 | 000,012,294 | —- | M] () – C:\Users\Carolyn\Documents\Reservation Confirmation.docx
[2010/06/21 15:50:18 | 003,946,287 | —- | M] () – C:\Users\Carolyn\Documents\MarkandCarolynEngagementAnnouncement.zip
[2010/06/09 18:15:41 | 000,317,624 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/06/08 21:33:15 | 000,574,268 | —- | M] () – C:\Users\Carolyn\Documents\IMG00116.jpg
[2010/05/29 22:06:58 | 006,404,050 | —- | M] () – C:\Users\Carolyn\Documents\IMG_3592[1].zip
[2010/05/18 07:52:51 | 000,000,581 | —- | M] () – C:\Users\Carolyn\.powerschool_gradebook.properties
[2010/05/15 08:16:27 | 000,002,075 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk
[2010/05/15 01:00:00 | 000,000,356 | —- | M] () – C:\Windows\tasks\McDefragTask.job
[3 C:\Users\Carolyn\Documents\*.tmp files -> C:\Users\Carolyn\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/06 10:46:05 | 000,000,806 | —- | C] () – C:\Users\Carolyn\Desktop\CCleaner.lnk
[2010/08/05 20:37:38 | 000,002,527 | —- | C] () – C:\Users\Carolyn\Desktop\HiJackThis.lnk
[2010/08/05 20:06:40 | 3210,784,768 | -HS- | C] () – C:\hiberfil.sys
[2010/08/05 16:42:40 | 000,000,820 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/04 16:02:18 | 000,000,772 | —- | C] () – C:\Users\Public\Desktop\Media Player Classic - Home Cinema.lnk
[2010/07/31 21:57:15 | 000,010,410 | —- | C] () – C:\Users\Carolyn\Documents\Nanny E-mail.docx
[2010/07/31 21:56:54 | 000,011,888 | —- | C] () – C:\Users\Carolyn\Documents\Lake House.docx
[2010/07/29 15:33:03 | 000,599,699 | —- | C] () – C:\Users\Carolyn\Documents\IMG00148.jpg
[2010/07/10 10:27:41 | 000,555,451 | —- | C] () – C:\Users\Carolyn\Documents\IMG_0239.zip
[2010/07/01 20:42:12 | 000,303,693 | —- | C] () – C:\Users\Carolyn\Documents\IMGP6763.zip
[2010/06/30 14:23:46 | 000,151,552 | —- | C] () – C:\Users\Carolyn\Documents\LauraandBenjamin.doc
[2010/06/30 14:21:24 | 000,100,352 | —- | C] () – C:\Users\Carolyn\Documents\WesHitchcockprofilepics.doc
[2010/06/30 14:11:16 | 000,644,885 | —- | C] () – C:\Users\Carolyn\Documents\IMG00122.jpg
[2010/06/29 13:40:45 | 004,065,372 | —- | C] () – C:\Users\Carolyn\Documents\LoaderBackup-(2010-06-29).ipd
[2010/06/24 20:54:57 | 000,012,294 | —- | C] () – C:\Users\Carolyn\Documents\Reservation Confirmation.docx
[2010/06/21 15:50:10 | 003,946,287 | —- | C] () – C:\Users\Carolyn\Documents\MarkandCarolynEngagementAnnouncement.zip
[2010/06/08 21:31:23 | 000,574,268 | —- | C] () – C:\Users\Carolyn\Documents\IMG00116.jpg
[2010/05/29 22:06:31 | 006,404,050 | —- | C] () – C:\Users\Carolyn\Documents\IMG_3592[1].zip
[2010/05/15 08:16:26 | 000,002,075 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2010/02/10 12:18:24 | 000,031,616 | —- | C] () – C:\Windows\System32\drivers\livecamv.sys
[2009/08/03 16:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2008/08/29 23:21:43 | 001,953,696 | —- | C] () – C:\Windows\System32\igklg400.dll
[2008/08/29 23:21:43 | 001,533,360 | —- | C] () – C:\Windows\System32\igklg450.dll
[2008/08/29 23:21:43 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1409.dll
[2008/08/29 23:21:43 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2008/08/29 23:21:43 | 000,004,608 | —- | C] () – C:\Windows\System32\HdmiCoin.dll
[2008/08/29 23:21:40 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
[2008/08/29 20:44:20 | 000,054,784 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2006/11/02 08:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 03:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini

========== LOP Check ==========

[2009/12/31 23:29:52 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\Netscape
[2009/08/10 16:48:43 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\PeerNetworking
[2009/11/15 19:51:00 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\Research In Motion
[2008/11/04 13:17:14 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\SMART Technologies
[2008/11/04 13:21:32 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\SMART Technologies Inc
[2009/03/21 06:56:21 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\Snapfish
[2010/05/15 01:00:00 | 000,000,356 | —- | M] () – C:\Windows\Tasks\McDefragTask.job
[2010/07/01 00:59:59 | 000,000,348 | —- | M] () – C:\Windows\Tasks\McQcTask.job
[2010/08/06 23:35:55 | 000,032,592 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/02/10 12:27:33 | 000,000,074 | —- | M] () – C:\autoexec.bat
[2008/01/20 22:24:42 | 000,333,203 | RHS- | M] () – C:\bootmgr
[2006/09/18 17:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2010/02/10 11:49:59 | 000,000,194 | —- | M] () – C:\CtDrvIns.log
[2010/02/10 11:49:59 | 000,005,899 | —- | M] () – C:\CtDrvStp.log
[2008/08/29 23:21:53 | 000,003,783 | RH– | M] () – C:\dell.sdr
[2010/08/07 07:27:31 | 3210,784,768 | -HS- | M] () – C:\hiberfil.sys
[2009/01/03 19:54:01 | 000,000,628 | -H– | M] () – C:\IPH.PH
[2008/08/29 20:44:17 | 000,026,927 | —- | M] () – C:\newfile.enc
[2008/08/29 20:44:17 | 000,026,927 | —- | M] () – C:\newkey
[2010/08/07 07:27:30 | 3524,587,520 | -HS- | M] () – C:\pagefile.sys
[2010/02/10 12:21:29 | 000,000,174 | —- | M] () – C:\Setup.log
[2008/08/29 21:01:22 | 000,000,071 | —- | M] () – C:\SystemInfo.ini
[2008/09/11 19:52:09 | 000,000,376 | -H– | M] () – C:\T4Metrics.log

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/11/02 08:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 08:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 08:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 08:37:12 | 000,030,808 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 17:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2008/01/20 22:23:14 | 000,089,600 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 08:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/05/19 02:25:24 | 000,054,784 | —- | M] () Unable to obtain MD5 – C:\Windows\System32\bcmwlrmt.dll
[2008/01/20 22:24:26 | 000,347,136 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\dxtmsft.dll
[2008/01/20 22:24:26 | 000,214,528 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\dxtrans.dll
[2008/01/20 22:24:42 | 000,242,744 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\rsaenh.dll
[2008/01/20 22:24:38 | 000,225,792 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\SLC.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008/01/20 23:14:18 | 016,846,848 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 23:14:08 | 000,106,496 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 23:14:18 | 000,020,480 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 06:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 06:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %systemroot%\system32\user32.dll /md5 >
[2008/01/20 22:24:21 | 000,627,200 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/01/20 22:24:48 | 000,179,200 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2006/11/02 05:44:30 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 – C:\Windows\System32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-08-04 07:01:06

========== Alternate Data Streams ==========

@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:288A91F8
< End of report >


OTL Extras logfile created on: 8/7/2010 5:56:11 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Carolyn\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 53.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 220.58 Gb Total Space | 100.43 Gb Free Space | 45.53% Space Free | Partition Type: NTFS
Drive D: | 9.77 Gb Total Space | 4.98 Gb Free Space | 51.02% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CAROLYN-PC
Current User Name: Carolyn
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00789F14-AD04-4190-B4FE-B8A983562390}" = protocol=17 | dir=in | app=c:\program files\aol 9.0\waol.exe |
"{133AB674-6DC9-4053-8D87-30F822354DAA}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{1D7B1D8D-7D67-4894-9C52-FB475EF5ED75}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{338DDC05-E21E-4B47-AC84-8701342E1BC2}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{591BCC5C-3B7A-4CCC-9FB4-89FBBEB94D99}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{825B4448-5963-49EE-9D73-78E067C7740F}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{83B77368-DCAB-4F30-8283-2A5E66B7D57B}" = dir=in | app=c:\program files\dell\mediadirect\kernel\dmp\clbrowserengine.exe |
"{84D4795B-9415-4DEA-8B47-EBE368D400A1}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{97D1E2AD-C529-4190-941F-19B9DB20B679}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{98B27570-A4E9-46CE-8702-C41AC02A6907}" = dir=in | app=c:\program files\dell\mediadirect\kernel\dms\clmsservice.exe |
"{9B3230F3-D185-4C64-B063-2A3A4F2A938D}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{9DC0F3C9-2863-4858-86C7-1C866DB28F95}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A43970A4-6D03-4A29-A86C-153DD6356B6D}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{ABFAC819-FD22-48D7-8FFE-66A185081CC4}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{AE65B1C2-7E89-49BD-AA3C-F21E27865F62}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{B0E36F43-B802-4A70-8C58-37F497C8B714}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{C4DB1CA7-2C56-49A3-B7BC-07AA6E13D634}" = dir=in | app=c:\program files\dell\mediadirect\mediadirect.exe |
"{CA75B3C8-900D-455D-9180-362F3385B4D7}" = dir=in | app=c:\program files\dell\mediadirect\pcmservice.exe |
"{CB992B41-29B3-4935-BDA3-09571C21E45A}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{D23AB7FB-36A8-44CC-80C7-17E48A1422D7}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{D300DFCC-9BCE-450A-BC92-D7D0D9227585}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{D68C02C4-FE0D-4717-B86A-C73D990E7061}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{EBB7197A-5199-41F0-A124-E8908CFFEDCE}" = protocol=6 | dir=in | app=c:\program files\aol 9.0\waol.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{13333239-0A15-4855-BEEB-0232DAA5B7EA}" = BlackBerry Desktop Software 5.0.1
"{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}" = Live! Cam Avatar v1.0
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2357B8BC-88C9-4A72-818C-050CC4EB0778}" = AOL Install
"{255909FA-8E58-4BC2-A83A-3C71EB5DD6EC}" = EarthLink Setup Files
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = Media Player Classic - Home Cinema v. 1.3.1249.0
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 13
"{26B878A8-5704-3B64-BDBC-4F0EACA38121}" = Google Talk Plugin
"{294EAADF-E50F-4DD8-AD8D-19587EA10512}" = Modem Diagnostic Tool
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{352310C3-E46B-42D3-8F32-54721FDD72D9}" = NetZeroInstallers
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E926B45-3748-40F9-8A30-99B225E1D2E5}" = Notebook Software
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}" = Banctec Service Agreement
"{44A91B04-3D0C-47F9-B644-7F682869AFF3}" = MobileMe Control Panel
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4B6AD248-D3BF-426A-8D64-847288154F13}" = QuickSet
"{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED}" = Dell DataSafe Online
"{4E5386F5-C0F6-4532-A54A-374865AEAB71}" = Cisco PEAP Module
"{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}" = iTunes
"{61128AC7-BD78-4D62-A114-2EF23856F558}" = Music Transfer Utility Ver.2
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{689E0AB3-50B2-4E5A-9DCE-6DA9F5BE1314}" = BlackBerry® Media Sync
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}" = EDocs
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{76F9CF97-FC4B-4E20-B363-D127C888448F}" = Cisco LEAP Module
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111410757}" = Scrabble Blast Deluxe
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup
"{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AFA20D47-69C3-4030-8DF8-D37466E70F13}" = Apple Mobile Device Support
"{B0F64C44-DC77-497D-9A27-C0F5BAB12493}" = muveeNow 2.0 - Creative
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3276CB1-20B6-4AF9-AAEC-E72C83816495}" = IKEA Home Planner
"{B674F947-56D6-4793-B465-7D7C87E04D0C}" = ImageMixer 3 SE Ver.5 Video Tools
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B7F98125-4955-41E3-8A71-4CE11CE9C198}" = KODAK Gallery Upload Software
"{B935C985-A17F-484B-8470-09E4FC27DC26}" = Dell-eBay
"{B98BE95C-E76F-4246-B8E6-BEB8EE791D06}" = Roxio Media Manager
"{BF53252E-4AB2-4C7F-A0FD-6100755745E3}" = Cisco EAP-FAST Module
"{C39A4E1F-9AF1-4FE1-A80E-A5B867FABB42}" = Dell Best of Web
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BB}" = WinZip 14.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D90AFDE3-3E67-407A-ACA8-F0BAAD012F08}" = Safari
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DFE492C4-A9F5-413E-A2CC-6F5F3ACC229F}" = ImageMixer 3 SE Ver.5 Transfer Utility
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{F6CB42B9-F033-4152-8813-FF11DA8E6A78}" = Dell Dock
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"{FF7A64AB-214A-47D1-95E7-742BCBA7F6C9}" = SMART Board Drivers
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Advanced Video FX Engine" = Advanced Video FX Engine
"AOL Uninstaller" = AOL Uninstaller (Choose which Products to Remove)
"BlackBerry_{13333239-0A15-4855-BEEB-0232DAA5B7EA}" = BlackBerry Desktop Software 5.0.1
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"CCleaner" = CCleaner
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F" = Conexant HDA D330 MDC V.92 Modem
"Creative Live! Cam Center" = Creative Live! Cam Center
"Creative Live! Cam Doodling" = Creative Live! Cam Doodling
"Creative Live! Cam FX Creator" = Creative Live! Cam FX Creator
"Creative Live! Cam Manager" = Creative Live! Cam Manager
"Creative Live! Cam User's Guide" = Creative Live! Cam User's Guide
"Creative Photo Calendar" = Creative Photo Calendar
"Creative Photo Manager" = Creative Photo Manager
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"Creative VF0380" = Creative Live! Cam Optia Pro Driver (1.00.06.0000)
"Easy Grade Pro" = Easy Grade Pro
"EPSON Printer and Utilities" = EPSON Printer Software
"FLV Player" = FLV Player 2.0 (build 25)
"Google Desktop" = Google Desktop
"Google Updater" = Google Updater
"GoToAssist" = GoToAssist 8.0.0.514
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.0.13)" = Mozilla Firefox (3.0.13)
"MSC" = McAfee SecurityCenter
"OfotoEZUpload" = KODAK EASYSHARE Gallery Upload ActiveX Control
"Photodex Presenter" = Photodex Presenter
"SightSpeed" = SightSpeed (remove only)
"SysInfo" = Creative System Information
"ViewpointMediaPlayer" = Viewpoint Media Player
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"Move Media Player" = Move Media Player
"PowerTeacher Gradebook" = PowerTeacher Gradebook

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/5/2010 1:08:04 PM | Computer Name = Carolyn-PC | Source = WinMgmt | ID = 10
Description =

Error - 4/5/2010 1:17:04 PM | Computer Name = Carolyn-PC | Source = Google Update | ID = 20
Description =

Error - 4/5/2010 6:03:30 PM | Computer Name = Carolyn-PC | Source = WinMgmt | ID = 10
Description =

Error - 4/6/2010 12:19:52 PM | Computer Name = Carolyn-PC | Source = Google Update | ID = 20
Description =

Error - 4/6/2010 12:22:52 PM | Computer Name = Carolyn-PC | Source = Google Update | ID = 20
Description =

Error - 4/6/2010 1:19:52 PM | Computer Name = Carolyn-PC | Source = Google Update | ID = 20
Description =

Error - 4/6/2010 1:22:51 PM | Computer Name = Carolyn-PC | Source = Google Update | ID = 20
Description =

Error - 4/7/2010 5:16:52 PM | Computer Name = Carolyn-PC | Source = WinMgmt | ID = 10
Description =

Error - 4/8/2010 2:46:41 PM | Computer Name = Carolyn-PC | Source = WinMgmt | ID = 10
Description =

Error - 4/8/2010 2:48:56 PM | Computer Name = Carolyn-PC | Source = Application Error | ID = 1000
Description = Faulting application bcmwltry.exe, version 4.170.25.12, time stamp
0x46f3437a, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception
code 0xc0000005, fault offset 0x01c98ec2, process id 0x6b8, application start time
0x01cad74b97ff76e9.

[ Broadcom Wireless LAN Events ]
Error - 7/22/2010 11:49:35 PM | Computer Name = Carolyn-PC | Source = WLAN-Tray | ID = 0
Description = 23:49:35, Thu, Jul 22, 10 Error - Unable to gain access to user store


Error - 7/23/2010 8:44:07 AM | Computer Name = Carolyn-PC | Source = WLAN-Tray | ID = 0
Description = 08:44:07, Fri, Jul 23, 10 Error - Unable to gain access to user store


Error - 7/25/2010 1:01:10 PM | Computer Name = Carolyn-PC | Source = WLAN-Tray | ID = 0
Description = 13:01:09, Sun, Jul 25, 10 Error - Unable to gain access to user store


Error - 7/29/2010 1:27:32 PM | Computer Name = Carolyn-PC | Source = WLAN-Tray | ID = 0
Description = 13:27:32, Thu, Jul 29, 10 Error - Unable to gain access to user store


Error - 7/29/2010 6:03:11 PM | Computer Name = Carolyn-PC | Source = WLAN-Tray | ID = 0
Description = 18:03:11, Thu, Jul 29, 10 Error - Unable to gain access to user store


Error - 7/29/2010 10:29:12 PM | Computer Name = Carolyn-PC | Source = WLAN-Tray | ID = 0
Description = 22:29:12, Thu, Jul 29, 10 Error - Unable to gain access to user store


Error - 8/1/2010 3:39:39 PM | Computer Name = Carolyn-PC | Source = WLAN-Tray | ID = 0
Description = 15:39:39, Sun, Aug 01, 10 Error - Unable to gain access to user store


Error - 8/1/2010 5:32:25 PM | Computer Name = Carolyn-PC | Source = WLAN-Tray | ID = 0
Description = 17:32:25, Sun, Aug 01, 10 Error - Unable to gain access to user store


Error - 8/3/2010 8:35:45 PM | Computer Name = Carolyn-PC | Source = WLAN-Tray | ID = 0
Description = 20:35:45, Tue, Aug 03, 10 Error - Unable to gain access to user store


Error - 8/3/2010 11:33:00 PM | Computer Name = Carolyn-PC | Source = WLAN-Tray | ID = 0
Description = 23:32:59, Tue, Aug 03, 10 Error - Unable to gain access to user store


[ Media Center Events ]
Error - 6/9/2009 9:34:28 PM | Computer Name = Carolyn-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 8/30/2009 11:10:43 AM | Computer Name = Carolyn-PC | Source = MCUpdate | ID = 0
Description = Failed to wait on MCUpdate mutex with exception: 'The wait completed
due to an abandoned mutex.'.

Error - 11/17/2009 4:51:15 AM | Computer Name = Carolyn-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 2/22/2010 4:34:42 PM | Computer Name = Carolyn-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 3/1/2010 4:34:15 PM | Computer Name = Carolyn-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ OSession Events ]
Error - 7/2/2009 5:06:29 PM | Computer Name = Carolyn-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 938
seconds with 480 seconds of active time. This session ended with a crash.

Error - 3/7/2010 10:32:44 PM | Computer Name = Carolyn-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 43929
seconds with 900 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 11/6/2009 9:20:36 AM | Computer Name = Carolyn-PC | Source = iaStor | ID = 262153
Description = The device, \Device\Ide\iaStor0, did not respond within the timeout
period.

Error - 11/6/2009 5:52:56 PM | Computer Name = Carolyn-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 4:51:05 PM on 11/6/2009 was unexpected.

Error - 11/6/2009 5:54:40 PM | Computer Name = Carolyn-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 11/6/2009 5:54:52 PM | Computer Name = Carolyn-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 11/6/2009 5:54:53 PM | Computer Name = Carolyn-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 11/6/2009 6:04:59 PM | Computer Name = Carolyn-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 11/6/2009 6:05:04 PM | Computer Name = Carolyn-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 11/6/2009 6:05:14 PM | Computer Name = Carolyn-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 11/6/2009 6:05:16 PM | Computer Name = Carolyn-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 11/6/2009 7:24:29 PM | Computer Name = Carolyn-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 6:22:55 PM on 11/6/2009 was unexpected.


< End of report >
Post #6 last edited
Hi jhess23a,

Please work through the following steps:

1. OTL Fix:
Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522
O4 - HKLM..\Run: [] File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O33 - MountPoints2\{5686ca39-9dbe-11dd-b951-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{5686ca39-9dbe-11dd-b951-00038a000015}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\{eea33814-aa81-11dd-b8a3-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{eea33814-aa81-11dd-b8a3-00038a000015}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
[2010/08/05 15:46:05 | 000,000,000 | —D | C] – C:\Users\Carolyn\AppData\Local\lisaqmgsg


:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • After rebooting, please post the OTL you are presented with on startup.


2. GMER Scan:
Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.


    [external image: Posted Image]
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries


In your next reply please include:
  • The OTL log.
  • The GMER log.

Cheers! :thumbup:
Post #7
step one: All processes killed ========== OTL ========== HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ not found. Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5686ca39-9dbe-11dd-b951-00038a000015}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5686ca39-9dbe-11dd-b951-00038a000015}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5686ca39-9dbe-11dd-b951-00038a000015}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5686ca39-9dbe-11dd-b951-00038a000015}\ not found. File F:\LaunchU3.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eea33814-aa81-11dd-b8a3-00038a000015}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eea33814-aa81-11dd-b8a3-00038a000015}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eea33814-aa81-11dd-b8a3-00038a000015}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eea33814-aa81-11dd-b8a3-00038a000015}\ not found. File F:\LaunchU3.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found. File G:\LaunchU3.exe not found. Folder C:\Users\Carolyn\AppData\Local\lisaqmgsg\ not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Carolyn ->Temp folder emptied: 165045 bytes ->Temporary Internet Files folder emptied: 1000144 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 4571481 bytes ->Google Chrome cache emptied: 0 bytes ->Apple Safari cache emptied: 0 bytes ->Flash cache emptied: 33 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 5.00 mb [EMPTYFLASH] User: All Users User: Carolyn ->Flash cache emptied: 0 bytes User: Default ->Flash cache emptied: 0 bytes User: Default User ->Flash cache emptied: 0 bytes User: Public Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.9.1 log created on 08102010_192125 Files\Folders moved on Reboot… File\Folder C:\Windows\temp\mcafee_ws5cW2xwmk6egPe not found! File\Folder C:\Windows\temp\mcmsc_LgkWdco582XkOOt not found! C:\Windows\temp\sqlite_AiUI2noQB3xsUd9 moved successfully. C:\Windows\temp\sqlite_pVjHDsehzKiywt9 moved successfully. File\Folder C:\Windows\temp\sqlite_wqpcibENHB57xnR not found! Registry entries deleted on Reboot…
Post #8
I'm having trouble running step two. I will try again later, but it runs automatically before I can click off the changes. Then it either freezes or shuts down my Windows.
Post #9
I have tried to run GMER about a dozen times. Each time has been unsuccessful. I thought I had the problem solved by turning off the computer's screen saver, and did get as far as the SAVE and rename the log into a .txt file step, but then my Windows shut down. I can try to run it in Safe mode, or I'll take any other suggestions. Also, on Sunday August 22 I'm going on holiday for a week and don't know if I will have access to this laptop. Will I need to start a new thread when I return? Thanks.
Post #10 last edited
Apologizes for the delay. NightWizard, is unavailable right now, and has asked me to step in.

Please attempt to run the GMER scan in Safe mode, and see if that works. If it still gives you issues, attempt to run GMER with only the C:/ and Sections checked.


If that still gives you issues do the following:


Please download this file, and save it to your Desktop. Once you have downloaded it, save and close all other programs and run it by double-clicking on the file named "RootRepeal.exe".

Once the main window shows up, please click on the "Report" button on the bottom of the window. Next, please click the "Scan" button.

Another window will pop up asking you to select what to include in the scan. Please uncheck everything except for the "Stealth Code" checkbox, and then click OK.

Once the program has finished scanning, the results will appear. Click on the "Save Report" button, and save the report to your desktop.

Finally, please open this report with Notepad, and post it here.
Post #11
RootRepeal also shut down my Windows, even faster than GMER did. I tried to run RootRepeal in Normal and Safe mode, failing both times. I did finally get GMER to run in Safe mode with only Sections and C: clicked. The scan did not produce a log and stated that "no system modications were found." Hope that's a good thing.
Post #12
Running ComboFix
Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Post #13
Combo fix, check.

ComboFix 10-08-12.03 - Carolyn 08/13/2010 15:49:00.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3061.1920 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Carolyn\GoToAssistDownloadHelper.exe

.
((((((((((((((((((((((((( Files Created from 2010-07-13 to 2010-08-13 )))))))))))))))))))))))))))))))
.

2010-08-13 19:58 . 2010-08-13 19:58 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-08-13 15:23 . 2010-08-13 15:34 33792 —-a-w- c:\windows\system32\drivers\rootrepeal.sys
2010-08-10 22:45 . 2010-08-10 22:45 ——– d—–w- C:\_OTL
2010-08-06 14:46 . 2010-08-06 14:46 ——– d—–w- c:\program files\CCleaner
2010-08-06 00:41 . 2010-08-06 00:41 388096 —-a-r- c:\users\Carolyn\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-08-06 00:37 . 2010-08-06 00:37 ——– d—–w- c:\program files\Trend Micro
2010-08-05 20:43 . 2010-08-05 20:43 ——– d—–w- c:\users\Carolyn\AppData\Roaming\Malwarebytes
2010-08-05 20:42 . 2010-04-29 19:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-05 20:42 . 2010-08-05 20:42 ——– d—–w- c:\programdata\Malwarebytes
2010-08-05 20:42 . 2010-04-29 19:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-08-05 20:42 . 2010-08-05 20:42 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-08-04 20:02 . 2010-08-04 20:02 ——– d—–w- c:\program files\MPC HomeCinema
2010-07-26 19:59 . 2010-08-06 14:49 ——– d—–w- c:\users\Carolyn\AppData\Roaming\Media Player Classic

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-13 00:04 . 2009-03-01 13:12 ——– d—–w- c:\programdata\Google Updater
2010-08-12 07:02 . 2008-08-30 00:47 ——– d—–w- c:\programdata\Microsoft Help
2010-08-12 07:01 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-06-28 16:17 . 2010-08-11 18:24 833024 —-a-w- c:\windows\system32\wininet.dll
2010-06-28 16:13 . 2010-08-11 18:24 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-06-26 07:02 . 2008-08-30 00:48 ——– d—–w- c:\program files\Microsoft.NET
2010-06-21 13:18 . 2010-08-11 18:24 2036736 —-a-w- c:\windows\system32\win32k.sys
2010-06-18 16:43 . 2010-08-11 18:24 36352 —-a-w- c:\windows\system32\rtutils.dll
2010-06-18 14:43 . 2010-08-11 18:24 302080 —-a-w- c:\windows\system32\drivers\srv.sys
2010-06-18 14:43 . 2010-08-11 18:24 144896 —-a-w- c:\windows\system32\drivers\srv2.sys
2010-06-16 15:59 . 2010-08-11 18:24 898952 —-a-w- c:\windows\system32\drivers\tcpip.sys
2010-06-11 20:51 . 2010-06-11 20:51 3055600 —-a-w- c:\users\Carolyn\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
2010-06-11 20:36 . 2010-06-11 20:36 275952 —-a-w- c:\users\Carolyn\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
2010-06-11 15:31 . 2010-08-11 18:24 274432 —-a-w- c:\windows\system32\schannel.dll
2010-06-11 15:30 . 2010-08-11 18:24 1257472 —-a-w- c:\windows\system32\msxml3.dll
2010-06-08 17:00 . 2010-08-11 18:24 3598216 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-06-08 17:00 . 2010-08-11 18:24 3545992 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-05-27 19:16 . 2010-08-11 18:24 81920 —-a-w- c:\windows\system32\iccvid.dll
2010-05-26 16:16 . 2010-06-09 13:22 34304 —-a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:25 . 2010-06-09 13:22 289792 —-a-w- c:\windows\system32\atmfd.dll
2010-07-03 22:13 . 2009-11-26 23:55 119808 —-a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2006-06-16 01:33 . 2010-02-10 16:21 233472 —-a-w- c:\program files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-25 23:43 . 2010-02-10 16:21 204895 —-a-w- c:\program files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 19:41 . 2010-02-10 16:21 77824 —-a-w- c:\program files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-06-19 18:10 . 2010-02-10 16:21 426081 —-a-w- c:\program files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 17:19 . 2010-02-10 16:20 458752 —-a-w- c:\program files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 23:35 . 2010-02-10 16:21 139264 —-a-w- c:\program files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 16:10 . 2010-02-10 16:20 204800 —-a-w- c:\program files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 16:42 . 2010-02-10 16:20 106496 —-a-w- c:\program files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 16:22 . 2010-02-10 16:20 212992 —-a-w- c:\program files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 16:21 . 2010-02-10 16:20 167936 —-a-w- c:\program files\mozilla firefox\plugins\RLVoiceUnpacker.dll
2010-02-10 16:21 . 2010-02-10 16:21 76 –sh–r- c:\windows\CT4CET.bin
2008-08-30 03:17 . 2008-08-30 03:16 8192 –sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-30 68856]
"Google Update"="c:\users\Carolyn\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-10-12 133104]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
"Creative Live! Cam Manager"="c:\program files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-06-07 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-05-04 167936]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-06 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-06 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-06 133656]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-05-19 3444736]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-03 30192]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-02 582992]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
"HostManager"="c:\program files\Common Files\AOL\1221177210\ee\AOLSoftware.exe" [2006-09-26 50736]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"SMARTSNMPAgent.exe"="c:\program files\SMART Technologies\SMART Board Drivers\SMARTSNMPAgent.exe" [2008-04-03 1008936]
"SMART Board Service"="c:\program files\SMART Technologies\SMART Board Drivers\SMARTBoardService.exe" [2008-04-03 2106664]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 177472]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2009-08-31 623960]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-07-08 236016]
"V0380Mon.exe"="c:\windows\V0380Mon.exe" [2007-04-05 32768]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

c:\users\Carolyn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2009-8-31 1799512]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-8-29 50688]
ImageMixer 3 SE Camera Monitor Ver.5.lnk - c:\program files\PIXELA\ImageMixer 3 SE Ver.5\Transfer Utility\CameraMonitor.exe [2009-12-25 253952]
SMART Board Tools.lnk - c:\program files\SMART Technologies\SMART Board Drivers\SMARTBoardTools.exe [2008-4-3 7197992]

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-08-30 00:57 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c99a6f84977b54;Google Update Service (gupdate1c99a6f84977b54);c:\program files\Google\Update\GoogleUpdate.exe [2009-03-01 133104]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-07-03 30192]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-11-12 73728]
S2 AEV0380;Creative Camera VF0380 APO service application;c:\windows\system32\V0380Aps.exe [2007-05-30 73728]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2008-03-06 111616]
S3 RLDesignVirtualAudioCableWdm;Live! Cam Virtual;c:\windows\system32\DRIVERS\livecamv.sys [2007-01-15 31616]

.
Contents of the 'Scheduled Tasks' folder

2010-08-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-30 20:44]

2010-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-01 13:13]

2010-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-01 13:13]

2010-08-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2805349893-152464557-784558142-1000Core.job
- c:\users\Carolyn\AppData\Local\Google\Update\GoogleUpdate.exe [2008-10-12 18:13]

2010-08-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2805349893-152464557-784558142-1000UA.job
- c:\users\Carolyn\AppData\Local\Google\Update\GoogleUpdate.exe [2008-10-12 18:13]

2010-05-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-08-30 18:32]

2010-07-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-08-30 18:32]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride =
FF - ProfilePath - c:\users\Carolyn\AppData\Roaming\Mozilla\Firefox\Profiles\7j5u7xrl.default\
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\users\Carolyn\AppData\Roaming\Mozilla\Firefox\Profiles\7j5u7xrl.default\extensions\[removed]\platform\WINNT\components\fotofox.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRLCT4Player.dll
FF - plugin: c:\program files\Photodex Presenter\npPxPlay.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\users\Carolyn\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\Carolyn\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\users\Carolyn\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\users\Carolyn\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-13 15:59
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-08-13 16:01:24
ComboFix-quarantined-files.txt 2010-08-13 20:01

Pre-Run: 109,038,141,440 bytes free
Post-Run: 108,970,717,184 bytes free

- - End Of File - - E77F90D42661920244E12466FAC82053
Post #14
Hello,

Malwarebytes' Anti-Malware

I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:

  • Open Malwarebytes' Anti-Malware
  • Select the Update tab
  • Click Check for Updates
  • After the update have been completed, Select the Scanner tab.
  • Select Perform quick scan, then click on Scan
  • Leave the default options as it is and click on Start Scan
  • When done, you will be prompted. Click OK, then click on Show Results
  • Checked (ticked) all items and click on Remove Selected
  • After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT:



Java Outdated
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "JDK 6 Update 21 (JDK or JRE)".
  • Click the "Download JRE" button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u21-windows-i586.exe to install the newest version.
  • If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  • When the Java Setup - Welcome window opens, click the Install > button.
  • If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
– Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
– Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note:
The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications.
To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
Click Ok and reboot your computer.


NEXT



Clean Java Cache & Temporary Files
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and AppletsTrace and Log Files
  • Click OK on Delete Temporary Files Window

    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.


NEXT:



Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer before continuing!***

  • Double-click on JavaRa.exe to start the program.
  • From the drop-down menu, choose English and click on Select.
  • JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  • Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  • A logfile will pop up. Please save it to a convenient location and post it in your next reply.


NEXT:



Kaspersky Online Scanner
Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply


NEXT:



Security Check
Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Post #15 last edited
Wow, thanks! Quite a few steps. I will try to get to them as quickly as possible. step one. it removed one "rogue" spyware. Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4430 Windows 6.0.6001 Service Pack 1 Internet Explorer 7.0.6001.18000 8/14/2010 8:28:39 PM mbam-log-2010-08-14 (20-28-39).txt Scan type: Quick scan Objects scanned: 141762 Time elapsed: 8 minute(s), 22 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\Software\SolutionAV (Rogue.AntivirSolutionPro) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Step two and three: New Java installed and Java cache cleaned successfully. Step four: JavaRa installed and run successfully. It removed about six old versions of Java; however, I cannot locate the log. Step five: I have been running the Kapersky log through Firefox for about five hours now. It is still doing an "update". You weren't kidding about needing patience :) Update: The Kapersky scan is still running after 11 hours. I'm going to x-out and try it through IE. Update II: Kasperky won't run through IE. I tried it again through Firefox and it told me that I needed to run it as an administrator. I opened Firefox as an administrator, but then Java wasn't supported and Kaspersky wouldn't run once again. Update III: The Kaspersky scan is now running through Firefox. It started approx 10AM eastern standard. Any idea on how many hours it may take? Thanks.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI