What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

AntiVir Solution Pro

25 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #18
Hi jhess23a,

Lets start by getting a fresh OTL log.

Please open OTL. If you have removed it from your system in the time you have been gone, here are the download links:
  • LINK 1
  • LINK 2
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Under the Custom Scan box paste this in;

    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %PROGRAMFILES%\Internet Explorer\*.dat
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them if you need to start a new topic.
Post #19 last edited
Step Five:


——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, August 25, 2010
Operating system: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, August 25, 2010 06:17:19
Records in database: 4143456
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Objects scanned: 172170
Threats found: 1
Infected objects found: 1
Suspicious objects found: 0
Scan duration: 02:46:37


File name / Threat / Threats count
C:\Program Files\muvee Technologies\muveeNow 2.0 - Creative\muveeapp.exe Infected: Trojan-Dropper.Win32.Delf.eal 1

Selected area has been scanned.

Step Six:


Results of screen317's Security Check version 0.99.5
Windows Vista Service Pack 1 (UAC is enabled)
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
McAfee SecurityCenter
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
CCleaner
Java™ 6 Update 21
Adobe Flash Player 10.0.22.87
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Out of date Adobe Reader installed!
Mozilla Firefox (3.0.19) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
McAfee VIRUSS~1 mcshield.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````
Post #20
Oh shoot. I've been editing a post on page one of this thread. Foolishly I never noticed that you had requested a new OTL log. I will do so, but you can see that I completed the Kaspersky scan above.
Post #21 last edited
I ran the program twice, once from the desktop and once from the Downloads folder. It did not produce an "Extras" file either time.

OTL logfile created on: 8/25/2010 9:06:29 PM - Run 3
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Carolyn\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 45.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 74.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 220.58 Gb Total Space | 97.94 Gb Free Space | 44.40% Space Free | Partition Type: NTFS
Drive D: | 9.77 Gb Total Space | 4.98 Gb Free Space | 51.02% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CAROLYN-PC
Current User Name: Carolyn
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/08/25 20:45:33 | 000,869,051 | —- | M] () – C:\Users\Carolyn\Desktop\SecurityCheck.exe
PRC - [2010/08/17 21:58:17 | 000,945,720 | —- | M] (Google Inc.) – C:\Users\Carolyn\AppData\Local\Google\Chrome\Application\chrome.exe
PRC - [2010/08/07 17:53:39 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\Carolyn\Downloads\OTL.exe
PRC - [2010/07/03 18:13:40 | 000,030,192 | —- | M] (Google) – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
PRC - [2010/06/18 20:17:27 | 000,134,808 | —- | M] (Google Inc.) – C:\Users\Carolyn\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe
PRC - [2010/06/16 17:14:51 | 000,134,808 | —- | M] (Google Inc.) – C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
PRC - [2009/08/31 12:25:16 | 000,623,960 | —- | M] (Research In Motion Limited) – C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
PRC - [2009/02/26 15:24:50 | 000,097,680 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
PRC - [2008/10/29 02:29:41 | 002,927,104 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/10/24 10:14:36 | 000,206,112 | —- | M] (Macrovision Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
PRC - [2008/09/24 23:10:56 | 000,253,952 | —- | M] (PIXELA CORPORATION) – C:\Program Files\PIXELA\ImageMixer 3 SE Ver.5\Transfer Utility\CameraMonitor.exe
PRC - [2008/08/29 20:50:31 | 000,068,856 | —- | M] (Google Inc.) – C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2008/05/13 17:33:10 | 001,058,088 | —- | M] (Stardock Corporation) – C:\Program Files\Dell\DellDock\DellDock.exe
PRC - [2008/05/04 05:25:32 | 000,040,960 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\DellTPad\hidfind.exe
PRC - [2008/05/04 05:25:26 | 000,167,936 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\DellTPad\Apoint.exe
PRC - [2008/05/04 05:25:26 | 000,050,736 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\DellTPad\ApMsgFwd.exe
PRC - [2008/05/04 05:25:26 | 000,049,152 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\DellTPad\ApntEx.exe
PRC - [2008/04/28 17:56:28 | 000,161,048 | —- | M] (Stardock Corporation) – C:\Program Files\Dell\DellDock\DockLogin.exe
PRC - [2008/04/03 04:14:42 | 001,008,936 | —- | M] (SMART Technologies Inc.) – C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTSNMPAgent.exe
PRC - [2008/04/03 04:14:12 | 007,197,992 | —- | M] (SMART Technologies Inc.) – C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardTools.exe
PRC - [2008/04/03 04:13:58 | 005,469,480 | —- | M] (SMART Technologies Inc.) – C:\Program Files\SMART Technologies\SMART Board Drivers\Marker.exe
PRC - [2008/04/03 04:13:52 | 002,258,216 | —- | M] (SMART Technologies Inc.) – C:\Program Files\SMART Technologies\SMART Board Drivers\Aware.exe
PRC - [2008/04/03 04:13:48 | 002,106,664 | —- | M] (SMART Technologies) – C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardService.exe
PRC - [2008/01/25 02:38:12 | 002,458,128 | —- | M] (McAfee, Inc.) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
PRC - [2008/01/20 22:25:32 | 000,198,656 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
PRC - [2008/01/20 22:25:31 | 000,300,032 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
PRC - [2008/01/20 22:23:40 | 000,244,224 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wisptis.exe
PRC - [2008/01/09 17:50:22 | 000,767,976 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\MSC\mcmscsvc.exe
PRC - [2007/12/21 11:58:06 | 000,184,320 | —- | M] (CyberLink Corp.) – C:\Program Files\Dell\MediaDirect\PCMService.exe
PRC - [2007/12/11 13:33:42 | 000,358,224 | —- | M] (McAfee, Inc.) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
PRC - [2007/11/26 11:46:14 | 000,023,880 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\MSK\msksrver.exe
PRC - [2007/11/12 07:07:20 | 000,102,400 | —- | M] (IDT, Inc.) – C:\Windows\System32\stacsv.exe
PRC - [2007/11/12 07:07:16 | 000,073,728 | —- | M] (Andrea Electronics Corporation) – C:\Windows\System32\AEstSrv.exe
PRC - [2007/11/01 20:12:38 | 000,582,992 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2007/11/01 20:12:38 | 000,265,040 | —- | M] (McAfee, Inc.) – c:\Program Files\McAfee\MSC\mcuimgr.exe
PRC - [2007/07/24 13:02:14 | 000,144,704 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\VirusScan\Mcshield.exe
PRC - [2007/07/18 16:54:42 | 000,856,864 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\MPF\MpfSrv.exe
PRC - [2007/06/07 15:01:38 | 000,155,648 | —- | M] (Creative Technology Ltd.) – C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
PRC - [2007/05/29 23:50:06 | 000,073,728 | —- | M] (Creative Technology Ltd.) – C:\Windows\System32\V0380Aps.exe
PRC - [2007/04/05 02:08:08 | 000,032,768 | —- | M] (Creative Technology Ltd.) – C:\Windows\V0380Mon.exe
PRC - [2007/03/21 14:00:04 | 000,355,096 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007/03/21 14:00:00 | 000,174,872 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2006/11/03 19:02:14 | 000,050,688 | —- | M] (Avanquest Software ) – C:\Program Files\Digital Line Detect\DLG.exe
PRC - [2006/11/02 08:36:17 | 000,138,752 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Photo Gallery\WindowsPhotoGallery.exe
PRC - [2006/10/23 08:50:35 | 000,046,640 | R— | M] (AOL LLC) – C:\Program Files\Common Files\aol\acs\AOLacsd.exe
PRC - [2006/09/25 20:52:48 | 000,050,736 | —- | M] (America Online, Inc.) – C:\Program Files\Common Files\aol\1221177210\ee\aolsoftware.exe


========== Modules (SafeList) ==========

MOD - [2010/08/07 17:53:39 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\Carolyn\Downloads\OTL.exe
MOD - [2008/01/20 22:25:29 | 000,380,416 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
MOD - [2008/01/20 22:24:37 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msscript.ocx
MOD - [2008/01/20 22:23:44 | 001,684,480 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/07/03 18:13:40 | 000,030,192 | —- | M] (Google) [On_Demand | Stopped] – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe – (GoogleDesktopManager-051210-111108)
SRV - [2010/03/18 13:16:28 | 000,753,504 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe – (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2008/08/29 20:57:40 | 000,016,680 | —- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe – (GoToAssist)
SRV - [2008/04/28 17:56:28 | 000,161,048 | —- | M] (Stardock Corporation) [Auto | Running] – C:\Program Files\Dell\DellDock\DockLogin.exe – (DockLoginService)
SRV - [2008/01/25 02:38:12 | 002,458,128 | —- | M] (McAfee, Inc.) [Auto | Running] – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe – (McNASvc)
SRV - [2008/01/20 22:23:32 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2008/01/09 17:50:22 | 000,767,976 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\MSC\mcmscsvc.exe – (mcmscsvc)
SRV - [2007/12/11 13:33:42 | 000,358,224 | —- | M] (McAfee, Inc.) [Auto | Running] – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe – (McProxy)
SRV - [2007/12/05 11:04:10 | 000,695,624 | —- | M] (McAfee, Inc.) [Disabled | Stopped] – C:\Program Files\McAfee\VirusScan\mcsysmon.exe – (McSysmon)
SRV - [2007/11/26 11:46:14 | 000,023,880 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\MSK\MskSrver.exe – (MSK80Service)
SRV - [2007/11/12 07:07:20 | 000,102,400 | —- | M] (IDT, Inc.) [Auto | Running] – C:\Windows\System32\stacsv.exe – (STacSV)
SRV - [2007/11/12 07:07:16 | 000,073,728 | —- | M] (Andrea Electronics Corporation) [Auto | Running] – C:\Windows\System32\AEstSrv.exe – (AESTFilters)
SRV - [2007/11/07 10:35:40 | 000,378,184 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee\VirusScan\mcods.exe – (McODS)
SRV - [2007/07/24 13:02:14 | 000,144,704 | —- | M] (McAfee, Inc.) [Unknown | Running] – C:\Program Files\McAfee\VirusScan\Mcshield.exe – (McShield)
SRV - [2007/07/18 16:54:42 | 000,856,864 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\MPF\MPFSrv.exe – (MpfService)
SRV - [2007/05/29 23:50:06 | 000,073,728 | —- | M] (Creative Technology Ltd.) [Auto | Running] – C:\Windows\System32\V0380Aps.exe – (AEV0380)
SRV - [2007/03/21 14:00:04 | 000,355,096 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe – (IAANTMON) Intel®
SRV - [2006/10/23 08:50:35 | 000,046,640 | R— | M] (AOL LLC) [Auto | Running] – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe – (AOL ACS)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\Carolyn\AppData\Local\Temp\catchme.sys – (catchme)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\BCM42RLY.sys – (BCM42RLY)
DRV - [2010/04/29 15:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mbamswissarmy.sys – (MBAMSwissArmy)
DRV - [2008/06/23 08:45:44 | 000,008,704 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)
DRV - [2008/06/23 08:45:40 | 000,980,992 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\HSX_DPV.sys – (HSF_DPV)
DRV - [2008/06/23 08:45:40 | 000,661,504 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\HSX_CNXT.sys – (winachsf)
DRV - [2008/06/23 08:45:38 | 000,208,384 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\HSXHWAZL.sys – (HSXHWAZL)
DRV - [2008/05/19 02:26:02 | 001,044,984 | —- | M] (Broadcom Corp.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\BCMWL6.SYS – (BCM43XX)
DRV - [2008/05/04 05:25:24 | 000,164,400 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Apfiltr.sys – (ApfiltrService)
DRV - [2008/04/03 01:54:42 | 000,014,120 | —- | M] (SMART Technologies ULC) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SMARTVHidMini2000x86.sys – (SMARTVHidMini2000x86)
DRV - [2008/04/03 01:54:38 | 000,011,048 | —- | M] (SMART Technologies ULC) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SMARTMouseFilterx86.sys – (SMARTMouseFilterx86)
DRV - [2008/04/03 01:54:34 | 000,016,808 | —- | M] (SMART Technologies ULC) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SMARTVTabletPCx86.sys – (SMARTVTabletPCx86)
DRV - [2008/03/06 03:58:44 | 000,111,616 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\IntcHdmi.sys – (IntcHdmiAddService) Intel®
DRV - [2008/03/06 03:58:12 | 002,016,256 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\igdkmd32.sys – (igfx)
DRV - [2008/01/20 22:23:27 | 000,386,616 | —- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasr.sys – (MegaSR)
DRV - [2008/01/20 22:23:27 | 000,149,560 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu320.sys – (adpu320)
DRV - [2008/01/20 22:23:27 | 000,031,288 | —- | M] (LSI Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasas.sys – (megasas)
DRV - [2008/01/20 22:23:26 | 000,101,432 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu160m.sys – (adpu160m)
DRV - [2008/01/20 22:23:26 | 000,074,808 | —- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid4.sys – (SiSRaid4)
DRV - [2008/01/20 22:23:26 | 000,040,504 | —- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\hpcisss.sys – (HpCISSs)
DRV - [2008/01/20 22:23:25 | 000,300,600 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpahci.sys – (adpahci)
DRV - [2008/01/20 22:23:25 | 000,220,672 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2008/01/20 22:23:25 | 000,089,656 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_sas.sys – (LSI_SAS)
DRV - [2008/01/20 22:23:24 | 001,122,360 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql2300.sys – (ql2300)
DRV - [2008/01/20 22:23:24 | 000,118,784 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\E1G60I32.sys – (E1G60) Intel®
DRV - [2008/01/20 22:23:24 | 000,079,928 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arcsas.sys – (arcsas)
DRV - [2008/01/20 22:23:23 | 000,235,064 | —- | M] (Intel Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iastorv.sys – (iaStorV)
DRV - [2008/01/20 22:23:23 | 000,130,616 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\vsmraid.sys – (vsmraid)
DRV - [2008/01/20 22:23:23 | 000,115,816 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata2.sys – (ulsata2)
DRV - [2008/01/20 22:23:23 | 000,096,312 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_scsi.sys – (LSI_SCSI)
DRV - [2008/01/20 22:23:23 | 000,096,312 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_fc.sys – (LSI_FC)
DRV - [2008/01/20 22:23:23 | 000,079,416 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arc.sys – (arc)
DRV - [2008/01/20 22:23:22 | 000,342,584 | —- | M] (Emulex) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\elxstor.sys – (elxstor)
DRV - [2008/01/20 22:23:21 | 000,422,968 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adp94xx.sys – (adp94xx)
DRV - [2008/01/20 22:23:21 | 000,102,968 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvraid.sys – (nvraid)
DRV - [2008/01/20 22:23:21 | 000,073,088 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\USBAUDIO.sys – (usbaudio) USB Audio Driver (WDM)
DRV - [2008/01/20 22:23:21 | 000,045,112 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvstor.sys – (nvstor)
DRV - [2008/01/20 22:23:20 | 000,238,648 | —- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\uliahci.sys – (uliahci)
DRV - [2008/01/20 22:23:00 | 000,020,024 | —- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\viaide.sys – (viaide)
DRV - [2008/01/20 22:23:00 | 000,019,000 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\cmdide.sys – (cmdide)
DRV - [2008/01/20 22:23:00 | 000,017,464 | —- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\aliide.sys – (aliide)
DRV - [2007/12/02 13:51:42 | 000,040,488 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfesmfk.sys – (mfesmfk)
DRV - [2007/11/22 07:44:08 | 000,201,320 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\mfehidk.sys – (mfehidk)
DRV - [2007/11/22 07:44:08 | 000,079,304 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mfeavfk.sys – (mfeavfk)
DRV - [2007/11/22 07:44:08 | 000,035,240 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mfebopk.sys – (mfebopk)
DRV - [2007/11/22 07:44:04 | 000,033,832 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mferkdk.sys – (mferkdk)
DRV - [2007/11/12 07:07:28 | 000,330,240 | —- | M] (IDT, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2007/09/29 01:31:54 | 000,278,528 | —- | M] (Marvell) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\yk60x86.sys – (yukonwlh)
DRV - [2007/09/06 12:43:26 | 000,304,920 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\iastor.sys – (iaStor)
DRV - [2007/09/06 12:35:16 | 000,037,376 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rixdptsk.sys – (rismxdp)
DRV - [2007/09/06 12:35:14 | 000,039,936 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimmptsk.sys – (rimmptsk)
DRV - [2007/09/06 12:35:12 | 000,042,496 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimsptsk.sys – (rimsptsk)
DRV - [2007/07/13 07:21:12 | 000,125,728 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\Mpfp.sys – (MPFP)
DRV - [2007/07/02 21:00:02 | 000,273,152 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\V0380Vid.sys – (V0380Dev)
DRV - [2007/01/15 18:57:08 | 000,031,616 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\livecamv.sys – (RLDesignVirtualAudioCableWdm)
DRV - [2006/12/05 01:37:46 | 000,007,168 | —- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\V0380Vfx.sys – (V0380Vfx)
DRV - [2006/11/02 05:50:35 | 000,106,088 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql40xx.sys – (ql40xx)
DRV - [2006/11/02 05:50:35 | 000,098,408 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata.sys – (UlSata)
DRV - [2006/11/02 05:50:19 | 000,045,160 | —- | M] (IBM Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nfrd960.sys – (nfrd960)
DRV - [2006/11/02 05:50:17 | 000,041,576 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iirsp.sys – (iirsp)
DRV - [2006/11/02 05:50:11 | 000,071,272 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\djsvs.sys – (aic78xx)
DRV - [2006/11/02 05:50:09 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteraid.sys – (iteraid)
DRV - [2006/11/02 05:50:07 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteatapi.sys – (iteatapi)
DRV - [2006/11/02 05:50:05 | 000,035,944 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\symc8xx.sys – (Symc8xx)
DRV - [2006/11/02 05:50:03 | 000,034,920 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_u3.sys – (Sym_u3)
DRV - [2006/11/02 05:49:59 | 000,033,384 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\mraid35x.sys – (Mraid35x)
DRV - [2006/11/02 05:49:56 | 000,031,848 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_hi.sys – (Sym_hi)
DRV - [2006/11/02 04:25:24 | 000,071,808 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 04:24:47 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brusbser.sys – (BrUsbSer)
DRV - [2006/11/02 04:24:46 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltup.sys – (BrFiltUp)
DRV - [2006/11/02 04:24:45 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltlo.sys – (BrFiltLo)
DRV - [2006/11/02 04:24:44 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserwdm.sys – (BrSerWdm)
DRV - [2006/11/02 04:24:44 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brusbmdm.sys – (BrUsbMdm)
DRV - [2006/11/02 03:36:50 | 000,020,608 | —- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ntrigdigi.sys – (ntrigdigi)
DRV - [2006/11/02 03:36:43 | 002,028,032 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2006/11/01 16:18:15 | 000,033,588 | —- | M] (America Online, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wanatw4.sys – (wanatw) WAN Miniport (ATW)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: [removed]:1.1
FF - prefs.js..extensions.enabledItems: [removed]:7

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/25 09:57:30 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/25 09:57:30 | 000,000,000 | —D | M]

[2008/10/09 21:08:40 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\Mozilla\Extensions
[2010/08/25 10:13:04 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\Mozilla\Firefox\Profiles\7j5u7xrl.default\extensions
[2009/09/08 20:44:46 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Carolyn\AppData\Roaming\Mozilla\Firefox\Profiles\7j5u7xrl.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2008/10/12 09:00:19 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\Mozilla\Firefox\Profiles\7j5u7xrl.default\extensions\[removed]
[2010/08/25 10:13:04 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/08/24 08:04:47 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2008/11/04 13:20:41 | 000,000,000 | —D | M] (Smart Notebook Extension) – C:\Program Files\Mozilla Firefox\extensions\{D6D05E6F-D5C1-4e03-8E33-73F92B05E262}
[2010/08/24 08:04:04 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2008/09/15 11:52:06 | 000,376,832 | —- | M] ( ) – C:\Program Files\Mozilla Firefox\plugins\npsnapfish.dll

O1 HOSTS File: ([2010/08/13 15:58:58 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (McAfee Phishing Filter) - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\Program Files\McAfee\MSK\mcapbho.dll ()
O2 - BHO: (CIEDownload Object) - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Program Files\SMART Technologies\Notebook Software\NotebookPlugin.dll (SMART Technologies ULC.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\aol\1221177210\ee\aolsoftware.exe (America Online, Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SMART Board Service] C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardService.exe (SMART Technologies)
O4 - HKLM..\Run: [SMARTSNMPAgent.exe] C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTSNMPAgent.exe (SMART Technologies Inc.)
O4 - HKLM..\Run: [V0380Mon.exe] C:\Windows\V0380Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Creative Live! Cam Manager] C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe (Creative Technology Ltd.)
O4 - HKCU..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Users\Carolyn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Carolyn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} http://www.kodakgallery.com/downloads/BUM/…_2/axofupld.cab (Kodak Gallery Easy Upload Manager Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} http://www.photodex.com/pxplay.cab (Photodex Presenter AX control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\Carolyn\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Carolyn\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/10 12:27:33 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…com [@ = ComFile] – Reg Error: Key error. File not found
O37 - HKCU\…exe [@ = exefile] – Reg Error: Key error. File not found

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 90 Days ==========

[2010/08/25 20:52:59 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\Carolyn\Desktop\OTL (1).exe
[2010/08/25 09:58:46 | 000,000,000 | —D | C] – C:\Windows\Sun
[2010/08/24 08:09:41 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/08/24 08:09:40 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/08/13 16:01:28 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2010/08/13 15:46:54 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2010/08/13 15:46:54 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2010/08/13 15:46:54 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2010/08/13 15:46:49 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/08/13 15:46:28 | 000,000,000 | —D | C] – C:\Qoobox
[2010/08/13 15:46:08 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010/08/10 18:45:17 | 000,000,000 | —D | C] – C:\_OTL
[2010/08/06 10:46:03 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/08/05 20:37:37 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/08/05 18:25:25 | 000,000,000 | —D | C] – C:\Users\Carolyn\Desktop\Virus Scans
[2010/08/05 16:43:03 | 000,000,000 | —D | C] – C:\Users\Carolyn\AppData\Roaming\Malwarebytes
[2010/08/05 16:42:37 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/08/05 16:42:36 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/08/05 16:42:36 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/08/05 16:42:35 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/08/04 16:02:16 | 000,000,000 | —D | C] – C:\Program Files\MPC HomeCinema
[2010/07/26 15:59:28 | 000,000,000 | —D | C] – C:\Users\Carolyn\AppData\Roaming\Media Player Classic
[2010/07/10 10:27:43 | 000,000,000 | —D | C] – C:\Users\Carolyn\Documents\IMG_0239
[2010/07/01 20:42:13 | 000,000,000 | —D | C] – C:\Users\Carolyn\Documents\IMGP6763
[2010/06/21 15:50:18 | 000,000,000 | —D | C] – C:\Users\Carolyn\Documents\MarkandCarolynEngagementAnnouncement
[2010/05/29 22:06:58 | 000,000,000 | —D | C] – C:\Users\Carolyn\Documents\IMG_3592[1]
[4 C:\Users\Carolyn\Documents\*.tmp files -> C:\Users\Carolyn\Documents\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/08/25 21:08:06 | 002,359,296 | -HS- | M] () – C:\Users\Carolyn\NTUSER.DAT
[2010/08/25 20:53:05 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Carolyn\Desktop\OTL (1).exe
[2010/08/25 20:45:37 | 000,003,744 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/08/25 20:45:37 | 000,003,744 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/08/25 20:45:33 | 000,869,051 | —- | M] () – C:\Users\Carolyn\Desktop\SecurityCheck.exe
[2010/08/25 20:22:00 | 000,000,916 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2805349893-152464557-784558142-1000UA.job
[2010/08/25 20:22:00 | 000,000,864 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2805349893-152464557-784558142-1000Core.job
[2010/08/25 20:20:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/08/25 17:20:00 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/08/25 13:16:10 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/08/25 09:50:52 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/08/25 09:15:23 | 000,703,388 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/08/25 09:15:23 | 000,604,502 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/08/25 09:15:23 | 000,104,170 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/08/25 08:12:47 | 000,021,141 | —- | M] () – C:\Windows\System32\Config.MPF
[2010/08/25 07:30:32 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/08/25 07:30:26 | 3210,784,768 | -HS- | M] () – C:\hiberfil.sys
[2010/08/24 23:25:22 | 000,524,288 | -HS- | M] () – C:\Users\Carolyn\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2010/08/24 23:25:22 | 000,065,536 | -HS- | M] () – C:\Users\Carolyn\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/08/24 23:25:10 | 000,023,817 | —- | M] () – C:\Users\Carolyn\Documents\Daily Routine.docx
[2010/08/24 23:25:06 | 003,937,897 | -H– | M] () – C:\Users\Carolyn\AppData\Local\IconCache.db
[2010/08/24 08:13:58 | 000,156,329 | —- | M] () – C:\Users\Carolyn\Desktop\JavaRa.zip
[2010/08/23 08:15:25 | 000,002,054 | —- | M] () – C:\Users\Carolyn\Desktop\Google Chrome.lnk
[2010/08/23 08:15:25 | 000,002,016 | —- | M] () – C:\Users\Carolyn\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/08/15 01:00:00 | 000,000,356 | —- | M] () – C:\Windows\tasks\McDefragTask.job
[2010/08/13 15:59:04 | 000,000,215 | —- | M] () – C:\Windows\system.ini
[2010/08/13 15:58:58 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/08/13 15:45:28 | 003,816,958 | R— | M] () – C:\Users\Carolyn\Desktop\ComboFix.exe
[2010/08/13 11:34:12 | 000,033,792 | —- | M] () – C:\Windows\System32\drivers\rootrepeal.sys
[2010/08/13 11:22:56 | 000,132,096 | —- | M] () – C:\Users\Carolyn\Desktop\RootRepeal.exe
[2010/08/12 21:30:52 | 000,010,037 | —- | M] () – C:\Users\Carolyn\Documents\She remembers….docx
[2010/08/12 16:09:11 | 000,457,038 | —- | M] () – C:\Users\Carolyn\Documents\IMG00155.jpg
[2010/08/12 11:12:30 | 000,000,734 | —- | M] () – C:\Users\Carolyn\.powerschool_gradebook.properties
[2010/08/12 03:11:32 | 000,317,624 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/08/10 22:45:53 | 000,530,507 | —- | M] () – C:\Users\Carolyn\Documents\IMG00156.jpg
[2010/08/10 19:27:22 | 000,293,376 | —- | M] () – C:\Users\Carolyn\Desktop\b6fxftbu.exe
[2010/08/06 20:44:41 | 000,010,410 | —- | M] () – C:\Users\Carolyn\Documents\Nanny E-mail.docx
[2010/08/06 10:46:05 | 000,000,806 | —- | M] () – C:\Users\Carolyn\Desktop\CCleaner.lnk
[2010/08/05 20:52:54 | 000,002,527 | —- | M] () – C:\Users\Carolyn\Desktop\HiJackThis.lnk
[2010/08/05 16:42:40 | 000,000,820 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/04 16:02:18 | 000,000,772 | —- | M] () – C:\Users\Public\Desktop\Media Player Classic - Home Cinema.lnk
[2010/08/02 22:27:35 | 000,524,288 | -HS- | M] () – C:\Users\Carolyn\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/07/31 21:56:56 | 000,011,888 | —- | M] () – C:\Users\Carolyn\Documents\Lake House.docx
[2010/07/29 15:33:05 | 000,599,699 | —- | M] () – C:\Users\Carolyn\Documents\IMG00148.jpg
[2010/07/10 10:27:43 | 000,555,451 | —- | M] () – C:\Users\Carolyn\Documents\IMG_0239.zip
[2010/07/01 20:42:13 | 000,303,693 | —- | M] () – C:\Users\Carolyn\Documents\IMGP6763.zip
[2010/07/01 00:59:59 | 000,000,348 | —- | M] () – C:\Windows\tasks\McQcTask.job
[2010/06/30 14:23:46 | 000,151,552 | —- | M] () – C:\Users\Carolyn\Documents\LauraandBenjamin.doc
[2010/06/30 14:21:25 | 000,100,352 | —- | M] () – C:\Users\Carolyn\Documents\WesHitchcockprofilepics.doc
[2010/06/30 14:11:19 | 000,644,885 | —- | M] () – C:\Users\Carolyn\Documents\IMG00122.jpg
[2010/06/29 13:40:45 | 004,065,372 | —- | M] () – C:\Users\Carolyn\Documents\LoaderBackup-(2010-06-29).ipd
[2010/06/24 20:54:58 | 000,012,294 | —- | M] () – C:\Users\Carolyn\Documents\Reservation Confirmation.docx
[2010/06/21 15:50:18 | 003,946,287 | —- | M] () – C:\Users\Carolyn\Documents\MarkandCarolynEngagementAnnouncement.zip
[2010/06/08 21:33:15 | 000,574,268 | —- | M] () – C:\Users\Carolyn\Documents\IMG00116.jpg
[2010/05/29 22:06:58 | 006,404,050 | —- | M] () – C:\Users\Carolyn\Documents\IMG_3592[1].zip
[4 C:\Users\Carolyn\Documents\*.tmp files -> C:\Users\Carolyn\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/25 20:45:16 | 000,869,051 | —- | C] () – C:\Users\Carolyn\Desktop\SecurityCheck.exe
[2010/08/24 08:13:58 | 000,156,329 | —- | C] () – C:\Users\Carolyn\Desktop\JavaRa.zip
[2010/08/13 15:46:54 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2010/08/13 15:46:54 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2010/08/13 15:46:54 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2010/08/13 15:46:54 | 000,077,312 | —- | C] () – C:\Windows\MBR.exe
[2010/08/13 15:46:54 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2010/08/13 15:45:22 | 003,816,958 | R— | C] () – C:\Users\Carolyn\Desktop\ComboFix.exe
[2010/08/13 11:46:22 | 3210,784,768 | -HS- | C] () – C:\hiberfil.sys
[2010/08/13 11:23:16 | 000,033,792 | —- | C] () – C:\Windows\System32\drivers\rootrepeal.sys
[2010/08/13 11:22:55 | 000,132,096 | —- | C] () – C:\Users\Carolyn\Desktop\RootRepeal.exe
[2010/08/12 21:30:29 | 000,010,037 | —- | C] () – C:\Users\Carolyn\Documents\She remembers….docx
[2010/08/12 16:09:06 | 000,457,038 | —- | C] () – C:\Users\Carolyn\Documents\IMG00155.jpg
[2010/08/10 22:45:50 | 000,530,507 | —- | C] () – C:\Users\Carolyn\Documents\IMG00156.jpg
[2010/08/10 19:27:22 | 000,293,376 | —- | C] () – C:\Users\Carolyn\Desktop\b6fxftbu.exe
[2010/08/06 10:46:05 | 000,000,806 | —- | C] () – C:\Users\Carolyn\Desktop\CCleaner.lnk
[2010/08/05 20:37:38 | 000,002,527 | —- | C] () – C:\Users\Carolyn\Desktop\HiJackThis.lnk
[2010/08/05 16:42:40 | 000,000,820 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/04 16:02:18 | 000,000,772 | —- | C] () – C:\Users\Public\Desktop\Media Player Classic - Home Cinema.lnk
[2010/07/31 21:57:15 | 000,010,410 | —- | C] () – C:\Users\Carolyn\Documents\Nanny E-mail.docx
[2010/07/31 21:56:54 | 000,011,888 | —- | C] () – C:\Users\Carolyn\Documents\Lake House.docx
[2010/07/29 15:33:03 | 000,599,699 | —- | C] () – C:\Users\Carolyn\Documents\IMG00148.jpg
[2010/07/10 10:27:41 | 000,555,451 | —- | C] () – C:\Users\Carolyn\Documents\IMG_0239.zip
[2010/07/01 20:42:12 | 000,303,693 | —- | C] () – C:\Users\Carolyn\Documents\IMGP6763.zip
[2010/06/30 14:23:46 | 000,151,552 | —- | C] () – C:\Users\Carolyn\Documents\LauraandBenjamin.doc
[2010/06/30 14:21:24 | 000,100,352 | —- | C] () – C:\Users\Carolyn\Documents\WesHitchcockprofilepics.doc
[2010/06/30 14:11:16 | 000,644,885 | —- | C] () – C:\Users\Carolyn\Documents\IMG00122.jpg
[2010/06/29 13:40:45 | 004,065,372 | —- | C] () – C:\Users\Carolyn\Documents\LoaderBackup-(2010-06-29).ipd
[2010/06/24 20:54:57 | 000,012,294 | —- | C] () – C:\Users\Carolyn\Documents\Reservation Confirmation.docx
[2010/06/21 15:50:10 | 003,946,287 | —- | C] () – C:\Users\Carolyn\Documents\MarkandCarolynEngagementAnnouncement.zip
[2010/06/08 21:31:23 | 000,574,268 | —- | C] () – C:\Users\Carolyn\Documents\IMG00116.jpg
[2010/05/29 22:06:31 | 006,404,050 | —- | C] () – C:\Users\Carolyn\Documents\IMG_3592[1].zip
[2010/02/10 12:18:24 | 000,031,616 | —- | C] () – C:\Windows\System32\drivers\livecamv.sys
[2009/08/03 16:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2008/08/29 23:21:43 | 001,953,696 | —- | C] () – C:\Windows\System32\igklg400.dll
[2008/08/29 23:21:43 | 001,533,360 | —- | C] () – C:\Windows\System32\igklg450.dll
[2008/08/29 23:21:43 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1409.dll
[2008/08/29 23:21:43 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2008/08/29 23:21:43 | 000,004,608 | —- | C] () – C:\Windows\System32\HdmiCoin.dll
[2008/08/29 23:21:40 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
[2008/08/29 20:44:20 | 000,054,784 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2006/11/02 08:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 03:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini

========== LOP Check ==========

[2009/12/31 23:29:52 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\Netscape
[2009/08/10 16:48:43 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\PeerNetworking
[2009/11/15 19:51:00 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\Research In Motion
[2008/11/04 13:17:14 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\SMART Technologies
[2008/11/04 13:21:32 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\SMART Technologies Inc
[2009/03/21 06:56:21 | 000,000,000 | —D | M] – C:\Users\Carolyn\AppData\Roaming\Snapfish
[2010/08/15 01:00:00 | 000,000,356 | —- | M] () – C:\Windows\Tasks\McDefragTask.job
[2010/07/01 00:59:59 | 000,000,348 | —- | M] () – C:\Windows\Tasks\McQcTask.job
[2010/08/24 23:25:25 | 000,032,592 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/02/10 12:27:33 | 000,000,074 | —- | M] () – C:\autoexec.bat
[2008/01/20 22:24:42 | 000,333,203 | RHS- | M] () – C:\bootmgr
[2010/08/13 16:01:24 | 000,014,721 | —- | M] () – C:\ComboFix.txt
[2006/09/18 17:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2010/02/10 11:49:59 | 000,000,194 | —- | M] () – C:\CtDrvIns.log
[2010/02/10 11:49:59 | 000,005,899 | —- | M] () – C:\CtDrvStp.log
[2008/08/29 23:21:53 | 000,003,783 | RH– | M] () – C:\dell.sdr
[2010/08/25 07:30:26 | 3210,784,768 | -HS- | M] () – C:\hiberfil.sys
[2009/01/03 19:54:01 | 000,000,628 | -H– | M] () – C:\IPH.PH
[2008/08/29 20:44:17 | 000,026,927 | —- | M] () – C:\newfile.enc
[2008/08/29 20:44:17 | 000,026,927 | —- | M] () – C:\newkey
[2010/08/25 07:30:24 | 3524,587,520 | -HS- | M] () – C:\pagefile.sys
[2010/02/10 12:21:29 | 000,000,174 | —- | M] () – C:\Setup.log
[2008/08/29 21:01:22 | 000,000,071 | —- | M] () – C:\SystemInfo.ini
[2008/09/11 19:52:09 | 000,000,376 | -H– | M] () – C:\T4Metrics.log

< %systemroot%\Fonts\*.com >
[2006/11/02 08:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 08:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 08:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 08:37:12 | 000,030,808 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 17:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/01/20 22:23:14 | 000,089,600 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 08:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 22:43:21 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/01/20 23:14:18 | 016,846,848 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 23:14:08 | 000,106,496 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 23:14:18 | 000,020,480 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 06:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 06:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/11/15 19:38:37 | 000,000,574 | -HS- | M] () – C:\Users\Carolyn\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/08/10 19:27:22 | 000,293,376 | —- | M] () – C:\Users\Carolyn\Desktop\b6fxftbu.exe
[2010/08/13 15:45:28 | 003,816,958 | R— | M] () – C:\Users\Carolyn\Desktop\ComboFix.exe
[2010/08/24 07:50:39 | 016,062,240 | —- | M] (Sun Microsystems, Inc.) – C:\Users\Carolyn\Desktop\jre-6u21-windows-i586.exe
[2010/08/25 20:53:05 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Carolyn\Desktop\OTL (1).exe
[2010/08/13 11:22:56 | 000,132,096 | —- | M] () – C:\Users\Carolyn\Desktop\RootRepeal.exe
[2010/08/25 20:45:33 | 000,869,051 | —- | M] () – C:\Users\Carolyn\Desktop\SecurityCheck.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:288A91F8
< End of report >
Post #22
Hi jhess23a,

Please work your way through the following:


1. OTL Fix
————————

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O37 - HKCU\…com [@ = ComFile] – Reg Error: Key error. File not found
O37 - HKCU\…exe [@ = exefile] – Reg Error: Key error. File not found

:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( dont check the boxes beside LOP Check or Purity this time )




1. Virus Totoal Scan
————————

  • Please visit Virus Total
  • Click the Browse button below Upload a File.
  • Copy and paste the file and path below into the File Name box and click Open

    C:\Program Files\muvee Technologies\muveeNow 2.0 - Creative\muveeapp.exe

  • Click Send File and wait for the scanning to complete
  • When "Current Status:" changes to Finished, click Compact above the report
  • Note: If the file has already been analysed, please click Reanalyse file now
  • Once the scan finishes, click Compact above the report (Looks like this [external image: Posted Image]).
  • In the new window that pops up, copy all the info (right-click > select all, right-click > copy) and paste it in your next reply.



In your next reply please include:
  • The OTL log.
  • The VirusTotal log.
  • How is your computer running now?
Post #23
All processes killed ========== OTL ========== Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found. Registry key HKEY_CURRENT_USER\Software\Classes\.com\ not found. Registry key HKEY_CURRENT_USER\Software\Classes\ComFile\ not found. HKEY_LOCAL_MACHINE\Software\Classes\.com\\|comfile /E : value set successfully! Registry key HKEY_CURRENT_USER\Software\Classes\.exe\ not found. Registry key HKEY_CURRENT_USER\Software\Classes\exefile\ not found. HKEY_LOCAL_MACHINE\Software\Classes\.exe\\|exefile /E : value set successfully! ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Carolyn ->Temp folder emptied: 7374076 bytes ->Temporary Internet Files folder emptied: 43552597 bytes ->Java cache emptied: 256214 bytes ->FireFox cache emptied: 64235340 bytes ->Google Chrome cache emptied: 6669086 bytes ->Apple Safari cache emptied: 0 bytes ->Flash cache emptied: 10475 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 43 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 102063435 bytes Total Files Cleaned = 214.00 mb OTL by OldTimer - Version 3.2.10.0 log created on 08272010_065928 Files\Folders moved on Reboot… File\Folder C:\Windows\temp\mcmsc_DcrxkmN1EaOQIrF not found! C:\Windows\temp\sqlite_I8XbKdp1c6DfDYN moved successfully. File\Folder C:\Windows\temp\sqlite_KV3zm1Nwp6tCKSK not found! C:\Windows\temp\sqlite_qVdabvu5MrWSWtB moved successfully. Registry entries deleted on Reboot…
Post #24
I copied and pasted each VirusTotal tab individually, Table, Tabulated, CSV, HTML, BBCode


Antivirus Version Last update Result
AhnLab-V3 2010.08.27.00 2010.08.26 Dropper/Xema.11885624
AntiVir 8.2.4.46 2010.08.27 -
Antiy-AVL 2.0.3.7 2010.08.26 -
Authentium 5.2.0.5 2010.08.27 W32/DropperX.SDO
Avast 4.8.1351.0 2010.08.27 -
Avast5 5.0.594.0 2010.08.27 -
AVG 9.0.0.851 2010.08.27 -
BitDefender 7.2 2010.08.27 -
CAT-QuickHeal 11.00 2010.08.27 TrojanDropper.Delf.eal
ClamAV 0.96.2.0-git 2010.08.27 PUA.Packed.Armadillo
Comodo 5874 2010.08.27 TrojWare.Win32.TrojanDropper.Delf.eal
DrWeb 5.0.2.03300 2010.08.27 -
Emsisoft 5.0.0.37 2010.08.27 -
eSafe 7.0.17.0 2010.08.26 -
eTrust-Vet 36.1.7821 2010.08.27 -
F-Prot 4.6.1.107 2010.08.26 W32/DropperX.SDO
F-Secure 9.0.15370.0 2010.08.27 -
Fortinet 4.1.143.0 2010.08.26 W32/Delf.EAL!tr
GData 21 2010.08.27 -
Ikarus T3.1.1.88.0 2010.08.27 -
Jiangmin 13.0.900 2010.08.27 -
Kaspersky 7.0.0.125 2010.08.27 Trojan-Dropper.Win32.Delf.eal
McAfee 5.400.0.1158 2010.08.27 Artemis!9CE8962F1189
McAfee-GW-Edition 2010.1B 2010.08.27 Artemis!9CE8962F1189
Microsoft 1.6103 2010.08.27 -
NOD32 5401 2010.08.27 -
Norman 6.05.11 2010.08.27 -
nProtect 2010-08-27.01 2010.08.27 -
Panda 10.0.2.7 2010.08.27 Suspicious file
PCTools 7.0.3.5 2010.08.27 -
Prevx 3.0 2010.08.27 -
Rising 22.62.04.04 2010.08.27 -
Sophos 4.56.0 2010.08.27 -
Sunbelt 6801 2010.08.27 Trojan.Win32.Generic!BT
SUPERAntiSpyware 4.40.0.1006 2010.08.27 -
Symantec 20101.1.1.7 2010.08.27 -
TheHacker 6.5.2.1.356 2010.08.26 -
TrendMicro 9.120.0.1004 2010.08.27 -
TrendMicro-HouseCall 9.120.0.1004 2010.08.27 -
VBA32 3.12.14.0 2010.08.25 Trojan-Dropper.Win32.Delf.eal
ViRobot 2010.8.25.4006 2010.08.27 -
VirusBuster 5.0.27.0 2010.08.26 -
MD5: 9ce8962f11892de22d2ac3a0d5e6be05
SHA1: 07d71b8b4094a7411502a52c667fbd38c25f9260
SHA256: 5ff952c08816b1f7694b9484343ad374613fa29664fb42293a780772634635d3
File size: 11885624 bytes
Scan date: 2010-08-27 11:16:23 (UTC)

Antivirus Version Last update Result
AhnLab-V3 2010.08.27.00 2010.08.26 Dropper/Xema.11885624
AntiVir 8.2.4.46 2010.08.27 -
Antiy-AVL 2.0.3.7 2010.08.26 -
Authentium 5.2.0.5 2010.08.27 W32/DropperX.SDO
Avast 4.8.1351.0 2010.08.27 -
Avast5 5.0.594.0 2010.08.27 -
AVG 9.0.0.851 2010.08.27 -
BitDefender 7.2 2010.08.27 -
CAT-QuickHeal 11.00 2010.08.27 TrojanDropper.Delf.eal
ClamAV 0.96.2.0-git 2010.08.27 PUA.Packed.Armadillo
Comodo 5874 2010.08.27 TrojWare.Win32.TrojanDropper.Delf.eal
DrWeb 5.0.2.03300 2010.08.27 -
Emsisoft 5.0.0.37 2010.08.27 -
eSafe 7.0.17.0 2010.08.26 -
eTrust-Vet 36.1.7821 2010.08.27 -
F-Prot 4.6.1.107 2010.08.26 W32/DropperX.SDO
F-Secure 9.0.15370.0 2010.08.27 -
Fortinet 4.1.143.0 2010.08.26 W32/Delf.EAL!tr
GData 21 2010.08.27 -
Ikarus T3.1.1.88.0 2010.08.27 -
Jiangmin 13.0.900 2010.08.27 -
Kaspersky 7.0.0.125 2010.08.27 Trojan-Dropper.Win32.Delf.eal
McAfee 5.400.0.1158 2010.08.27 Artemis!9CE8962F1189
McAfee-GW-Edition 2010.1B 2010.08.27 Artemis!9CE8962F1189
Microsoft 1.6103 2010.08.27 -
NOD32 5401 2010.08.27 -
Norman 6.05.11 2010.08.27 -
nProtect 2010-08-27.01 2010.08.27 -
Panda 10.0.2.7 2010.08.27 Suspicious file
PCTools 7.0.3.5 2010.08.27 -
Prevx 3.0 2010.08.27 -
Rising 22.62.04.04 2010.08.27 -
Sophos 4.56.0 2010.08.27 -
Sunbelt 6801 2010.08.27 Trojan.Win32.Generic!BT
SUPERAntiSpyware 4.40.0.1006 2010.08.27 -
Symantec 20101.1.1.7 2010.08.27 -
TheHacker 6.5.2.1.356 2010.08.26 -
TrendMicro 9.120.0.1004 2010.08.27 -
TrendMicro-HouseCall 9.120.0.1004 2010.08.27 -
VBA32 3.12.14.0 2010.08.25 Trojan-Dropper.Win32.Delf.eal
ViRobot 2010.8.25.4006 2010.08.27 -
VirusBuster 5.0.27.0 2010.08.26 -
MD5: 9ce8962f11892de22d2ac3a0d5e6be05
SHA1: 07d71b8b4094a7411502a52c667fbd38c25f9260
SHA256: 5ff952c08816b1f7694b9484343ad374613fa29664fb42293a780772634635d3
File size: 11885624 bytes
Scan date: 2010-08-27 11:16:23 (UTC)

"Antivirus", "Version", "Last update", "Result"
"AhnLab-V3", "2010.08.27.00", "2010.08.26", "Dropper/Xema.11885624"
"AntiVir", "8.2.4.46", "2010.08.27", "-"
"Antiy-AVL", "2.0.3.7", "2010.08.26", "-"
"Authentium", "5.2.0.5", "2010.08.27", "W32/DropperX.SDO"
"Avast", "4.8.1351.0", "2010.08.27", "-"
"Avast5", "5.0.594.0", "2010.08.27", "-"
"AVG", "9.0.0.851", "2010.08.27", "-"
"BitDefender", "7.2", "2010.08.27", "-"
"CAT-QuickHeal", "11.00", "2010.08.27", "TrojanDropper.Delf.eal"
"ClamAV", "0.96.2.0-git", "2010.08.27", "PUA.Packed.Armadillo"
"Comodo", "5874", "2010.08.27", "TrojWare.Win32.TrojanDropper.Delf.eal"
"DrWeb", "5.0.2.03300", "2010.08.27", "-"
"Emsisoft", "[removed]", "2010.08.27", "-"
"eSafe", "7.0.17.0", "2010.08.26", "-"
"eTrust-Vet", "36.1.7821", "2010.08.27", "-"
"F-Prot", "4.6.1.107", "2010.08.26", "W32/DropperX.SDO"
"F-Secure", "9.0.15370.0", "2010.08.27", "-"
"Fortinet", "4.1.143.0", "2010.08.26", "W32/Delf.EAL!tr"
"GData", "21", "2010.08.27", "-"
"Ikarus", "T3.1.1.88.0", "2010.08.27", "-"
"Jiangmin", "13.0.900", "2010.08.27", "-"
"Kaspersky", "7.0.0.125", "2010.08.27", "Trojan-Dropper.Win32.Delf.eal"
"McAfee", "5.400.0.1158", "2010.08.27", "Artemis!9CE8962F1189"
"McAfee-GW-Edition", "2010.1B", "2010.08.27", "Artemis!9CE8962F1189"
"Microsoft", "1.6103", "2010.08.27", "-"
"NOD32", "5401", "2010.08.27", "-"
"Norman", "6.05.11", "2010.08.27", "-"
"nProtect", "2010-08-27.01", "2010.08.27", "-"
"Panda", "10.0.2.7", "2010.08.27", "Suspicious file"
"PCTools", "[removed]", "2010.08.27", "-"
"Prevx", "3.0", "2010.08.27", "-"
"Rising", "22.62.04.04", "2010.08.27", "-"
"Sophos", "4.56.0", "2010.08.27", "-"
"Sunbelt", "6801", "2010.08.27", "Trojan.Win32.Generic!BT"
"SUPERAntiSpyware", "4.40.0.1006", "2010.08.27", "-"
"Symantec", "20101.1.1.7", "2010.08.27", "-"
"TheHacker", "6.5.2.1.356", "2010.08.26", "-"
"TrendMicro", "9.120.0.1004", "2010.08.27", "-"
"TrendMicro-HouseCall", "9.120.0.1004", "2010.08.27", "-"
"VBA32", "[removed]", "2010.08.25", "Trojan-Dropper.Win32.Delf.eal"
"ViRobot", "2010.8.25.4006", "2010.08.27", "-"
"VirusBuster", "[removed]", "2010.08.26", "-"
"MD5", "9ce8962f11892de22d2ac3a0d5e6be05"
"SHA1", "07d71b8b4094a7411502a52c667fbd38c25f9260"
"SHA256", "5ff952c08816b1f7694b9484343ad374613fa29664fb42293a780772634635d3"
"File size", "11885624 bytes"
"Scan date", "2010-08-27 11:16:23 (UTC)"




































































































































































































































































Antivirus Version Last update Result
AhnLab-V3 2010.08.27.00 2010.08.26 Dropper/Xema.11885624
AntiVir 8.2.4.46 2010.08.27 -
Antiy-AVL 2.0.3.7 2010.08.26 -
Authentium 5.2.0.5 2010.08.27 W32/DropperX.SDO
Avast 4.8.1351.0 2010.08.27 -
Avast5 5.0.594.0 2010.08.27 -
AVG 9.0.0.851 2010.08.27 -
BitDefender 7.2 2010.08.27 -
CAT-QuickHeal 11.00 2010.08.27 TrojanDropper.Delf.eal
ClamAV 0.96.2.0-git 2010.08.27 PUA.Packed.Armadillo
Comodo 5874 2010.08.27 TrojWare.Win32.TrojanDropper.Delf.eal
DrWeb 5.0.2.03300 2010.08.27 -
Emsisoft 5.0.0.37 2010.08.27 -
eSafe 7.0.17.0 2010.08.26 -
eTrust-Vet 36.1.7821 2010.08.27 -
F-Prot 4.6.1.107 2010.08.26 W32/DropperX.SDO
F-Secure 9.0.15370.0 2010.08.27 -
Fortinet 4.1.143.0 2010.08.26 W32/Delf.EAL!tr
GData 21 2010.08.27 -
Ikarus T3.1.1.88.0 2010.08.27 -
Jiangmin 13.0.900 2010.08.27 -
Kaspersky 7.0.0.125 2010.08.27 Trojan-Dropper.Win32.Delf.eal
McAfee 5.400.0.1158 2010.08.27 Artemis!9CE8962F1189
McAfee-GW-Edition 2010.1B 2010.08.27 Artemis!9CE8962F1189
Microsoft 1.6103 2010.08.27 -
NOD32 5401 2010.08.27 -
Norman 6.05.11 2010.08.27 -
nProtect 2010-08-27.01 2010.08.27 -
Panda 10.0.2.7 2010.08.27 Suspicious file
PCTools 7.0.3.5 2010.08.27 -
Prevx 3.0 2010.08.27 -
Rising 22.62.04.04 2010.08.27 -
Sophos 4.56.0 2010.08.27 -
Sunbelt 6801 2010.08.27 Trojan.Win32.Generic!BT
SUPERAntiSpyware 4.40.0.1006 2010.08.27 -
Symantec 20101.1.1.7 2010.08.27 -
TheHacker 6.5.2.1.356 2010.08.26 -
TrendMicro 9.120.0.1004 2010.08.27 -
TrendMicro-HouseCall 9.120.0.1004 2010.08.27 -
VBA32 3.12.14.0 2010.08.25 Trojan-Dropper.Win32.Delf.eal
ViRobot 2010.8.25.4006 2010.08.27 -
VirusBuster 5.0.27.0 2010.08.26 -





















Additional information
MD5: 9ce8962f11892de22d2ac3a0d5e6be05
SHA1: 07d71b8b4094a7411502a52c667fbd38c25f9260
SHA256: 5ff952c08816b1f7694b9484343ad374613fa29664fb42293a780772634635d3
File size: 11885624 bytes
Scan date: 2010-08-27 11:16:23 (UTC)


Antivirus results
AhnLab-V3 - 2010.08.27.00 - 2010.08.26 - Dropper/Xema.11885624
AntiVir - 8.2.4.46 - 2010.08.27 - -
Antiy-AVL - 2.0.3.7 - 2010.08.26 - -
Authentium - 5.2.0.5 - 2010.08.27 - W32/DropperX.SDO
Avast - 4.8.1351.0 - 2010.08.27 - -
Avast5 - 5.0.594.0 - 2010.08.27 - -
AVG - 9.0.0.851 - 2010.08.27 - -
BitDefender - 7.2 - 2010.08.27 - -
CAT-QuickHeal - 11.00 - 2010.08.27 - TrojanDropper.Delf.eal
ClamAV - 0.96.2.0-git - 2010.08.27 - PUA.Packed.Armadillo
Comodo - 5874 - 2010.08.27 - TrojWare.Win32.TrojanDropper.Delf.eal
DrWeb - 5.0.2.03300 - 2010.08.27 - -
Emsisoft - 5.0.0.37 - 2010.08.27 - -
eSafe - 7.0.17.0 - 2010.08.26 - -
eTrust-Vet - 36.1.7821 - 2010.08.27 - -
F-Prot - 4.6.1.107 - 2010.08.26 - W32/DropperX.SDO
F-Secure - 9.0.15370.0 - 2010.08.27 - -
Fortinet - 4.1.143.0 - 2010.08.26 - W32/Delf.EAL!tr
GData - 21 - 2010.08.27 - -
Ikarus - T3.1.1.88.0 - 2010.08.27 - -
Jiangmin - 13.0.900 - 2010.08.27 - -
Kaspersky - 7.0.0.125 - 2010.08.27 - Trojan-Dropper.Win32.Delf.eal
McAfee - 5.400.0.1158 - 2010.08.27 - Artemis!9CE8962F1189
McAfee-GW-Edition - 2010.1B - 2010.08.27 - Artemis!9CE8962F1189
Microsoft - 1.6103 - 2010.08.27 - -
NOD32 - 5401 - 2010.08.27 - -
Norman - 6.05.11 - 2010.08.27 - -
nProtect - 2010-08-27.01 - 2010.08.27 - -
Panda - 10.0.2.7 - 2010.08.27 - Suspicious file
PCTools - 7.0.3.5 - 2010.08.27 - -
Prevx - 3.0 - 2010.08.27 - -
Rising - 22.62.04.04 - 2010.08.27 - -
Sophos - 4.56.0 - 2010.08.27 - -
Sunbelt - 6801 - 2010.08.27 - Trojan.Win32.Generic!BT
SUPERAntiSpyware - 4.40.0.1006 - 2010.08.27 - -
Symantec - 20101.1.1.7 - 2010.08.27 - -
TheHacker - 6.5.2.1.356 - 2010.08.26 - -
TrendMicro - 9.120.0.1004 - 2010.08.27 - -
TrendMicro-HouseCall - 9.120.0.1004 - 2010.08.27 - -
VBA32 - 3.12.14.0 - 2010.08.25 - Trojan-Dropper.Win32.Delf.eal
ViRobot - 2010.8.25.4006 - 2010.08.27 - -
VirusBuster - 5.0.27.0 - 2010.08.26 - -
File info:
MD5: 9ce8962f11892de22d2ac3a0d5e6be05
SHA1: 07d71b8b4094a7411502a52c667fbd38c25f9260
SHA256: 5ff952c08816b1f7694b9484343ad374613fa29664fb42293a780772634635d3
File size: 11885624 bytes
Scan date: 2010-08-27 11:16:23 (UTC)
Post #26
Hi jhess23a,

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Files
C:\Program Files\muvee Technologies\muveeNow 2.0 - Creative\muveeapp.exe

:Commands
[emptytemp]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( dont check the boxes beside LOP Check or Purity this time )


In your next reply please include:
  • The OTL log.
  • How is your computer running now?
Post #27
OTL log. The computer is running well. All processes killed ========== FILES ========== C:\Program Files\muvee Technologies\muveeNow 2.0 - Creative\muveeapp.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Carolyn ->Temp folder emptied: 123884 bytes ->Temporary Internet Files folder emptied: 12327058 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Google Chrome cache emptied: 35678170 bytes ->Apple Safari cache emptied: 0 bytes ->Flash cache emptied: 1167 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 46.00 mb OTL by OldTimer - Version 3.2.10.0 log created on 08282010_102054 Files\Folders moved on Reboot… File\Folder C:\Windows\temp\mcmsc_0qbm5KAmYrwKcqr not found! C:\Windows\temp\sqlite_nLFs2FXgk46Xx7h moved successfully. C:\Windows\temp\sqlite_YEUo5qgHBHeG09n moved successfully. Registry entries deleted on Reboot…
Post #28
Hi jhess23a,

You have some very important updates to do and address several security issues to ensure you are protected.

Please work your way through the following:


1. Update Adobe
———————————

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum

In either case you should uninstall Old version goes here first. Be sure to move any PDF documents to another folder first though.



2. Update Firefox
———————————

Update FireFox
You are currently using an outdated version of Firefox. The latest version of Firefox is 3.6.

You can get the latest version of Firefox by accessing the Help menu in Firefox and then selecting Check for Updates. Please make sure that you Check for Updates again after updating to the latest version to make sure that you have in fact received the latest version.



3. Update Internet Explorer
———————————

Your current version of Internet Explorer is outdated and older versions contain vulnerabilities. Please download the latest version (V8.00) from HERE.



4. Update Service Pack
———————————

You currently have an outdated Service Pack. It is highly recommended you update to the latest Service Pack. This is an extremely important update which fixes several bugs and security issues that attackers exploit. Without it, I can almost guarantee that you will get infected again.
To download the latest Service Pack, please visit: Windows Update



I understand these steps may take a while to work through, however I implore you address all the issues listed above.

Please let me know how the updates go and if you have any issues doing them as it may be a sign of more malware on your system.


Cheers :thumbup:
Post #29
Adobe is done. I will get to Firefox and Explorer today. When this is all said and done I will definitely be donating to your great site.
Post #30 last edited
Thank you so much. The four updates are completed. All went smoothly. Then computer is running well. Once I have a clean bill-of-health, are they any programs that I can remove from the desktop? P.S. Just donated :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI