Spyware / Malware / Virus Removal

virtumonde.sdn

12 min read

Looking for the outcome? Ask AI

mstein66 Topic Starter

Post #1August 14, 2010, 5:17 PM UTC

Hello – Spybot keeps finding virtumonde.sdn and WinPatrol keeps asking me to okay system32\d3dx9_3032.dll and I need help getting ride of these 2 things…

Please review HijackThis Log File and advise!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:15:27 PM, on 8/14/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\ASUS\Ai Suite\EnergySaving\PwSave.exe
C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe
C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ASUS\AASP\1.00.91\aaCenter.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe
C:\Program Files\Cyberlink\Shared files\brs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.foxsports.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: LastPass Browser Helper Object - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files\LastPass\LPBar.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files\LastPass\LPBar.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [QFan Help] "C:\Program Files\ASUS\Ai Suite\QFan3\QFanHelp.exe"
O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] "C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ASUS Energy Saving] "C:\Program Files\ASUS\Ai Suite\EnergySaving\PwSave.exe"
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp
O4 - HKLM\..\Run: [RemoteControl10] "C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared files\brs.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [FileHippo.com] "C:\Program Files\FileHippo.com\UpdateChecker.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-21-1004336348-926492609-682003330-501\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden (User 'Guest')
O4 - HKUS\S-1-5-21-1004336348-926492609-682003330-501\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (User 'Guest')
O4 - HKUS\S-1-5-21-1004336348-926492609-682003330-501\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Guest')
O4 - S-1-5-18 Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (User 'Default user')
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: LastPass - file://C:\Program Files\LastPass\context.html?cmd=lastpass
O8 - Extra context menu item: LastPass Fill Forms - file://C:\Program Files\LastPass\context.html?cmd=fillforms
O9 - Extra button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1263443305593
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\d3dx9_3032.dll
O20 - Winlogon Notify: f43ada65985 - C:\WINDOWS\system32\d3dx9_3032.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SureThing Labelflash service - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

–
End of file - 11161 bytes

oldman960

Post #2August 15, 2010, 3:00 PM UTC last edited August 15, 2010, 3:06 PM UTC

Hi mstein66, welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Please do not post on multiple forums. This only wastes valuable helper time. Please close your thread HERE and only reply to this one.

LimeWire and uTorrent
You have LimeWire and uTorrent, P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx

http://www.internetworldstats.com/articles…cles/art053.htm

I would recommend that you uninstall LimeWire and uTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

Go HERE to get a randomly named copy of GMER. Scroll down to the Download section and click Download EXE. Save it to your desktop.

Before scanning with GMER, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double click on the file you downloaded. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If GMER will not run in normal windows, please run it in Saffe Mode

Next

Download OTL to your desktop.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
In the window under Custom Scans/Fixes copy and paste the following

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Please post back with

GMER log
both OTL logs

Thanks

RPMcMurphy

Post #3August 15, 2010, 3:01 PM UTC

Hello and welcome. Please follow these guidelines while we work on your PC:

Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
Please do not run any scans or install/uninstall any applications without being directed to do so.
Please follow my instructions carefully and in the order they are posted.
Any underlined text in my posts indicates a clickable link.
You should print any instructions I give you for ease of use and reference.
If you have any questions at all, please stop and ask before proceeding.

🖼Click to load external image (Posted Image) Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.pif

Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.

Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If you have trouble running GEMR:

Make sure that your security software is disabled
Uncheck the box next to "Files" this time also
If you still can't run it, try in the Safe Mode

Please include the following in your next post:

DDS and Attach.txt logs

GMER log

mstein66

Post #4August 15, 2010, 5:27 PM UTC last edited August 15, 2010, 5:30 PM UTC

….

mstein66

Post #5August 15, 2010, 5:27 PM UTC

Hi Oldman & RP & thanks for assisting.

Since this post I have uninstalled LimeWire & I have downloaded & ran Spyware Doctor & ran Spybot Search & Destroy both in Safe Mode & regular & it seemed to have removed virtumonde.sdn.

WinPatrol Active Tasks doesn't show system32\d3dx9_3032.dll nor does it pop up to ask me to allow or disallow anymore either, but a new one started, which is named lsass.exe (C:\DOCUMENTS AND SETTINGS\MATT\APPLICATION DATA\SYSTEMPROC\LSASS.EXE), which has no company name, version, copyright & is disable at this time.

Another thing I have notice is when searching for alternatives fixes on the Net and clicking on the link to open, it would open an alternate link(s) and the only way to get to the legit site(s) would to either open in a new tab or copy & paste it in the address bar…

SEE INFO BELOW & ATTACHED!!!

DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 11:45:57.34 on Sun 08/15/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2408 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\ASUS\Ai Suite\EnergySaving\PwSave.exe
C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe
C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe
C:\Program Files\ASUS\AASP\1.00.91\aaCenter.exe
C:\Program Files\Cyberlink\Shared files\brs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Matt\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://msn.foxsports.com/
uInternet Settings,ProxyOverride = *.local
BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\spyware

doctor\bdt\PCTBrowserDefender.dll
BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: LastPass Browser Helper Object: {95d9ecf5-2a4d-4550-be49-70d42f71296e} - c:\program files\lastpass\LPBar.dll
BHO: WOT Helper: {c920e44a-7f78-4e64-bdd7-a57026e7feb7} - c:\program files\wot\WOT.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program

files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - c:\program files\lastpass\LPBar.dll
TB: WOT: {71576546-354d-41c9-aae8-31f2ec22bf0d} - c:\program files\wot\WOT.dll
TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\spyware

doctor\bdt\PCTBrowserDefender.dll
uRun: [FileHippo.com] "c:\program files\filehippo.com\UpdateChecker.exe" /background
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [QFan Help] "c:\program files\asus\ai suite\qfan3\QFanHelp.exe"
mRun: [CPU Power Monitor] "c:\program files\asus\ai suite\aigear3\CpuPowerMonitor.exe"
mRun: [Cpu Level Up help] "c:\program files\asus\ai suite\CpuLevelUpHelp.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [ASUS Energy Saving] "c:\program files\asus\ai suite\energysaving\PwSave.exe"
mRun: [Alcmtr] ALCMTR.EXE
mRun: [Ai Nap] "c:\program files\asus\ai suite\ainap\AiNap.exe"
mRun: [LWS] c:\program files\logitech\lws\webcam software\LWS.exe -hide
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming
mRun: [SmartDefrag] "c:\program files\iobit\iobit smartdefrag\IObit SmartDefrag.exe" /StartUp
mRun: [RemoteControl10] "c:\program files\cyberlink\powerdvd10\PDVD10Serv.exe"
mRun: [BDRegion] c:\program files\cyberlink\shared files\brs.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
StartupFolder: c:\docume~1\matt\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: LastPass - file://c:\program files\lastpass\context.html?cmd=lastpass
IE: LastPass Fill Forms - file://c:\program files\lastpass\context.html?cmd=fillforms
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\program files\lastpass\LPBar.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: %SYSTEMROOT%\system32\nvLsp.dll
Trusted Zone: intuit.com\ttlc
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} -

hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1263443305593
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft

office\office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - c:\program files\wot\WOT.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft

office\office12\GrooveShellExtensions.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\matt\applic~1\mozilla\firefox\profiles\tf8574lj.default\
FF - prefs.js: browser.startup.homepage - hxxp://rivals.yahoo.com/ncaa/football;_ylt=ArvpMQPmZicaZaD72iFcaJs5nYcB
FF - component: c:\documents and settings\matt\application

data\mozilla\firefox\profiles\tf8574lj.default\extensions\[removed]\platform\winnt_x86-msvc\components\lpxpcom.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} -

c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla

firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js -

pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name",

"chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js -

pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-8-15 218592]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-1-14 11608]
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/08/14 07:48:41];c:\program

files\cyberlink\powerdvd10\navfilter\000.fcl [2010-6-28 87536]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-1-14 135336]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-1-14 267432]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-1-14 60936]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\spyware doctor\bdt\BDTUpdateService.exe

[2010-8-15 112592]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2010-1-14 10448]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2010-8-15 366840]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2010-8-15 1142224]
S3 SureThing Labelflash service;SureThing Labelflash service;c:\program files\common files\surething shared\stllssvr.exe

[2010-8-14 74392]

=============== Created Last 30 ================

2010-08-15 12:10:35 0 d—–w- C:\VundoFix Backups
2010-08-15 11:37:07 0 d—–w- c:\docume~1\matt\applic~1\GetRightToGo
2010-08-15 10:04:47 882 —-a-w- c:\windows\RegSDImport.xml
2010-08-15 10:04:47 879 —-a-w- c:\windows\RegISSImport.xml
2010-08-15 10:04:47 767952 —-a-w- c:\windows\BDTSupport.dll
2010-08-15 10:04:47 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-08-15 10:04:47 131 —-a-w- c:\windows\IDB.zip
2010-08-15 10:04:46 165840 —-a-w- c:\windows\PCTBDRes.dll
2010-08-15 10:04:46 1652688 —-a-w- c:\windows\PCTBDCore.dll
2010-08-15 10:04:46 1152444 —-a-w- c:\windows\UDB.zip
2010-08-15 10:03:17 7387 —-a-w- c:\windows\system32\drivers\pctgntdi.cat
2010-08-15 10:03:17 233136 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2010-08-15 10:03:12 88040 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-08-15 10:03:12 7412 —-a-w- c:\windows\system32\drivers\PCTAppEvent.cat
2010-08-15 10:03:12 7383 —-a-w- c:\windows\system32\drivers\pctcore.cat
2010-08-15 10:03:12 218592 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2010-08-15 10:03:01 7383 —-a-w- c:\windows\system32\drivers\pctplsg.cat
2010-08-15 10:03:01 63360 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2010-08-15 10:02:44 0 d—–w- c:\program files\Spyware Doctor
2010-08-15 10:02:44 0 d—–w- c:\program files\common files\PC Tools
2010-08-15 10:02:44 0 d—–w- c:\docume~1\matt\applic~1\PC Tools
2010-08-15 10:02:44 0 d—–w- c:\docume~1\alluse~1\applic~1\PC Tools
2010-08-15 03:33:36 0 d-sh–w- c:\docume~1\matt\applic~1\SystemProc
2010-08-14 17:15:13 0 d—–w- c:\program files\Trend Micro
2010-08-14 16:50:57 19 —-a-w- c:\windows\system32\24badd62
2010-08-14 14:22:15 471 —-a-w- c:\windows\wininit.ini
2010-08-14 13:13:27 1900 —-a-w- c:\windows\GnuHashes.ini
2010-08-14 13:05:59 141 —-a-w- c:\windows\system32\sl1166743719
2010-08-14 13:05:59 0 d-sh–w- c:\windows\system32\SysWoW32
2010-08-14 13:05:44 203776 –sh–w- c:\windows\system32\unrar.exe
2010-08-14 13:05:44 0 d—–w- c:\windows\system32\1174977794
2010-08-14 13:05:28 316928 —-a-w- c:\windows\system32\danim32.dll
2010-08-14 13:05:28 1160704 –sha-w- c:\windows\system32\99.tmp
2010-08-14 11:01:29 487424 —-a-w- c:\windows\system32\msvcp70.dll
2010-08-14 11:01:29 344064 —-a-w- c:\windows\system32\msvcr70.dll
2010-08-14 11:01:28 0 d—–w- c:\program files\common files\SureThing Shared
2010-08-14 11:01:24 0 d—–w- c:\program files\SureThing CD Labeler 5
2010-08-13 21:47:44 0 d—–w- c:\docume~1\matt\applic~1\NVIDIA
2010-08-13 21:43:50 0 d—–w- c:\program files\common files\CyberLink
2010-08-13 20:30:57 0 d—–w- c:\program files\uTorrent
2010-08-13 20:30:16 0 d—–w- c:\docume~1\matt\applic~1\uTorrent
2010-08-13 19:52:30 0 d—–w- c:\program files\LimeWire
2010-08-13 19:35:51 0 d—–w- c:\program files\LightScribe Diagnostic Utility
2010-08-03 01:47:27 1157 —-a-w- c:\windows\checkip.dat
2010-08-03 01:42:39 1157 —-a-w- c:\windows\ipconfig.dat
2010-08-03 00:33:14 0 d—–w- c:\windows\system32\wbem\Repository
2010-07-24 14:31:18 73728 —-a-w- c:\windows\system32\javacpl.cpl
2010-07-20 00:28:38 0 d—–w- c:\program files\iPod
2010-07-20 00:28:34 0 d—–w- c:\program files\iTunes

==================== Find3M ====================

2010-08-15 15:25:08 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2010-08-15 15:25:06 0 —-a-w- c:\windows\system32\drivers\logiflt.iad
2010-08-14 11:47:16 353576 —-a-w- c:\windows\system32\msvcr71.dll
2010-08-14 11:47:16 29480 —-a-w- c:\windows\system32\msxml3a.dll
2010-08-14 11:47:15 505128 —-a-w- c:\windows\system32\msvcp71.dll
2010-07-24 14:40:36 232968 —-a-w- c:\windows\system32\nvdrsdb0.bin
2010-07-24 14:40:35 232968 —-a-w- c:\windows\system32\nvdrsdb1.bin
2010-07-24 14:31:08 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-09 20:24:26 81920 —-a-w- c:\windows\system32\nvwddi.dll
2010-07-09 20:24:18 277608 —-a-w- c:\windows\system32\nvmccs.dll
2010-07-09 20:24:18 110696 —-a-w- c:\windows\system32\nvmctray.dll
2010-07-09 20:24:16 155752 —-a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 20:24:16 145000 —-a-w- c:\windows\system32\nvcolor.exe
2010-07-09 20:24:16 13923432 —-a-w- c:\windows\system32\nvcpl.dll
2010-07-07 17:46:46 604776 —-a-w- c:\windows\system32\NVUNINST.EXE
2010-06-30 12:31:35 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22:03 916480 —-a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44:04 1851904 —-a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27:11 354304 —-a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03:00 80384 —-a-w- c:\windows\system32\iccvid.dll
2010-06-14 07:41:45 1172480 —-a-w- c:\windows\system32\msxml3.dll
2010-05-18 20:35:16 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-05-18 20:35:16 75040 —-a-w- c:\windows\system32\jdns_sd.dll
2010-05-18 20:35:16 197920 —-a-w- c:\windows\system32\dnssdX.dll
2010-05-18 20:35:16 107808 —-a-w- c:\windows\system32\dns-sd.exe

============= FINISH: 11:46:14.48 ===============

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-15 12:58:39
Windows 5.1.2600 Service Pack 3
Running: dq5yotcj.exe; Driver: C:\DOCUME~1\Matt\LOCALS~1\Temp\ffkyrpow.sys

—- System - GMER 1.0.15 —-

SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateKey [0xB7E8F112]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0xB7E6E2D6]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0xB7E6E4C8]
SSDT A860BCB4 ZwCreateThread
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteKey [0xB7E8F900]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteValueKey [0xB7E8FBB4]
SSDT A860BCD2 ZwLoadKey
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwOpenKey [0xB7E8DE12]
SSDT A860BCA0 ZwOpenProcess
SSDT A860BCA5 ZwOpenThread
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwRenameKey [0xB7E90020]
SSDT A860BCDC ZwReplaceKey
SSDT A860BCD7 ZwRestoreKey
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwSetValueKey [0xB7E8F3D2]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0xB7E6DF44]

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwCallbackReturn + 2EE4 80504780 8 Bytes JMP E10D243C
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB5CB63A0, 0x59FFE5, 0xE8000020]
.text C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl section is writeable [0xA5E83000, 0x2892, 0xE8000020]
.vmp2 C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl entry point in ".vmp2" section [0xA5EA6050]

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Mozilla Firefox\firefox.exe[2720] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

—- EOF - GMER 1.0.15 —-

OTL logfile created on: 8/15/2010 1:13:51 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Matt\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 80.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 423.71 Gb Free Space | 90.97% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME-AD798B7B7F
Current User Name: Matt
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Matt\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe (IObit)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\CyberLink\Shared files\brs.exe (cyberlink)
PRC - C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe (BillP Studios)
PRC - C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
PRC - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe ()
PRC - C:\Program Files\ASUS\AASP\1.00.91\aaCenter.exe ()
PRC - C:\Program Files\ASUS\Ai Suite\EnergySaving\PwSave.exe ()
PRC - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
PRC - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe ()

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Matt\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\Program Files\BillP Studios\WinPatrol\patrolpro.dll (BillP Studios)

========== Win32 Services (SafeList) ==========

SRV - (NMIndexingService) – C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe File not found
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (sdCoreService) – C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (sdAuxService) – C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (Browser Defender Update Service) – C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
SRV - (IntuitUpdateService) – C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) – C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
SRV - (nSvcIp) – C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()

========== Driver Services (SafeList) ==========

DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - ({1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}) – C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl (CyberLink Corp.)
DRV - (FilterService) – C:\WINDOWS\system32\drivers\lvuvcflt.sys (Logitech Inc.)
DRV - (LVUVC) Logitech Webcam Pro 9000(UVC) – C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (LVPr2Mon) – C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()
DRV - (PCTCore) – C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LBeepKE) – C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.)
DRV - (L8042Kbd) – C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech, Inc.)
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (nvgts) – C:\WINDOWS\system32\DRIVERS\nvgts.sys (NVIDIA Corporation)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (AsIO) – C:\WINDOWS\system32\drivers\AsIO.sys ()
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (UsbDiag) – C:\WINDOWS\system32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (USBModem) – C:\WINDOWS\system32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (usbbus) – C:\WINDOWS\system32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (ICAM5USB) Intel® – C:\WINDOWS\system32\drivers\ICAM5D2.sys (Intel Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://msn.foxsports.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = B1 86 26 38 64 E7 E0 48 A4 0F AC 5A 55 5B 4E 47 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://rivals.yahoo.com/ncaa/football;_ylt=ArvpMQPmZicaZaD72iFcaJs5nYcB"
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.48.3
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.69.1
FF - prefs.js..extensions.enabledItems: {37fa1426-b82d-11db-8314-0800200c9a66}:2.5.4
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100503
FF - prefs.js..extensions.enabledItems: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}:0.9.10.2
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {4a95b579-b4b6-43f9-8266-11741d9e5477}:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/14 17:09:40 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/14 17:09:40 | 000,000,000 | —D | M]

[2010/08/13 15:53:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\Mozilla\Extensions
[2010/08/13 15:53:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\Mozilla\Extensions\[removed]
[2010/08/15 07:28:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions
[2010/02/06 09:32:53 | 000,000,000 | —D | M] (Forecastfox) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2010/04/27 18:14:57 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/08/06 07:04:39 | 000,000,000 | —D | M] (WebMail Notifier) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{37fa1426-b82d-11db-8314-0800200c9a66}
[2010/08/14 09:05:55 | 000,000,000 | —D | M] (XUL Cache) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{4a95b579-b4b6-43f9-8266-11741d9e5477}
[2010/05/11 22:16:59 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/07/31 06:44:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
[2010/06/06 15:03:47 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/07/12 16:36:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\[removed]
[2010/01/16 20:24:59 | 000,002,172 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\searchplugins\bing.xml
[2010/08/15 07:28:05 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/07/24 10:31:19 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/07/24 10:31:08 | 000,423,656 | —- | M] (Oracle) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/08/12 16:14:35 | 000,075,208 | —- | M] (Foxit Software Company) – C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll

O1 HOSTS File: ([2010/08/15 07:16:00 | 000,416,619 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 14381 more lines…
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (LastPass Browser Helper Object) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O3 - HKCU\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [Ai Nap] C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe ()
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ASUS Energy Saving] C:\Program Files\ASUS\Ai Suite\EnergySaving\PwSave.exe ()
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BDRegion] C:\Program Files\CyberLink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [Cpu Level Up help] C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe ()
O4 - HKLM..\Run: [CPU Power Monitor] C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe ()
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [QFan Help] C:\Program Files\ASUS\Ai Suite\QFan3\QFanHelp.exe ()
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SmartDefrag] C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe (IObit)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKCU..\Run: [FileHippo.com] C:\Program Files\FileHippo.com\UpdateChecker.exe (FileHippo.com)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Documents and Settings\Matt\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\nvLsp.dll (NVIDIA)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1263443305593 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Matt\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Matt\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/01/13 11:16:06 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{65c95fd1-001a-11df-bbc4-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{65c95fd1-001a-11df-bbc4-806d6172696f}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{65c95fd1-001a-11df-bbc4-806d6172696f}\Shell\AutoRun\command - "" = D:\.\Bin\ASSETUP.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/08/15 12:18:05 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2010/08/15 12:11:10 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Matt\Desktop\OTL.exe
[2010/08/15 09:29:16 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Matt\Recent
[2010/08/15 08:10:35 | 000,000,000 | —D | C] – C:\VundoFix Backups
[2010/08/15 07:37:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Application Data\GetRightToGo
[2010/08/15 06:04:47 | 000,149,456 | —- | C] (PC Tools) – C:\WINDOWS\SGDetectionTool.dll
[2010/08/15 06:04:46 | 001,652,688 | —- | C] (Threat Expert Ltd.) – C:\WINDOWS\PCTBDCore.dll
[2010/08/15 06:04:46 | 000,165,840 | —- | C] (Threat Expert Ltd.) – C:\WINDOWS\PCTBDRes.dll
[2010/08/15 06:03:17 | 000,233,136 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctgntdi.sys
[2010/08/15 06:03:12 | 000,218,592 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTCore.sys
[2010/08/15 06:03:12 | 000,088,040 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTAppEvent.sys
[2010/08/15 06:03:01 | 000,063,360 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctplsg.sys
[2010/08/15 06:02:44 | 000,000,000 | —D | C] – C:\Program Files\Spyware Doctor
[2010/08/15 06:02:44 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PC Tools
[2010/08/15 06:02:44 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Application Data\PC Tools
[2010/08/15 06:02:44 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PC Tools
[2010/08/14 23:33:36 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Matt\Application Data\SystemProc
[2010/08/14 17:09:25 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/08/14 13:28:17 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/08/14 13:26:31 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/08/14 13:15:13 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/08/14 09:06:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Application Data\WinRAR
[2010/08/14 09:05:59 | 000,000,000 | -HSD | C] – C:\WINDOWS\System32\SysWoW32
[2010/08/14 09:05:44 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1174977794
[2010/08/14 09:05:28 | 000,316,928 | —- | C] (Borland Software Corporation) – C:\WINDOWS\System32\danim32.dll
[2010/08/14 07:47:51 | 000,000,000 | —D | C] – C:\Program Files\CyberLink
[2010/08/14 07:01:43 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\My Documents\My SureThing Projects
[2010/08/14 07:01:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Local Settings\Application Data\MicroVision Applications
[2010/08/14 07:01:29 | 000,487,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvcp70.dll
[2010/08/14 07:01:29 | 000,344,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvcr70.dll
[2010/08/14 07:01:28 | 000,000,000 | —D | C] – C:\Program Files\Common Files\SureThing Shared
[2010/08/14 07:01:24 | 000,000,000 | —D | C] – C:\Program Files\SureThing CD Labeler 5
[2010/08/13 17:47:44 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Application Data\NVIDIA
[2010/08/13 17:45:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Local Settings\Application Data\Cyberlink
[2010/08/13 17:43:50 | 000,000,000 | —D | C] – C:\Program Files\Common Files\CyberLink
[2010/08/13 16:30:57 | 000,000,000 | —D | C] – C:\Program Files\uTorrent
[2010/08/13 16:30:16 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Application Data\uTorrent
[2010/08/13 15:52:30 | 000,000,000 | —D | C] – C:\Program Files\LimeWire
[2010/08/13 15:47:19 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\CyberLink
[2010/08/13 15:35:51 | 000,000,000 | —D | C] – C:\Program Files\LightScribe Diagnostic Utility
[2010/07/24 10:31:33 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/07/24 10:31:18 | 000,153,376 | —- | C] (Oracle) – C:\WINDOWS\System32\javaws.exe
[2010/07/24 10:31:18 | 000,145,184 | —- | C] (Oracle) – C:\WINDOWS\System32\javaw.exe
[2010/07/24 10:31:18 | 000,145,184 | —- | C] (Oracle) – C:\WINDOWS\System32\java.exe
[2010/07/24 10:31:18 | 000,073,728 | —- | C] (Oracle) – C:\WINDOWS\System32\javacpl.cpl
[2010/07/19 20:28:38 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/07/19 20:28:34 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/08/15 13:12:13 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/08/15 13:11:41 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/08/15 13:11:39 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/08/15 13:11:38 | 3488,141,312 | -HS- | M] () – C:\hiberfil.sys
[2010/08/15 13:11:37 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\lvuvc.hs
[2010/08/15 13:11:35 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\logiflt.iad
[2010/08/15 12:11:10 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Matt\Desktop\OTL.exe
[2010/08/15 11:54:47 | 000,001,611 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\Spyware Doctor.lnk
[2010/08/15 11:49:02 | 000,293,376 | —- | M] () – C:\Documents and Settings\Matt\Desktop\dq5yotcj.exe
[2010/08/15 11:42:16 | 000,525,824 | —- | M] () – C:\Documents and Settings\Matt\Desktop\dds.scr
[2010/08/15 11:28:13 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{2DA6BE3E-518E-4316-866D-8BC21DE5086F}.job
[2010/08/15 11:24:29 | 010,223,616 | —- | M] () – C:\Documents and Settings\Matt\ntuser.dat
[2010/08/15 11:24:29 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Matt\ntuser.ini
[2010/08/15 11:24:27 | 003,712,656 | -H– | M] () – C:\Documents and Settings\Matt\Local Settings\Application Data\IconCache.db
[2010/08/15 07:16:00 | 000,416,619 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.bak
[2010/08/15 07:16:00 | 000,416,619 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/08/15 05:56:30 | 000,000,019 | —- | M] () – C:\WINDOWS\System32\24badd62
[2010/08/15 05:33:28 | 000,003,636 | -HS- | M] () – C:\Documents and Settings\Matt\Application Data\02000000a8df1c2f985P.manifest
[2010/08/14 17:40:24 | 000,000,471 | —- | M] () – C:\WINDOWS\wininit.ini
[2010/08/14 17:10:24 | 000,001,604 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk
[2010/08/14 17:01:26 | 000,002,463 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\HiJackThis.lnk
[2010/08/14 13:26:53 | 000,000,767 | —- | M] () – C:\Documents and Settings\Matt\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/08/14 13:26:31 | 000,000,610 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\ERUNT.lnk
[2010/08/14 10:27:20 | 000,000,138 | -HS- | M] () – C:\Documents and Settings\Matt\Application Data\02000000a8df1c2f985O.manifest
[2010/08/14 10:27:20 | 000,000,011 | -HS- | M] () – C:\Documents and Settings\Matt\Application Data\02000000a8df1c2f985S.manifest
[2010/08/14 10:27:19 | 000,000,051 | -HS- | M] () – C:\Documents and Settings\Matt\Application Data\02000000a8df1c2f985C.manifest
[2010/08/14 09:13:27 | 000,001,900 | —- | M] () – C:\WINDOWS\GnuHashes.ini
[2010/08/14 09:05:59 | 000,000,141 | —- | M] () – C:\WINDOWS\System32\sl1166743719
[2010/08/14 09:05:44 | 000,203,776 | -HS- | M] () – C:\WINDOWS\System32\unrar.exe
[2010/08/14 09:05:28 | 000,316,928 | —- | M] (Borland Software Corporation) – C:\WINDOWS\System32\danim32.dll
[2010/08/14 07:49:11 | 000,001,758 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\CyberLink PowerDVD 10.lnk
[2010/08/14 07:47:16 | 000,353,576 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msvcr71.dll
[2010/08/14 07:47:16 | 000,029,480 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msxml3a.dll
[2010/08/14 07:47:15 | 000,505,128 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msvcp71.dll
[2010/08/14 07:42:33 | 000,316,360 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/14 07:28:36 | 000,087,472 | —- | M] () – C:\Documents and Settings\Matt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/08/14 07:22:37 | 000,000,382 | —- | M] () – C:\WINDOWS\tasks\SmartDefrag.job
[2010/08/14 07:22:28 | 000,000,792 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\Smart Defrag.lnk
[2010/08/14 07:01:32 | 000,000,774 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\SureThing CD Labeler Deluxe 5.lnk
[2010/08/13 16:30:57 | 000,000,648 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2010/08/13 15:47:30 | 000,010,240 | —- | M] () – C:\Documents and Settings\Matt\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/13 15:40:20 | 000,001,815 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\LightScribe Diagnostic Utility.lnk
[2010/08/12 16:17:39 | 000,416,619 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100815-071600.backup
[2010/08/12 04:27:13 | 000,505,234 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/08/12 04:27:13 | 000,444,028 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/08/12 04:27:13 | 000,071,904 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/08/11 17:31:15 | 007,965,884 | —- | M] () – C:\Documents and Settings\Matt\Desktop\ACS Education Info.pdf
[2010/08/09 20:24:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/08/08 19:24:04 | 000,415,879 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100812-161739.backup
[2010/08/08 06:36:47 | 000,415,879 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100808-192404.backup
[2010/08/07 14:57:36 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/08/06 07:03:08 | 000,415,879 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100808-063646.backup
[2010/08/06 07:02:59 | 000,415,879 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100806-070308.backup
[2010/08/04 21:05:43 | 000,338,392 | —- | M] () – C:\Documents and Settings\Matt\Desktop\TransUnion Credit Report - August 2010 (2).pdf
[2010/08/04 21:02:53 | 000,253,842 | —- | M] () – C:\Documents and Settings\Matt\Desktop\TransUnion Credit Report - August 2010.pdf
[2010/08/04 20:59:42 | 000,197,184 | —- | M] () – C:\Documents and Settings\Matt\Desktop\Experian Credit Report - August 2010.pdf
[2010/08/04 20:56:11 | 000,632,291 | —- | M] () – C:\Documents and Settings\Matt\Desktop\Equifax Credit Report - August 2010.pdf
[2010/08/02 21:47:27 | 000,001,157 | —- | M] () – C:\WINDOWS\checkip.dat
[2010/08/02 21:46:14 | 000,001,157 | —- | M] () – C:\WINDOWS\ipconfig.dat
[2010/08/02 17:19:44 | 000,415,577 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100806-070259.backup
[2010/08/01 13:26:05 | 000,415,577 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100802-171944.backup
[2010/08/01 06:17:11 | 000,415,577 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100801-132605.backup
[2010/08/01 06:17:01 | 000,415,577 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100801-061711.backup
[2010/07/31 08:19:40 | 000,099,567 | —- | M] () – C:\Documents and Settings\Matt\Desktop\Motorcycle Superstore Return Confirmation.pdf
[2010/07/27 02:30:35 | 008,462,336 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shell32.dll
[2010/07/25 23:05:21 | 000,414,692 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100801-061701.backup
[2010/07/25 08:44:34 | 000,468,968 | —- | M] () – C:\Documents and Settings\Matt\Desktop\Flagstar Mortgage Payment Relief Form.pdf
[2010/07/25 08:33:49 | 000,377,309 | R— | M] () – C:\Documents and Settings\Matt\Desktop\Property Tax Information.pdf
[2010/07/25 08:32:54 | 000,836,688 | R— | M] () – C:\Documents and Settings\Matt\Desktop\GMAC Insurance Homeowners Program.pdf
[2010/07/24 10:49:36 | 000,414,692 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100725-230521.backup
[2010/07/24 10:40:36 | 000,232,968 | —- | M] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2010/07/24 10:40:36 | 000,000,001 | —- | M] () – C:\WINDOWS\System32\nvdrssel.bin
[2010/07/24 10:40:35 | 000,232,968 | —- | M] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2010/07/24 10:31:08 | 000,423,656 | —- | M] (Oracle) – C:\WINDOWS\System32\deployJava1.dll
[2010/07/24 10:31:08 | 000,153,376 | —- | M] (Oracle) – C:\WINDOWS\System32\javaws.exe
[2010/07/24 10:31:08 | 000,145,184 | —- | M] (Oracle) – C:\WINDOWS\System32\javaw.exe
[2010/07/24 10:31:08 | 000,145,184 | —- | M] (Oracle) – C:\WINDOWS\System32\java.exe
[2010/07/24 10:31:08 | 000,073,728 | —- | M] (Oracle) – C:\WINDOWS\System32\javacpl.cpl
[2010/07/21 18:41:28 | 000,107,188 | —- | M] () – C:\Documents and Settings\Matt\Desktop\Motorcyle Superstore.pdf
[2010/07/21 17:25:12 | 000,412,092 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100724-104936.backup
[2010/07/20 17:39:46 | 000,412,092 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100721-172512.backup
[2010/07/19 22:36:16 | 000,412,092 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100720-173946.backup
[2010/07/19 12:56:18 | 000,132,256 | —- | M] () – C:\Documents and Settings\Matt\Desktop\Cruiser Customizing.pdf
[2010/07/18 21:26:44 | 000,412,092 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100719-223616.backup
[2010/07/18 21:26:34 | 000,412,092 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100718-212644.backup
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/15 11:49:01 | 000,293,376 | —- | C] () – C:\Documents and Settings\Matt\Desktop\dq5yotcj.exe
[2010/08/15 11:42:16 | 000,525,824 | —- | C] () – C:\Documents and Settings\Matt\Desktop\dds.scr
[2010/08/15 11:25:10 | 3488,141,312 | -HS- | C] () – C:\hiberfil.sys
[2010/08/15 06:04:47 | 000,767,952 | —- | C] () – C:\WINDOWS\BDTSupport.dll
[2010/08/15 06:04:47 | 000,000,882 | —- | C] () – C:\WINDOWS\RegSDImport.xml
[2010/08/15 06:04:47 | 000,000,879 | —- | C] () – C:\WINDOWS\RegISSImport.xml
[2010/08/15 06:04:47 | 000,000,131 | —- | C] () – C:\WINDOWS\IDB.zip
[2010/08/15 06:04:46 | 001,152,444 | —- | C] () – C:\WINDOWS\UDB.zip
[2010/08/15 06:03:17 | 000,007,387 | —- | C] () – C:\WINDOWS\System32\drivers\pctgntdi.cat
[2010/08/15 06:03:12 | 000,007,412 | —- | C] () – C:\WINDOWS\System32\drivers\PCTAppEvent.cat
[2010/08/15 06:03:12 | 000,007,383 | —- | C] () – C:\WINDOWS\System32\drivers\pctcore.cat
[2010/08/15 06:03:08 | 000,001,611 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\Spyware Doctor.lnk
[2010/08/15 06:03:01 | 000,007,383 | —- | C] () – C:\WINDOWS\System32\drivers\pctplsg.cat
[2010/08/14 17:10:24 | 000,001,604 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk
[2010/08/14 17:01:08 | 000,002,463 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\HiJackThis.lnk
[2010/08/14 13:26:53 | 000,000,767 | —- | C] () – C:\Documents and Settings\Matt\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/08/14 13:26:31 | 000,000,610 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\ERUNT.lnk
[2010/08/14 12:50:57 | 000,000,019 | —- | C] () – C:\WINDOWS\System32\24badd62
[2010/08/14 10:22:15 | 000,000,471 | —- | C] () – C:\WINDOWS\wininit.ini
[2010/08/14 09:13:27 | 000,001,900 | —- | C] () – C:\WINDOWS\GnuHashes.ini
[2010/08/14 09:05:59 | 000,000,141 | —- | C] () – C:\WINDOWS\System32\sl1166743719
[2010/08/14 09:05:44 | 000,203,776 | -HS- | C] () – C:\WINDOWS\System32\unrar.exe
[2010/08/14 09:05:27 | 000,003,636 | -HS- | C] () – C:\Documents and Settings\Matt\Application Data\02000000a8df1c2f985P.manifest
[2010/08/14 09:05:27 | 000,000,138 | -HS- | C] () – C:\Documents and Settings\Matt\Application Data\02000000a8df1c2f985O.manifest
[2010/08/14 09:05:27 | 000,000,051 | -HS- | C] () – C:\Documents and Settings\Matt\Application Data\02000000a8df1c2f985C.manifest
[2010/08/14 09:05:27 | 000,000,011 | -HS- | C] () – C:\Documents and Settings\Matt\Application Data\02000000a8df1c2f985S.manifest
[2010/08/14 07:49:11 | 000,001,758 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\CyberLink PowerDVD 10.lnk
[2010/08/14 07:22:37 | 000,000,382 | —- | C] () – C:\WINDOWS\tasks\SmartDefrag.job
[2010/08/14 07:22:28 | 000,000,792 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\Smart Defrag.lnk
[2010/08/14 07:01:32 | 000,000,774 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\SureThing CD Labeler Deluxe 5.lnk
[2010/08/13 16:30:57 | 000,000,648 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2010/08/13 15:40:20 | 000,001,815 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\LightScribe Diagnostic Utility.lnk
[2010/08/09 15:59:24 | 007,965,884 | —- | C] () – C:\Documents and Settings\Matt\Desktop\ACS Education Info.pdf
[2010/08/04 21:05:58 | 000,338,392 | —- | C] () – C:\Documents and Settings\Matt\Desktop\TransUnion Credit Report - August 2010 (2).pdf
[2010/08/04 21:03:03 | 000,253,842 | —- | C] () – C:\Documents and Settings\Matt\Desktop\TransUnion Credit Report - August 2010.pdf
[2010/08/04 20:59:52 | 000,197,184 | —- | C] () – C:\Documents and Settings\Matt\Desktop\Experian Credit Report - August 2010.pdf
[2010/08/04 20:45:06 | 000,632,291 | —- | C] () – C:\Documents and Settings\Matt\Desktop\Equifax Credit Report - August 2010.pdf
[2010/08/02 21:47:27 | 000,001,157 | —- | C] () – C:\WINDOWS\checkip.dat
[2010/08/02 21:42:39 | 000,001,157 | —- | C] () – C:\WINDOWS\ipconfig.dat
[2010/07/31 08:20:00 | 000,099,567 | —- | C] () – C:\Documents and Settings\Matt\Desktop\Motorcycle Superstore Return Confirmation.pdf
[2010/07/25 08:44:46 | 000,468,968 | —- | C] () – C:\Documents and Settings\Matt\Desktop\Flagstar Mortgage Payment Relief Form.pdf
[2010/07/25 08:34:10 | 000,377,309 | R— | C] () – C:\Documents and Settings\Matt\Desktop\Property Tax Information.pdf
[2010/07/21 18:41:42 | 000,107,188 | —- | C] () – C:\Documents and Settings\Matt\Desktop\Motorcyle Superstore.pdf
[2010/07/20 21:17:36 | 000,836,688 | R— | C] () – C:\Documents and Settings\Matt\Desktop\GMAC Insurance Homeowners Program.pdf
[2010/07/19 12:56:38 | 000,132,256 | —- | C] () – C:\Documents and Settings\Matt\Desktop\Cruiser Customizing.pdf
[2010/05/14 17:56:06 | 010,830,680 | —- | C] () – C:\WINDOWS\System32\LogiDPP.dll
[2010/05/14 17:55:58 | 000,290,648 | —- | C] () – C:\WINDOWS\System32\DevManagerCore.dll
[2010/05/07 18:46:36 | 000,014,168 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2010/05/07 18:43:30 | 000,025,824 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2010/03/16 16:14:10 | 000,090,071 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2010/01/27 22:46:53 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\custmon32.dll
[2010/01/16 14:52:54 | 000,002,657 | —- | C] () – C:\WINDOWS\DevMgr.ini
[2010/01/16 14:51:39 | 000,000,020 | —- | C] () – C:\WINDOWS\Hposcv07.INI
[2010/01/14 18:22:53 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2010/01/14 00:05:22 | 000,024,576 | R— | C] () – C:\WINDOWS\System32\AsIO.dll
[2010/01/14 00:05:22 | 000,012,400 | R— | C] () – C:\WINDOWS\System32\drivers\AsIO.sys
[2010/01/14 00:05:19 | 000,011,832 | —- | C] () – C:\WINDOWS\System32\drivers\AsInsHelp64.sys
[2010/01/14 00:05:19 | 000,010,216 | —- | C] () – C:\WINDOWS\System32\drivers\AsInsHelp32.sys
[2010/01/13 11:56:13 | 000,019,691 | —- | C] () – C:\WINDOWS\Ascd_log.ini
[2010/01/13 11:54:58 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2010/01/13 11:54:48 | 000,015,738 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2010/01/13 11:54:48 | 000,010,296 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009/08/03 16:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2002/09/26 16:48:46 | 000,159,744 | —- | C] () – C:\WINDOWS\System32\win2000.dll

========== LOP Check ==========

[2010/01/17 09:00:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LightScribe
[2010/08/15 13:11:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/06/19 18:44:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/01/14 20:12:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\Foxit
[2010/03/21 12:53:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\Foxit Software
[2010/08/15 07:39:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\GetRightToGo
[2010/02/02 21:28:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\IObit
[2010/01/14 00:59:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\Leadertech
[2010/01/20 06:19:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\mjusbsp
[2010/03/03 19:59:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\MyScribe
[2010/08/15 06:10:56 | 000,000,000 | -HSD | M] – C:\Documents and Settings\Matt\Application Data\SystemProc
[2010/08/15 13:12:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\uTorrent
[2010/04/18 19:38:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\webex
[2010/05/31 19:30:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\WinPatrol
[2010/08/14 07:22:37 | 000,000,382 | —- | M] () – C:\WINDOWS\Tasks\SmartDefrag.job
[2010/08/15 11:28:13 | 000,000,420 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{2DA6BE3E-518E-4316-866D-8BC21DE5086F}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/01/13 11:16:06 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/03/18 17:29:45 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2010/01/13 11:16:06 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/08/15 13:11:38 | 3488,141,312 | -HS- | M] () – C:\hiberfil.sys
[2010/01/13 11:16:06 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/01/13 11:16:06 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008/04/14 08:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/04/14 08:00:00 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/08/15 13:11:34 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2010/08/15 09:43:56 | 000,000,296 | —- | M] () – C:\VundoFix.txt

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010/01/13 11:15:42 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2008/07/06 08:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[5 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2010/01/13 05:58:28 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2010/01/13 05:58:28 | 001,089,536 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2010/01/13 05:58:28 | 000,933,888 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/14 08:00:00 | 000,578,560 | —- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B – C:\WINDOWS\system32\user32.dll
[5 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/14 08:00:00 | 000,082,432 | —- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A – C:\WINDOWS\system32\ws2_32.dll
[5 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/14 08:00:00 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 – C:\WINDOWS\system32\ws2help.dll
[5 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-08-12 08:28:07

========== Alternate Data Streams ==========

@Alternate Data Stream - 190 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EA029835
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
< End of report >

OTL Extras logfile created on: 8/15/2010 1:13:51 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Matt\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 80.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 423.71 Gb Free Space | 90.97% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME-AD798B7B7F
Current User Name: Matt
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Windows Shell – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook – (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove – (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote – (Microsoft Corporation)
"C:\Documents and Settings\Matt\Application Data\mjusbsp\magicJack.exe" = C:\Documents and Settings\Matt\Application Data\mjusbsp\magicJack.exe:*:Enabled:magicJack – (magicJack L.P.)
"C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe" = C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe:LocalSubNet:Disabled:Intuit Update Shared Downloads Server – (Intuit Inc.)
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test – (Microsoft Corporation)
"C:\Documents and Settings\Matt\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll" = C:\Documents and Settings\Matt\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll:*:Enabled:Google Talk Plugin – File not found
"C:\Documents and Settings\Matt\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\Matt\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin – File not found
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\Logitech\Logitech Vid\Vid.exe" = C:\Program Files\Logitech\Logitech Vid\Vid.exe:*:Enabled:Logitech Vid HD – (Logitech Inc.)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire – File not found

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{209DF55F-5E5C-48A3-BC3D-A7CB1224458C}" = HP Print Diagnostic Utility
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 21
"{310BC5E2-31AF-49BB-904D-E71EB93645DC}" = AI Suite
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset
"{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine
"{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport
"{3BAC6780-EAA2-012B-AE74-000000000000}" = TurboTax 2009 wohiper
"{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4ED7D297-58F7-45C3-A9BA-A7CD6FA0D373}_is1" = SureThing CD Labeler Deluxe 5
"{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}" = Logitech Vid
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{6E06FC10-2DA5-42AA-A1E5-2D8AEF651033}" = SecurDisc Viewer
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7A73EFB4-C362-4395-83D5-E0C6C53677FE}" = LightScribe Diagnostic Utility
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{818ABC3C-635C-4651-8183-D0E9640B7DD1}" = HP Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8B7917E0-AF55-4E8A-9473-017F0AA03AC8}" = QuickTime
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{93099B48-E36A-46C9-A03F-C85201D9B1C1}" = Foxit PDF IFilter
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1.2
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1E11C46-E6EB-4BD2-9ADF-2A98ACBEB216}" = iTunes
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{DB6BD5D5-8482-45C0-99CF-745C5B924497}" = WOT for Internet Explorer
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FD71E2F7-B9FC-4072-88DB-AC19E2464D82}" = LightScribe System Software
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Browser Defender_is1" = Browser Defender 2.0.6.15
"CCleaner" = CCleaner
"ENTERPRISER" = Microsoft Office Enterprise 2007
"ERUNT_is1" = ERUNT 1.1j
"FileHippo.com" = FileHippo.com Update Checker
"Foxit PDF Editor" = Foxit PDF Editor
"Foxit Reader" = Foxit Reader
"hp psc 900 series 1263667973" = hp psc 900 series
"ie8" = Windows Internet Explorer 8
"InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"lvdrivers_12.10" = Logitech Webcam Software Driver Package
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"PDFCreator" = PDFCreator
"Smart Defrag_is1" = Smart Defrag Server 2010 Trail
"SP6" = Logitech SetPoint 6.15
"Spyware Doctor" = Spyware Doctor 7.0
"SpywareBlaster_is1" = SpywareBlaster 4.3
"TurboTax 2009" = TurboTax 2009
"uTorrent" = µTorrent
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinPatrol" = WinPatrol
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"LastPass" = LastPass (uninstall only)

========== Last 10 Event Log Errors ==========

[ OSession Events ]
Error - 1/15/2010 6:55:55 PM | Computer Name = HOME-AD798B7B7F | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 19196
seconds with 13320 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 8/15/2010 9:28:46 AM | Computer Name = HOME-AD798B7B7F | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 8/15/2010 9:30:06 AM | Computer Name = HOME-AD798B7B7F | Source = Service Control Manager | ID = 7001
Description = The DHCP Client service depends on the NetBios over Tcpip service
which failed to start because of the following error: %%31

Error - 8/15/2010 9:30:06 AM | Computer Name = HOME-AD798B7B7F | Source = Service Control Manager | ID = 7001
Description = The DNS Client service depends on the TCP/IP Protocol Driver service
which failed to start because of the following error: %%31

Error - 8/15/2010 9:30:06 AM | Computer Name = HOME-AD798B7B7F | Source = Service Control Manager | ID = 7001
Description = The TCP/IP NetBIOS Helper service depends on the AFD service which
failed to start because of the following error: %%31

Error - 8/15/2010 9:30:06 AM | Computer Name = HOME-AD798B7B7F | Source = Service Control Manager | ID = 7001
Description = The Apple Mobile Device service depends on the TCP/IP Protocol Driver
service which failed to start because of the following error: %%31

Error - 8/15/2010 9:30:06 AM | Computer Name = HOME-AD798B7B7F | Source = Service Control Manager | ID = 7001
Description = The Bonjour Service service depends on the TCP/IP Protocol Driver
service which failed to start because of the following error: %%31

Error - 8/15/2010 9:30:06 AM | Computer Name = HOME-AD798B7B7F | Source = Service Control Manager | ID = 7001
Description = The IPSEC Services service depends on the IPSEC driver service which
failed to start because of the following error: %%31

Error - 8/15/2010 9:30:06 AM | Computer Name = HOME-AD798B7B7F | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD AsIO avgio avipbb Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss ssmdrv Tcpip WS2IFSL

Error - 8/15/2010 11:24:28 AM | Computer Name = HOME-AD798B7B7F | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 8/15/2010 12:19:34 PM | Computer Name = HOME-AD798B7B7F | Source = System Error | ID = 1003
Description = Error code 1000000a, parameter1 c05c4000, parameter2 00000002, parameter3
00000001, parameter4 805462f0.

< End of report >

oldman960

Post #6August 15, 2010, 5:40 PM UTC

Hi mstein66, Seems like RPMcMurphy and I posted at the same time. He will continue helping you.

RPMcMurphy

Post #7August 15, 2010, 7:00 PM UTC

Hello,

Sorry about the confusion there.

🖼Click to load external image (Posted Image) You have a trial verson of IObit SmartDefrag installed. IObit has been accused of stealing and incorporating Malwarebytes AntiMalware proprietary database and intellectual property into their software. More information is available HERE. I strongly recommend that you unistall that software.

🖼Click to load external image (Posted Image) Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:

ComboFix log

mstein66

Post #8August 16, 2010, 7:30 PM UTC

Here is the ComboFix Log – can you recommend a replacement for the IObit Defrag.

ComboFix 10-08-15.04 - Matt 08/16/2010 15:22:21.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2558 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Matt\Application Data\02000000a8df1c2f985C.manifest
c:\documents and settings\Matt\Application Data\02000000a8df1c2f985O.manifest
c:\documents and settings\Matt\Application Data\02000000a8df1c2f985P.manifest
c:\documents and settings\Matt\Application Data\02000000a8df1c2f985S.manifest
c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{4a95b579-b4b6-43f9-8266-11741d9e5477}
c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{4a95b579-b4b6-43f9-8266-11741d9e5477}\chrome.manifest
c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{4a95b579-b4b6-43f9-8266-11741d9e5477}\chrome\xulcache.jar
c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{4a95b579-b4b6-43f9-8266-11741d9e5477}\defaults\preferences\xulcache.js
c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{4a95b579-b4b6-43f9-8266-11741d9e5477}\install.rdf
c:\documents and settings\Matt\Application Data\SystemProc
c:\windows\GnuHashes.ini
c:\windows\system32\1174977794
c:\windows\system32\DANIM32.DLL
c:\windows\system32\SysWoW32
c:\windows\system32\SysWoW32\mu778076223v4
c:\windows\system32\SysWoW32\mu778076223v4.kwd
c:\windows\system32\SysWoW32\mu778076223v5
c:\windows\system32\SysWoW32\mu778076223v5.kwd
c:\windows\system32\SysWoW32\mu778076223v6
c:\windows\system32\SysWoW32\mu778076223v6.kwd
c:\windows\system32\SysWoW32\mu778076223v7
c:\windows\system32\SysWoW32\mu778076223v7.kwd
c:\windows\system32\SysWoW32\wu778076223v0
c:\windows\system32\SysWoW32\wu778076223v0.kwd
c:\windows\system32\SysWoW32\wu778076223v1
c:\windows\system32\SysWoW32\wu778076223v1.kwd
c:\windows\system32\SysWoW32\wu778076223v2
c:\windows\system32\SysWoW32\wu778076223v2.kwd
c:\windows\system32\SysWoW32\wu778076223v3
c:\windows\system32\SysWoW32\wu778076223v3.kwd
c:\windows\system32\unrar.exe

.
((((((((((((((((((((((((( Files Created from 2010-07-16 to 2010-08-16 )))))))))))))))))))))))))))))))
.

2010-08-15 12:10 . 2010-08-15 12:10 ——– d—–w- C:\VundoFix Backups
2010-08-15 11:37 . 2010-08-15 11:39 ——– d—–w- c:\documents and settings\Matt\Application Data\GetRightToGo
2010-08-15 10:04 . 2010-01-22 13:56 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-08-15 10:04 . 2010-01-22 13:55 767952 —-a-w- c:\windows\BDTSupport.dll
2010-08-15 10:04 . 2008-11-26 16:08 131 —-a-w- c:\windows\IDB.zip
2010-08-15 10:04 . 2010-01-22 13:56 165840 —-a-w- c:\windows\PCTBDRes.dll
2010-08-15 10:04 . 2010-01-22 13:56 1652688 —-a-w- c:\windows\PCTBDCore.dll
2010-08-15 10:04 . 2009-10-28 05:36 1152444 —-a-w- c:\windows\UDB.zip
2010-08-15 10:03 . 2010-02-05 13:17 233136 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2010-08-15 10:03 . 2010-03-29 14:06 218592 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2010-08-15 10:03 . 2009-11-23 17:54 88040 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-08-15 10:03 . 2010-04-08 18:29 63360 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2010-08-15 10:02 . 2010-08-16 19:16 ——– d—–w- c:\program files\Spyware Doctor
2010-08-15 10:02 . 2010-08-15 10:05 ——– d—–w- c:\program files\Common Files\PC Tools
2010-08-15 10:02 . 2010-08-15 10:02 ——– d—–w- c:\documents and settings\Matt\Application Data\PC Tools
2010-08-15 10:02 . 2010-08-15 10:02 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2010-08-14 21:09 . 2010-08-14 21:09 ——– d—–w- c:\program files\QuickTime
2010-08-14 17:26 . 2010-08-14 17:26 ——– d—–w- c:\program files\ERUNT
2010-08-14 17:15 . 2010-08-14 17:15 388096 —-a-r- c:\documents and settings\Matt\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-08-14 17:15 . 2010-08-14 17:15 ——– d—–w- c:\program files\Trend Micro
2010-08-14 11:47 . 2010-08-14 11:48 ——– d—–w- c:\program files\CyberLink
2010-08-14 11:01 . 2010-08-14 11:17 ——– d—–w- c:\documents and settings\Matt\Local Settings\Application Data\MicroVision Applications
2010-08-14 11:01 . 2006-09-21 11:42 487424 —-a-w- c:\windows\system32\msvcp70.dll
2010-08-14 11:01 . 2006-09-21 11:42 344064 —-a-w- c:\windows\system32\msvcr70.dll
2010-08-14 11:01 . 2010-08-14 11:01 ——– d—–w- c:\program files\Common Files\SureThing Shared
2010-08-14 11:01 . 2010-08-14 11:01 ——– d—–w- c:\program files\SureThing CD Labeler 5
2010-08-13 21:59 . 2010-08-13 21:59 53319 —-a-w- c:\documents and settings\All Users\Application Data\TEMP\{8C20787A-7402-4FA7-BF25-6E5750930FDC}\PostBuild.exe
2010-08-13 21:47 . 2010-08-13 21:47 ——– d—–w- c:\documents and settings\Matt\Application Data\NVIDIA
2010-08-13 21:45 . 2010-08-13 21:45 ——– d—–w- c:\documents and settings\Matt\Local Settings\Application Data\Cyberlink
2010-08-13 21:43 . 2010-08-13 21:43 ——– d—–w- c:\program files\Common Files\CyberLink
2010-08-13 21:42 . 2010-08-14 11:47 53319 —-a-w- c:\documents and settings\All Users\Application Data\TEMP\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}\PostBuild.exe
2010-08-13 20:30 . 2010-08-13 20:30 ——– d—–w- c:\program files\uTorrent
2010-08-13 20:30 . 2010-08-16 19:17 ——– d—–w- c:\documents and settings\Matt\Application Data\uTorrent
2010-08-13 19:52 . 2010-08-15 11:23 ——– d—–w- c:\program files\LimeWire
2010-08-13 19:47 . 2010-08-13 19:47 ——– d—–w- c:\documents and settings\LocalService\Application Data\CyberLink
2010-08-13 19:35 . 2010-08-13 19:35 ——– d—–w- c:\program files\LightScribe Diagnostic Utility
2010-08-06 22:48 . 2010-08-06 22:48 61440 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-72e332a5-n\decora-sse.dll
2010-08-06 22:48 . 2010-08-06 22:48 12800 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-72e332a5-n\decora-d3d.dll
2010-08-06 22:48 . 2010-08-06 22:48 503808 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-7596ec1d-n\msvcp71.dll
2010-08-06 22:48 . 2010-08-06 22:48 499712 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-7596ec1d-n\jmc.dll
2010-08-06 22:48 . 2010-08-06 22:48 348160 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-7596ec1d-n\msvcr71.dll
2010-08-03 02:52 . 2010-08-03 02:52 53248 —-a-r- c:\documents and settings\Matt\Application Data\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2010-08-03 01:47 . 2010-08-03 01:47 1157 —-a-w- c:\windows\checkip.dat
2010-08-03 01:42 . 2010-08-03 01:46 1157 —-a-w- c:\windows\ipconfig.dat
2010-08-03 00:33 . 2010-08-03 00:33 ——– d—–w- c:\windows\system32\wbem\Repository
2010-07-24 14:31 . 2010-07-24 14:31 ——– d—–w- c:\program files\Common Files\Java
2010-07-20 00:28 . 2010-07-20 00:28 ——– d—–w- c:\program files\iPod
2010-07-20 00:28 . 2010-07-20 00:28 ——– d—–w- c:\program files\iTunes
2010-07-20 00:24 . 2010-07-20 00:24 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.4\SetupAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-16 19:17 . 2010-03-18 21:55 ——– d—–w- c:\documents and settings\Matt\Application Data\Skype
2010-08-16 19:16 . 2010-01-15 00:47 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-08-16 18:16 . 2010-03-18 21:58 ——– d—–w- c:\documents and settings\Matt\Application Data\skypePM
2010-08-16 18:14 . 2010-03-16 20:14 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2010-08-16 18:14 . 2010-03-16 20:14 0 —-a-w- c:\windows\system32\drivers\logiflt.iad
2010-08-16 01:31 . 2010-01-15 00:47 ——– d—–w- c:\program files\SpywareBlaster
2010-08-15 13:29 . 2010-01-15 00:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-14 21:11 . 2010-06-19 22:43 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-08-14 13:05 . 2010-08-14 13:05 1160704 –sha-w- c:\windows\system32\99.tmp
2010-08-14 12:55 . 2010-01-20 23:26 ——– d—–w- c:\documents and settings\All Users\Application Data\CyberLink
2010-08-14 11:48 . 2010-01-13 15:57 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-08-14 11:47 . 2010-01-14 04:34 29480 —-a-w- c:\windows\system32\msxml3a.dll
2010-08-14 11:47 . 2010-01-14 04:33 353576 —-a-w- c:\windows\system32\msvcr71.dll
2010-08-14 11:47 . 2010-01-14 04:33 505128 —-a-w- c:\windows\system32\msvcp71.dll
2010-08-14 11:28 . 2010-01-13 15:42 87472 —-a-w- c:\documents and settings\Matt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-13 21:45 . 2010-01-20 23:26 ——– d—–w- c:\documents and settings\Matt\Application Data\CyberLink
2010-08-13 19:15 . 2010-01-14 04:35 ——– d—–w- c:\program files\Nero
2010-08-13 19:14 . 2010-01-14 04:39 ——– d—–w- c:\documents and settings\All Users\Application Data\Nero
2010-08-13 18:34 . 2010-01-15 01:04 ——– d—–w- c:\documents and settings\Matt\Application Data\Nero
2010-08-13 18:25 . 2010-01-17 13:07 ——– d—–w- c:\program files\Common Files\LightScribe
2010-08-12 08:27 . 2010-01-14 05:09 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-07 18:57 . 2010-04-19 19:55 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-08-03 02:52 . 2010-01-14 04:58 ——– d—–w- c:\program files\Common Files\Logishrd
2010-08-03 02:52 . 2010-03-03 23:49 ——– d—–w- c:\program files\Logitech
2010-08-03 02:52 . 2010-03-03 23:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Logishrd
2010-08-03 02:50 . 2010-01-15 01:08 ——– d—–w- c:\program files\CCleaner
2010-07-24 14:51 . 2010-01-14 04:35 ——– d—–w- c:\program files\Common Files\Ahead
2010-07-24 14:41 . 2010-01-13 15:57 ——– d—–w- c:\program files\NVIDIA Corporation
2010-07-24 14:40 . 2010-06-30 16:32 232968 —-a-w- c:\windows\system32\nvdrsdb0.bin
2010-07-24 14:40 . 2010-06-30 16:32 1 —-a-w- c:\windows\system32\nvdrssel.bin
2010-07-24 14:40 . 2010-06-30 16:32 232968 —-a-w- c:\windows\system32\nvdrsdb1.bin
2010-07-24 14:31 . 2010-04-17 00:05 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-20 00:28 . 2010-01-22 21:22 ——– d—–w- c:\program files\Common Files\Apple
2010-07-13 19:46 . 2010-01-14 22:30 ——– d—–w- c:\program files\LastPass
2010-07-12 15:32 . 2010-07-12 20:36 822784 —-a-w- c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\[removed]\platform\WINNT_x86-msvc\components\lpxpcom.dll
2010-07-09 20:24 . 2010-07-09 20:24 81920 —-a-w- c:\windows\system32\nvwddi.dll
2010-07-09 20:24 . 2010-07-09 20:24 277608 —-a-w- c:\windows\system32\nvmccs.dll
2010-07-09 20:24 . 2010-07-09 20:24 110696 —-a-w- c:\windows\system32\nvmctray.dll
2010-07-09 20:24 . 2010-07-09 20:24 155752 —-a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 20:24 . 2010-07-09 20:24 145000 —-a-w- c:\windows\system32\nvcolor.exe
2010-07-09 20:24 . 2010-07-09 20:24 13923432 —-a-w- c:\windows\system32\nvcpl.dll
2010-07-07 17:46 . 2010-01-13 15:34 604776 —-a-w- c:\windows\system32\NVUNINST.EXE
2010-07-05 23:28 . 2010-03-03 23:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Logitech
2010-07-05 23:28 . 2010-07-05 23:28 ——– d—–w- c:\program files\Common Files\LWS
2010-07-05 13:42 . 2010-01-15 00:52 ——– d—–w- c:\program files\IZArc
2010-06-30 12:31 . 2008-04-14 12:00 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-30 10:58 . 2010-01-14 04:45 ——– d—–w- c:\program files\Windows Media Connect 2
2010-06-29 19:31 . 2010-06-29 19:31 ——– d—–w- c:\documents and settings\Guest\Application Data\Avira
2010-06-24 12:22 . 2008-04-14 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-06-23 21:45 . 2010-06-23 21:45 71000 —-a-w- c:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-23 13:44 . 2008-04-14 12:00 1851904 —-a-w- c:\windows\system32\win32k.sys
2010-06-22 08:30 . 2010-06-22 08:30 61440 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4481cf57-n\decora-sse.dll
2010-06-22 08:30 . 2010-06-22 08:30 503808 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-13243215-n\msvcp71.dll
2010-06-22 08:30 . 2010-06-22 08:30 499712 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-13243215-n\jmc.dll
2010-06-22 08:30 . 2010-06-22 08:30 348160 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-13243215-n\msvcr71.dll
2010-06-22 08:30 . 2010-06-22 08:30 12800 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4481cf57-n\decora-d3d.dll
2010-06-21 21:01 . 2010-06-21 21:01 ——– d—–w- c:\documents and settings\Guest\Application Data\Logitech
2010-06-21 21:01 . 2010-06-21 21:01 ——– d—–w- c:\documents and settings\Guest\Application Data\IObit
2010-06-21 21:01 . 2010-06-21 21:01 ——– d—–w- c:\documents and settings\Guest\Application Data\WinPatrol
2010-06-21 15:27 . 2008-04-14 12:00 354304 —-a-w- c:\windows\system32\drivers\srv.sys
2010-06-19 23:09 . 2010-03-26 21:18 ——– d—–w- c:\documents and settings\Matt\Application Data\Apple Computer
2010-06-19 22:44 . 2010-06-19 22:43 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-06-19 22:42 . 2010-06-19 22:42 ——– d—–w- c:\program files\Apple Software Update
2010-06-19 22:42 . 2010-06-19 22:42 ——– d—–w- c:\program files\Bonjour
2010-06-17 14:03 . 2008-04-14 12:00 80384 —-a-w- c:\windows\system32\iccvid.dll
2010-06-15 08:30 . 2010-03-03 23:50 16400 —-a-w- c:\windows\system32\drivers\LNonPnP.sys
2010-06-14 14:31 . 2010-01-13 15:13 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2008-04-14 12:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2010-05-24 19:29 . 2010-05-24 19:29 61440 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-69fa5926-n\decora-sse.dll
2010-05-24 19:29 . 2010-05-24 19:29 503808 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6db8c008-n\msvcp71.dll
2010-05-24 19:29 . 2010-05-24 19:29 499712 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6db8c008-n\jmc.dll
2010-05-24 19:29 . 2010-05-24 19:29 348160 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6db8c008-n\msvcr71.dll
2010-05-24 19:29 . 2010-05-24 19:29 12800 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-69fa5926-n\decora-d3d.dll
2010-05-18 20:35 . 2010-05-18 20:35 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-05-18 20:35 . 2010-05-18 20:35 75040 —-a-w- c:\windows\system32\jdns_sd.dll
2010-05-18 20:35 . 2010-05-18 20:35 197920 —-a-w- c:\windows\system32\dnssdX.dll
2010-05-18 20:35 . 2010-05-18 20:35 107808 —-a-w- c:\windows\system32\dns-sd.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2010-04-29 248832]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-08-13 327472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2010-05-31 323976]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
"QFan Help"="c:\program files\ASUS\Ai Suite\QFan3\QFanHelp.exe" [2009-04-30 598528]
"CPU Power Monitor"="c:\program files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe" [2008-01-09 627200]
"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2007-12-01 881152]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"ASUS Energy Saving"="c:\program files\ASUS\Ai Suite\EnergySaving\PwSave.exe" [2009-01-23 1352704]
"Ai Nap"="c:\program files\ASUS\Ai Suite\AiNap\AiNap.exe" [2009-05-25 1431040]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-07 165208]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
"RemoteControl10"="c:\program files\CyberLink\PowerDVD10\PDVD10Serv.exe" [2010-02-03 87336]
"BDRegion"="c:\program files\Cyberlink\Shared files\brs.exe" [2010-06-28 75048]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-02-15 417792]

c:\documents and settings\Matt\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-01-29 21:17 64592 —-a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^Matt^Start Menu^Programs^Startup^Hewlett-Packard Recorder.lnk]
path=c:\documents and settings\Matt\Start Menu\Programs\Startup\Hewlett-Packard Recorder.lnk
backup=c:\windows\pss\Hewlett-Packard Recorder.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EvtMgr6]
2010-06-26 00:15 1311312 —-a-w- c:\program files\Logitech\SetPointP\SetPoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-12-08 20:50 54576 —-a-w- c:\program files\Hp\HP Software Update\hpwuschd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2010-07-21 16:22 2736128 —-a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2010-07-09 20:24 13923432 —-a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2010-07-09 20:24 110696 —-a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-02-15 22:50 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"cdloader"="c:\documents and settings\Matt\Application Data\mjusbsp\cdloader2.exe" MAGICJACK

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\Matt\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [8/15/2010 6:03 AM 218592]
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/08/14 07:48];c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl [6/28/2010 10:50 PM 87536]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1/14/2010 12:56 AM 135336]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [8/15/2010 6:04 AM 112592]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [1/14/2010 12:59 AM 10448]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [8/15/2010 6:02 AM 366840]
S3 SureThing Labelflash service;SureThing Labelflash service;c:\program files\Common Files\SureThing Shared\stllssvr.exe [8/14/2010 7:01 AM 74392]

— Other Services/Drivers In Memory —

*Deregistered* - PCTSDInjDriver32

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-07-21 16:20 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-08-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]

2010-08-16 c:\windows\Tasks\User_Feed_Synchronization-{2DA6BE3E-518E-4316-866D-8BC21DE5086F}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://msn.foxsports.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: LastPass - file://c:\program files\LastPass\context.html?cmd=lastpass
IE: LastPass Fill Forms - file://c:\program files\LastPass\context.html?cmd=fillforms
LSP: %SYSTEMROOT%\system32\nvLsp.dll
Trusted Zone: intuit.com\ttlc
FF - ProfilePath - c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\
FF - prefs.js: browser.startup.homepage - hxxp://rivals.yahoo.com/ncaa/football;_ylt=ArvpMQPmZicaZaD72iFcaJs5nYcB
FF - component: c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\[removed]\platform\WINNT_x86-msvc\components\lpxpcom.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-SmartDefrag - c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
MSConfigStartUp-LanguageShortcut - c:\program files\CyberLink\PowerDVD\Language\Language.exe
MSConfigStartUp-LogitechQuickCamRibbon - c:\program files\Logitech\Logitech WebCam Software\LWS.exe
MSConfigStartUp-NeroFilterCheck - c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
MSConfigStartUp-RemoteControl - c:\program files\CyberLink\PowerDVD\PDVDServ.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-16 15:24
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(748)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

- - - - - - - > 'lsass.exe'(804)
c:\windows\system32\nvLsp.dll
.
Completion time: 2010-08-16 15:27:07
ComboFix-quarantined-files.txt 2010-08-16 19:27

Pre-Run: 453,572,485,120 bytes free
Post-Run: 453,564,977,152 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 38AC6F598CB2B145AD6EFBC295F901A8

RPMcMurphy

Post #9August 16, 2010, 9:12 PM UTC

Hi,

If you're looking for a replacement for the Windows Defrag tool try Priniform's Degraggler.

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above http://

http://forums.whatthetech.com/index.php?showtopic=113967
Collect::
c:\windows\system32\99.tmp
DDS::
uInternet Settings,ProxyOverride = *.local

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

🖼Click to load external image (Posted Image) Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please post the results.

Please include the following in your next post:

ComboFix log

MBAM log

mstein66

Post #10August 17, 2010, 12:35 AM UTC

Hello,

Here are the next 2 logs:

ComboFix 10-08-16.03 - Matt 08/16/2010 19:54:00.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2300 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Matt\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

file zipped: c:\windows\system32\99.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\99.tmp

.
((((((((((((((((((((((((( Files Created from 2010-07-16 to 2010-08-16 )))))))))))))))))))))))))))))))
.

2010-08-16 19:35 . 2010-08-16 19:35 ——– d—–w- c:\documents and settings\Matt\Local Settings\Application Data\Threat Expert
2010-08-15 12:10 . 2010-08-15 12:10 ——– d—–w- C:\VundoFix Backups
2010-08-15 11:37 . 2010-08-15 11:39 ——– d—–w- c:\documents and settings\Matt\Application Data\GetRightToGo
2010-08-15 10:04 . 2010-01-22 13:56 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-08-15 10:04 . 2010-01-22 13:55 767952 —-a-w- c:\windows\BDTSupport.dll
2010-08-15 10:04 . 2008-11-26 16:08 131 —-a-w- c:\windows\IDB.zip
2010-08-15 10:04 . 2010-01-22 13:56 165840 —-a-w- c:\windows\PCTBDRes.dll
2010-08-15 10:04 . 2010-01-22 13:56 1652688 —-a-w- c:\windows\PCTBDCore.dll
2010-08-15 10:04 . 2009-10-28 05:36 1152444 —-a-w- c:\windows\UDB.zip
2010-08-15 10:03 . 2010-02-05 13:17 233136 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2010-08-15 10:03 . 2010-03-29 14:06 218592 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2010-08-15 10:03 . 2009-11-23 17:54 88040 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-08-15 10:03 . 2010-04-08 18:29 63360 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2010-08-15 10:02 . 2010-08-16 19:16 ——– d—–w- c:\program files\Spyware Doctor
2010-08-15 10:02 . 2010-08-15 10:05 ——– d—–w- c:\program files\Common Files\PC Tools
2010-08-15 10:02 . 2010-08-15 10:02 ——– d—–w- c:\documents and settings\Matt\Application Data\PC Tools
2010-08-15 10:02 . 2010-08-15 10:02 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2010-08-14 21:09 . 2010-08-14 21:09 ——– d—–w- c:\program files\QuickTime
2010-08-14 17:26 . 2010-08-14 17:26 ——– d—–w- c:\program files\ERUNT
2010-08-14 17:15 . 2010-08-14 17:15 388096 —-a-r- c:\documents and settings\Matt\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-08-14 17:15 . 2010-08-14 17:15 ——– d—–w- c:\program files\Trend Micro
2010-08-14 11:47 . 2010-08-14 11:48 ——– d—–w- c:\program files\CyberLink
2010-08-14 11:01 . 2010-08-14 11:17 ——– d—–w- c:\documents and settings\Matt\Local Settings\Application Data\MicroVision Applications
2010-08-14 11:01 . 2006-09-21 11:42 487424 —-a-w- c:\windows\system32\msvcp70.dll
2010-08-14 11:01 . 2006-09-21 11:42 344064 —-a-w- c:\windows\system32\msvcr70.dll
2010-08-14 11:01 . 2010-08-14 11:01 ——– d—–w- c:\program files\Common Files\SureThing Shared
2010-08-14 11:01 . 2010-08-14 11:01 ——– d—–w- c:\program files\SureThing CD Labeler 5
2010-08-13 21:59 . 2010-08-13 21:59 53319 —-a-w- c:\documents and settings\All Users\Application Data\TEMP\{8C20787A-7402-4FA7-BF25-6E5750930FDC}\PostBuild.exe
2010-08-13 21:47 . 2010-08-13 21:47 ——– d—–w- c:\documents and settings\Matt\Application Data\NVIDIA
2010-08-13 21:45 . 2010-08-13 21:45 ——– d—–w- c:\documents and settings\Matt\Local Settings\Application Data\Cyberlink
2010-08-13 21:43 . 2010-08-13 21:43 ——– d—–w- c:\program files\Common Files\CyberLink
2010-08-13 21:42 . 2010-08-14 11:47 53319 —-a-w- c:\documents and settings\All Users\Application Data\TEMP\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}\PostBuild.exe
2010-08-13 20:30 . 2010-08-13 20:30 ——– d—–w- c:\program files\uTorrent
2010-08-13 20:30 . 2010-08-16 19:17 ——– d—–w- c:\documents and settings\Matt\Application Data\uTorrent
2010-08-13 19:52 . 2010-08-15 11:23 ——– d—–w- c:\program files\LimeWire
2010-08-13 19:47 . 2010-08-13 19:47 ——– d—–w- c:\documents and settings\LocalService\Application Data\CyberLink
2010-08-13 19:35 . 2010-08-13 19:35 ——– d—–w- c:\program files\LightScribe Diagnostic Utility
2010-08-06 22:48 . 2010-08-06 22:48 61440 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-72e332a5-n\decora-sse.dll
2010-08-06 22:48 . 2010-08-06 22:48 12800 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-72e332a5-n\decora-d3d.dll
2010-08-06 22:48 . 2010-08-06 22:48 503808 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-7596ec1d-n\msvcp71.dll
2010-08-06 22:48 . 2010-08-06 22:48 499712 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-7596ec1d-n\jmc.dll
2010-08-06 22:48 . 2010-08-06 22:48 348160 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-7596ec1d-n\msvcr71.dll
2010-08-03 02:52 . 2010-08-03 02:52 53248 —-a-r- c:\documents and settings\Matt\Application Data\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2010-08-03 01:47 . 2010-08-03 01:47 1157 —-a-w- c:\windows\checkip.dat
2010-08-03 01:42 . 2010-08-03 01:46 1157 —-a-w- c:\windows\ipconfig.dat
2010-08-03 00:33 . 2010-08-03 00:33 ——– d—–w- c:\windows\system32\wbem\Repository
2010-07-24 14:31 . 2010-07-24 14:31 ——– d—–w- c:\program files\Common Files\Java
2010-07-20 00:28 . 2010-07-20 00:28 ——– d—–w- c:\program files\iPod
2010-07-20 00:28 . 2010-07-20 00:28 ——– d—–w- c:\program files\iTunes
2010-07-20 00:24 . 2010-07-20 00:24 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.4\SetupAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-16 19:36 . 2010-01-15 00:47 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-08-16 19:17 . 2010-03-18 21:55 ——– d—–w- c:\documents and settings\Matt\Application Data\Skype
2010-08-16 18:16 . 2010-03-18 21:58 ——– d—–w- c:\documents and settings\Matt\Application Data\skypePM
2010-08-16 18:14 . 2010-03-16 20:14 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2010-08-16 18:14 . 2010-03-16 20:14 0 —-a-w- c:\windows\system32\drivers\logiflt.iad
2010-08-16 01:31 . 2010-01-15 00:47 ——– d—–w- c:\program files\SpywareBlaster
2010-08-15 13:29 . 2010-01-15 00:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-14 21:11 . 2010-06-19 22:43 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-08-14 12:55 . 2010-01-20 23:26 ——– d—–w- c:\documents and settings\All Users\Application Data\CyberLink
2010-08-14 11:48 . 2010-01-13 15:57 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-08-14 11:47 . 2010-01-14 04:34 29480 —-a-w- c:\windows\system32\msxml3a.dll
2010-08-14 11:47 . 2010-01-14 04:33 353576 —-a-w- c:\windows\system32\msvcr71.dll
2010-08-14 11:47 . 2010-01-14 04:33 505128 —-a-w- c:\windows\system32\msvcp71.dll
2010-08-14 11:28 . 2010-01-13 15:42 87472 —-a-w- c:\documents and settings\Matt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-13 21:45 . 2010-01-20 23:26 ——– d—–w- c:\documents and settings\Matt\Application Data\CyberLink
2010-08-13 19:15 . 2010-01-14 04:35 ——– d—–w- c:\program files\Nero
2010-08-13 19:14 . 2010-01-14 04:39 ——– d—–w- c:\documents and settings\All Users\Application Data\Nero
2010-08-13 18:34 . 2010-01-15 01:04 ——– d—–w- c:\documents and settings\Matt\Application Data\Nero
2010-08-13 18:25 . 2010-01-17 13:07 ——– d—–w- c:\program files\Common Files\LightScribe
2010-08-12 08:27 . 2010-01-14 05:09 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-07 18:57 . 2010-04-19 19:55 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-08-03 02:52 . 2010-01-14 04:58 ——– d—–w- c:\program files\Common Files\Logishrd
2010-08-03 02:52 . 2010-03-03 23:49 ——– d—–w- c:\program files\Logitech
2010-08-03 02:52 . 2010-03-03 23:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Logishrd
2010-08-03 02:50 . 2010-01-15 01:08 ——– d—–w- c:\program files\CCleaner
2010-07-24 14:51 . 2010-01-14 04:35 ——– d—–w- c:\program files\Common Files\Ahead
2010-07-24 14:41 . 2010-01-13 15:57 ——– d—–w- c:\program files\NVIDIA Corporation
2010-07-24 14:40 . 2010-06-30 16:32 232968 —-a-w- c:\windows\system32\nvdrsdb0.bin
2010-07-24 14:40 . 2010-06-30 16:32 1 —-a-w- c:\windows\system32\nvdrssel.bin
2010-07-24 14:40 . 2010-06-30 16:32 232968 —-a-w- c:\windows\system32\nvdrsdb1.bin
2010-07-24 14:31 . 2010-04-17 00:05 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-20 00:28 . 2010-01-22 21:22 ——– d—–w- c:\program files\Common Files\Apple
2010-07-13 19:46 . 2010-01-14 22:30 ——– d—–w- c:\program files\LastPass
2010-07-12 15:32 . 2010-07-12 20:36 822784 —-a-w- c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\[removed]\platform\WINNT_x86-msvc\components\lpxpcom.dll
2010-07-09 20:24 . 2010-07-09 20:24 81920 —-a-w- c:\windows\system32\nvwddi.dll
2010-07-09 20:24 . 2010-07-09 20:24 277608 —-a-w- c:\windows\system32\nvmccs.dll
2010-07-09 20:24 . 2010-07-09 20:24 110696 —-a-w- c:\windows\system32\nvmctray.dll
2010-07-09 20:24 . 2010-07-09 20:24 155752 —-a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 20:24 . 2010-07-09 20:24 145000 —-a-w- c:\windows\system32\nvcolor.exe
2010-07-09 20:24 . 2010-07-09 20:24 13923432 —-a-w- c:\windows\system32\nvcpl.dll
2010-07-07 17:46 . 2010-01-13 15:34 604776 —-a-w- c:\windows\system32\NVUNINST.EXE
2010-07-05 23:28 . 2010-03-03 23:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Logitech
2010-07-05 23:28 . 2010-07-05 23:28 ——– d—–w- c:\program files\Common Files\LWS
2010-07-05 13:42 . 2010-01-15 00:52 ——– d—–w- c:\program files\IZArc
2010-06-30 12:31 . 2008-04-14 12:00 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-30 10:58 . 2010-01-14 04:45 ——– d—–w- c:\program files\Windows Media Connect 2
2010-06-29 19:31 . 2010-06-29 19:31 ——– d—–w- c:\documents and settings\Guest\Application Data\Avira
2010-06-24 12:22 . 2008-04-14 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-06-23 21:45 . 2010-06-23 21:45 71000 —-a-w- c:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-23 13:44 . 2008-04-14 12:00 1851904 —-a-w- c:\windows\system32\win32k.sys
2010-06-22 08:30 . 2010-06-22 08:30 61440 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4481cf57-n\decora-sse.dll
2010-06-22 08:30 . 2010-06-22 08:30 503808 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-13243215-n\msvcp71.dll
2010-06-22 08:30 . 2010-06-22 08:30 499712 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-13243215-n\jmc.dll
2010-06-22 08:30 . 2010-06-22 08:30 348160 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-13243215-n\msvcr71.dll
2010-06-22 08:30 . 2010-06-22 08:30 12800 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4481cf57-n\decora-d3d.dll
2010-06-21 21:01 . 2010-06-21 21:01 ——– d—–w- c:\documents and settings\Guest\Application Data\Logitech
2010-06-21 21:01 . 2010-06-21 21:01 ——– d—–w- c:\documents and settings\Guest\Application Data\IObit
2010-06-21 21:01 . 2010-06-21 21:01 ——– d—–w- c:\documents and settings\Guest\Application Data\WinPatrol
2010-06-21 15:27 . 2008-04-14 12:00 354304 —-a-w- c:\windows\system32\drivers\srv.sys
2010-06-19 23:09 . 2010-03-26 21:18 ——– d—–w- c:\documents and settings\Matt\Application Data\Apple Computer
2010-06-19 22:44 . 2010-06-19 22:43 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-06-19 22:42 . 2010-06-19 22:42 ——– d—–w- c:\program files\Apple Software Update
2010-06-19 22:42 . 2010-06-19 22:42 ——– d—–w- c:\program files\Bonjour
2010-06-17 14:03 . 2008-04-14 12:00 80384 —-a-w- c:\windows\system32\iccvid.dll
2010-06-15 08:30 . 2010-03-03 23:50 16400 —-a-w- c:\windows\system32\drivers\LNonPnP.sys
2010-06-14 14:31 . 2010-01-13 15:13 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2008-04-14 12:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2010-05-24 19:29 . 2010-05-24 19:29 61440 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-69fa5926-n\decora-sse.dll
2010-05-24 19:29 . 2010-05-24 19:29 503808 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6db8c008-n\msvcp71.dll
2010-05-24 19:29 . 2010-05-24 19:29 499712 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6db8c008-n\jmc.dll
2010-05-24 19:29 . 2010-05-24 19:29 348160 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6db8c008-n\msvcr71.dll
2010-05-24 19:29 . 2010-05-24 19:29 12800 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-69fa5926-n\decora-d3d.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-08-16_19.24.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-13 15:18 . 2010-08-16 19:35 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2010-01-13 15:18 . 2010-01-13 15:18 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-08-16 19:35 . 2010-08-16 19:35 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2010-01-13 15:18 . 2010-01-13 15:18 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2010-04-29 248832]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-08-13 327472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2010-05-31 323976]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
"QFan Help"="c:\program files\ASUS\Ai Suite\QFan3\QFanHelp.exe" [2009-04-30 598528]
"CPU Power Monitor"="c:\program files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe" [2008-01-09 627200]
"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2007-12-01 881152]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"ASUS Energy Saving"="c:\program files\ASUS\Ai Suite\EnergySaving\PwSave.exe" [2009-01-23 1352704]
"Ai Nap"="c:\program files\ASUS\Ai Suite\AiNap\AiNap.exe" [2009-05-25 1431040]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-07 165208]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
"RemoteControl10"="c:\program files\CyberLink\PowerDVD10\PDVD10Serv.exe" [2010-02-03 87336]
"BDRegion"="c:\program files\Cyberlink\Shared files\brs.exe" [2010-06-28 75048]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-02-15 417792]

c:\documents and settings\Matt\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-01-29 21:17 64592 —-a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^Matt^Start Menu^Programs^Startup^Hewlett-Packard Recorder.lnk]
path=c:\documents and settings\Matt\Start Menu\Programs\Startup\Hewlett-Packard Recorder.lnk
backup=c:\windows\pss\Hewlett-Packard Recorder.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EvtMgr6]
2010-06-26 00:15 1311312 —-a-w- c:\program files\Logitech\SetPointP\SetPoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-12-08 20:50 54576 —-a-w- c:\program files\Hp\HP Software Update\hpwuschd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2010-07-21 16:22 2736128 —-a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2010-07-09 20:24 13923432 —-a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2010-07-09 20:24 110696 —-a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-02-15 22:50 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"cdloader"="c:\documents and settings\Matt\Application Data\mjusbsp\cdloader2.exe" MAGICJACK

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\Matt\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [8/15/2010 6:03 AM 218592]
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/08/14 07:48];c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl [6/28/2010 10:50 PM 87536]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1/14/2010 12:56 AM 135336]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [8/15/2010 6:04 AM 112592]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [1/14/2010 12:59 AM 10448]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [8/15/2010 6:02 AM 366840]
S3 SureThing Labelflash service;SureThing Labelflash service;c:\program files\Common Files\SureThing Shared\stllssvr.exe [8/14/2010 7:01 AM 74392]

— Other Services/Drivers In Memory —

*Deregistered* - PCTSDInjDriver32

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-07-21 16:20 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-08-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]

2010-08-16 c:\windows\Tasks\User_Feed_Synchronization-{2DA6BE3E-518E-4316-866D-8BC21DE5086F}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://msn.foxsports.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: LastPass - file://c:\program files\LastPass\context.html?cmd=lastpass
IE: LastPass Fill Forms - file://c:\program files\LastPass\context.html?cmd=fillforms
LSP: %SYSTEMROOT%\system32\nvLsp.dll
Trusted Zone: intuit.com\ttlc
FF - ProfilePath - c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\
FF - prefs.js: browser.startup.homepage - hxxp://rivals.yahoo.com/ncaa/football;_ylt=ArvpMQPmZicaZaD72iFcaJs5nYcB
FF - component: c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\[removed]\platform\WINNT_x86-msvc\components\lpxpcom.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-16 19:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(748)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

- - - - - - - > 'lsass.exe'(804)
c:\windows\system32\nvLsp.dll
.
Completion time: 2010-08-16 19:57:33
ComboFix-quarantined-files.txt 2010-08-16 23:57
ComboFix2.txt 2010-08-16 19:27

Pre-Run: 453,513,539,584 bytes free
Post-Run: 453,500,579,840 bytes free

- - End Of File - - 7F9FC794A52CB9361C37BE56567541FA
Upload was successful

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4438

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/16/2010 8:28:45 PM
mbam-log-2010-08-16 (20-28-45).txt

Scan type: Full scan (C:\|)
Objects scanned: 203616
Time elapsed: 25 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Qoobox\Quarantine\C\WINDOWS\system32\99.tmp.vir (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\danim32.dll.vir (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CB83B743-370E-4399-8664-F88A9B29CA6B}\RP277\A0027443.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CB83B743-370E-4399-8664-F88A9B29CA6B}\RP277\A0027456.exe (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CB83B743-370E-4399-8664-F88A9B29CA6B}\RP281\A0027713.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CB83B743-370E-4399-8664-F88A9B29CA6B}\RP282\A0031792.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CB83B743-370E-4399-8664-F88A9B29CA6B}\RP282\A0031815.sys (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CB83B743-370E-4399-8664-F88A9B29CA6B}\RP282\A0031869.sys (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CB83B743-370E-4399-8664-F88A9B29CA6B}\RP282\A0031963.sys (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

RPMcMurphy

Post #11August 17, 2010, 1:09 AM UTC

mstein66,

How is the computer running now? I have one last scan I'd like you to do:

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

Once the update is complete, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, adware, dialers, and other riskware
- Archives
- E-mail databases
Click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View report… at the bottom.
Click the Save report… button.
Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

Please include the following in your next post:

Kaspersky log

mstein66

Post #12August 17, 2010, 8:21 AM UTC

Hi,

After running the combofix/malware, I forgot that I had a program disable in WinPatrol due to thinking it was a virus, which it was, (lsass.exe) so I ran these 2 steps again. See new logs…. Kaspersky found 3 infections after running the 2 steps over…

ComboFix 10-08-16.03 - Matt 08/16/2010 22:01:44.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2623 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Matt\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((( Files Created from 2010-07-17 to 2010-08-17 )))))))))))))))))))))))))))))))
.

2010-08-17 00:58 . 2010-08-17 00:58 ——– d—–w- c:\program files\Defraggler
2010-08-17 00:00 . 2010-08-17 00:00 ——– d—–w- c:\documents and settings\Matt\Application Data\Malwarebytes
2010-08-17 00:00 . 2010-04-29 19:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-17 00:00 . 2010-08-17 00:00 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-17 00:00 . 2010-08-17 00:00 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-08-17 00:00 . 2010-04-29 19:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-08-16 19:35 . 2010-08-16 19:35 ——– d—–w- c:\documents and settings\Matt\Local Settings\Application Data\Threat Expert
2010-08-15 12:10 . 2010-08-15 12:10 ——– d—–w- C:\VundoFix Backups
2010-08-15 11:37 . 2010-08-15 11:39 ——– d—–w- c:\documents and settings\Matt\Application Data\GetRightToGo
2010-08-15 10:04 . 2010-01-22 13:56 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-08-15 10:04 . 2010-01-22 13:55 767952 —-a-w- c:\windows\BDTSupport.dll
2010-08-15 10:04 . 2008-11-26 16:08 131 —-a-w- c:\windows\IDB.zip
2010-08-15 10:04 . 2010-01-22 13:56 165840 —-a-w- c:\windows\PCTBDRes.dll
2010-08-15 10:04 . 2010-01-22 13:56 1652688 —-a-w- c:\windows\PCTBDCore.dll
2010-08-15 10:04 . 2009-10-28 05:36 1152444 —-a-w- c:\windows\UDB.zip
2010-08-15 10:03 . 2010-02-05 13:17 233136 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2010-08-15 10:03 . 2010-03-29 14:06 218592 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2010-08-15 10:03 . 2009-11-23 17:54 88040 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-08-15 10:03 . 2010-04-08 18:29 63360 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2010-08-15 10:02 . 2010-08-17 01:45 ——– d—–w- c:\program files\Spyware Doctor
2010-08-15 10:02 . 2010-08-15 10:05 ——– d—–w- c:\program files\Common Files\PC Tools
2010-08-15 10:02 . 2010-08-15 10:02 ——– d—–w- c:\documents and settings\Matt\Application Data\PC Tools
2010-08-15 10:02 . 2010-08-15 10:02 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2010-08-14 21:09 . 2010-08-14 21:09 ——– d—–w- c:\program files\QuickTime
2010-08-14 17:26 . 2010-08-14 17:26 ——– d—–w- c:\program files\ERUNT
2010-08-14 17:15 . 2010-08-14 17:15 388096 —-a-r- c:\documents and settings\Matt\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-08-14 17:15 . 2010-08-14 17:15 ——– d—–w- c:\program files\Trend Micro
2010-08-14 11:47 . 2010-08-14 11:48 ——– d—–w- c:\program files\CyberLink
2010-08-14 11:01 . 2010-08-14 11:17 ——– d—–w- c:\documents and settings\Matt\Local Settings\Application Data\MicroVision Applications
2010-08-14 11:01 . 2006-09-21 11:42 487424 —-a-w- c:\windows\system32\msvcp70.dll
2010-08-14 11:01 . 2006-09-21 11:42 344064 —-a-w- c:\windows\system32\msvcr70.dll
2010-08-14 11:01 . 2010-08-14 11:01 ——– d—–w- c:\program files\Common Files\SureThing Shared
2010-08-14 11:01 . 2010-08-14 11:01 ——– d—–w- c:\program files\SureThing CD Labeler 5
2010-08-13 21:59 . 2010-08-13 21:59 53319 —-a-w- c:\documents and settings\All Users\Application Data\TEMP\{8C20787A-7402-4FA7-BF25-6E5750930FDC}\PostBuild.exe
2010-08-13 21:47 . 2010-08-13 21:47 ——– d—–w- c:\documents and settings\Matt\Application Data\NVIDIA
2010-08-13 21:45 . 2010-08-13 21:45 ——– d—–w- c:\documents and settings\Matt\Local Settings\Application Data\Cyberlink
2010-08-13 21:43 . 2010-08-13 21:43 ——– d—–w- c:\program files\Common Files\CyberLink
2010-08-13 21:42 . 2010-08-14 11:47 53319 —-a-w- c:\documents and settings\All Users\Application Data\TEMP\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}\PostBuild.exe
2010-08-13 20:30 . 2010-08-17 00:57 ——– d—–w- c:\program files\uTorrent
2010-08-13 20:30 . 2010-08-17 01:01 ——– d—–w- c:\documents and settings\Matt\Application Data\uTorrent
2010-08-13 19:52 . 2010-08-15 11:23 ——– d—–w- c:\program files\LimeWire
2010-08-13 19:47 . 2010-08-13 19:47 ——– d—–w- c:\documents and settings\LocalService\Application Data\CyberLink
2010-08-13 19:35 . 2010-08-13 19:35 ——– d—–w- c:\program files\LightScribe Diagnostic Utility
2010-08-06 22:48 . 2010-08-06 22:48 61440 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-72e332a5-n\decora-sse.dll
2010-08-06 22:48 . 2010-08-06 22:48 12800 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-72e332a5-n\decora-d3d.dll
2010-08-06 22:48 . 2010-08-06 22:48 503808 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-7596ec1d-n\msvcp71.dll
2010-08-06 22:48 . 2010-08-06 22:48 499712 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-7596ec1d-n\jmc.dll
2010-08-06 22:48 . 2010-08-06 22:48 348160 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-7596ec1d-n\msvcr71.dll
2010-08-03 02:52 . 2010-08-03 02:52 53248 —-a-r- c:\documents and settings\Matt\Application Data\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2010-08-03 01:47 . 2010-08-03 01:47 1157 —-a-w- c:\windows\checkip.dat
2010-08-03 01:42 . 2010-08-03 01:46 1157 —-a-w- c:\windows\ipconfig.dat
2010-08-03 00:33 . 2010-08-03 00:33 ——– d—–w- c:\windows\system32\wbem\Repository
2010-07-24 14:31 . 2010-07-24 14:31 ——– d—–w- c:\program files\Common Files\Java
2010-07-20 00:28 . 2010-07-20 00:28 ——– d—–w- c:\program files\iPod
2010-07-20 00:28 . 2010-07-20 00:28 ——– d—–w- c:\program files\iTunes
2010-07-20 00:24 . 2010-07-20 00:24 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.4\SetupAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-17 01:45 . 2010-01-15 00:47 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-08-17 01:41 . 2010-03-18 21:55 ——– d—–w- c:\documents and settings\Matt\Application Data\Skype
2010-08-17 01:39 . 2010-03-16 20:14 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2010-08-17 01:39 . 2010-03-16 20:14 0 —-a-w- c:\windows\system32\drivers\logiflt.iad
2010-08-17 00:32 . 2010-03-18 21:58 ——– d—–w- c:\documents and settings\Matt\Application Data\skypePM
2010-08-16 01:31 . 2010-01-15 00:47 ——– d—–w- c:\program files\SpywareBlaster
2010-08-15 13:29 . 2010-01-15 00:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-14 21:11 . 2010-06-19 22:43 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-08-14 12:55 . 2010-01-20 23:26 ——– d—–w- c:\documents and settings\All Users\Application Data\CyberLink
2010-08-14 11:48 . 2010-01-13 15:57 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-08-14 11:47 . 2010-01-14 04:34 29480 —-a-w- c:\windows\system32\msxml3a.dll
2010-08-14 11:47 . 2010-01-14 04:33 353576 —-a-w- c:\windows\system32\msvcr71.dll
2010-08-14 11:47 . 2010-01-14 04:33 505128 —-a-w- c:\windows\system32\msvcp71.dll
2010-08-14 11:28 . 2010-01-13 15:42 87472 —-a-w- c:\documents and settings\Matt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-13 21:45 . 2010-01-20 23:26 ——– d—–w- c:\documents and settings\Matt\Application Data\CyberLink
2010-08-13 19:15 . 2010-01-14 04:35 ——– d—–w- c:\program files\Nero
2010-08-13 19:14 . 2010-01-14 04:39 ——– d—–w- c:\documents and settings\All Users\Application Data\Nero
2010-08-13 18:34 . 2010-01-15 01:04 ——– d—–w- c:\documents and settings\Matt\Application Data\Nero
2010-08-13 18:25 . 2010-01-17 13:07 ——– d—–w- c:\program files\Common Files\LightScribe
2010-08-12 08:27 . 2010-01-14 05:09 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-07 18:57 . 2010-04-19 19:55 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-08-03 02:52 . 2010-01-14 04:58 ——– d—–w- c:\program files\Common Files\Logishrd
2010-08-03 02:52 . 2010-03-03 23:49 ——– d—–w- c:\program files\Logitech
2010-08-03 02:52 . 2010-03-03 23:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Logishrd
2010-08-03 02:50 . 2010-01-15 01:08 ——– d—–w- c:\program files\CCleaner
2010-07-24 14:51 . 2010-01-14 04:35 ——– d—–w- c:\program files\Common Files\Ahead
2010-07-24 14:41 . 2010-01-13 15:57 ——– d—–w- c:\program files\NVIDIA Corporation
2010-07-24 14:40 . 2010-06-30 16:32 232968 —-a-w- c:\windows\system32\nvdrsdb0.bin
2010-07-24 14:40 . 2010-06-30 16:32 1 —-a-w- c:\windows\system32\nvdrssel.bin
2010-07-24 14:40 . 2010-06-30 16:32 232968 —-a-w- c:\windows\system32\nvdrsdb1.bin
2010-07-24 14:31 . 2010-04-17 00:05 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-20 00:28 . 2010-01-22 21:22 ——– d—–w- c:\program files\Common Files\Apple
2010-07-13 19:46 . 2010-01-14 22:30 ——– d—–w- c:\program files\LastPass
2010-07-12 15:32 . 2010-07-12 20:36 822784 —-a-w- c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\[removed]\platform\WINNT_x86-msvc\components\lpxpcom.dll
2010-07-09 20:24 . 2010-07-09 20:24 81920 —-a-w- c:\windows\system32\nvwddi.dll
2010-07-09 20:24 . 2010-07-09 20:24 277608 —-a-w- c:\windows\system32\nvmccs.dll
2010-07-09 20:24 . 2010-07-09 20:24 110696 —-a-w- c:\windows\system32\nvmctray.dll
2010-07-09 20:24 . 2010-07-09 20:24 155752 —-a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 20:24 . 2010-07-09 20:24 145000 —-a-w- c:\windows\system32\nvcolor.exe
2010-07-09 20:24 . 2010-07-09 20:24 13923432 —-a-w- c:\windows\system32\nvcpl.dll
2010-07-07 17:46 . 2010-01-13 15:34 604776 —-a-w- c:\windows\system32\NVUNINST.EXE
2010-07-05 23:28 . 2010-03-03 23:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Logitech
2010-07-05 23:28 . 2010-07-05 23:28 ——– d—–w- c:\program files\Common Files\LWS
2010-07-05 13:42 . 2010-01-15 00:52 ——– d—–w- c:\program files\IZArc
2010-06-30 12:31 . 2008-04-14 12:00 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-30 10:58 . 2010-01-14 04:45 ——– d—–w- c:\program files\Windows Media Connect 2
2010-06-29 19:31 . 2010-06-29 19:31 ——– d—–w- c:\documents and settings\Guest\Application Data\Avira
2010-06-24 12:22 . 2008-04-14 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-06-23 21:45 . 2010-06-23 21:45 71000 —-a-w- c:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-23 13:44 . 2008-04-14 12:00 1851904 —-a-w- c:\windows\system32\win32k.sys
2010-06-22 08:30 . 2010-06-22 08:30 61440 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4481cf57-n\decora-sse.dll
2010-06-22 08:30 . 2010-06-22 08:30 503808 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-13243215-n\msvcp71.dll
2010-06-22 08:30 . 2010-06-22 08:30 499712 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-13243215-n\jmc.dll
2010-06-22 08:30 . 2010-06-22 08:30 348160 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-13243215-n\msvcr71.dll
2010-06-22 08:30 . 2010-06-22 08:30 12800 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4481cf57-n\decora-d3d.dll
2010-06-21 21:01 . 2010-06-21 21:01 ——– d—–w- c:\documents and settings\Guest\Application Data\Logitech
2010-06-21 21:01 . 2010-06-21 21:01 ——– d—–w- c:\documents and settings\Guest\Application Data\IObit
2010-06-21 21:01 . 2010-06-21 21:01 ——– d—–w- c:\documents and settings\Guest\Application Data\WinPatrol
2010-06-21 15:27 . 2008-04-14 12:00 354304 —-a-w- c:\windows\system32\drivers\srv.sys
2010-06-19 23:09 . 2010-03-26 21:18 ——– d—–w- c:\documents and settings\Matt\Application Data\Apple Computer
2010-06-19 22:44 . 2010-06-19 22:43 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-06-19 22:42 . 2010-06-19 22:42 ——– d—–w- c:\program files\Apple Software Update
2010-06-19 22:42 . 2010-06-19 22:42 ——– d—–w- c:\program files\Bonjour
2010-06-17 14:03 . 2008-04-14 12:00 80384 —-a-w- c:\windows\system32\iccvid.dll
2010-06-15 08:30 . 2010-03-03 23:50 16400 —-a-w- c:\windows\system32\drivers\LNonPnP.sys
2010-06-14 14:31 . 2010-01-13 15:13 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2008-04-14 12:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2010-05-24 19:29 . 2010-05-24 19:29 61440 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-69fa5926-n\decora-sse.dll
2010-05-24 19:29 . 2010-05-24 19:29 503808 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6db8c008-n\msvcp71.dll
2010-05-24 19:29 . 2010-05-24 19:29 499712 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6db8c008-n\jmc.dll
2010-05-24 19:29 . 2010-05-24 19:29 348160 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6db8c008-n\msvcr71.dll
2010-05-24 19:29 . 2010-05-24 19:29 12800 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-69fa5926-n\decora-d3d.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-08-16_19.24.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-08-17 01:39 . 2010-08-17 01:39 16384 c:\windows\Temp\Perflib_Perfdata_12c.dat
+ 2010-01-13 15:18 . 2010-08-16 19:35 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2010-01-13 15:18 . 2010-01-13 15:18 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2010-04-29 248832]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2010-05-31 323976]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
"QFan Help"="c:\program files\ASUS\Ai Suite\QFan3\QFanHelp.exe" [2009-04-30 598528]
"CPU Power Monitor"="c:\program files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe" [2008-01-09 627200]
"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2007-12-01 881152]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"ASUS Energy Saving"="c:\program files\ASUS\Ai Suite\EnergySaving\PwSave.exe" [2009-01-23 1352704]
"Ai Nap"="c:\program files\ASUS\Ai Suite\AiNap\AiNap.exe" [2009-05-25 1431040]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-07 165208]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
"RemoteControl10"="c:\program files\CyberLink\PowerDVD10\PDVD10Serv.exe" [2010-02-03 87336]
"BDRegion"="c:\program files\Cyberlink\Shared files\brs.exe" [2010-06-28 75048]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-02-15 417792]

c:\documents and settings\Matt\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-01-29 21:17 64592 —-a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^Matt^Start Menu^Programs^Startup^Hewlett-Packard Recorder.lnk]
path=c:\documents and settings\Matt\Start Menu\Programs\Startup\Hewlett-Packard Recorder.lnk
backup=c:\windows\pss\Hewlett-Packard Recorder.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EvtMgr6]
2010-06-26 00:15 1311312 —-a-w- c:\program files\Logitech\SetPointP\SetPoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-12-08 20:50 54576 —-a-w- c:\program files\Hp\HP Software Update\hpwuschd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2010-07-21 16:22 2736128 —-a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2010-07-09 20:24 13923432 —-a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2010-07-09 20:24 110696 —-a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-02-15 22:50 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"cdloader"="c:\documents and settings\Matt\Application Data\mjusbsp\cdloader2.exe" MAGICJACK

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\Matt\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [8/15/2010 6:03 AM 218592]
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/08/14 07:48];c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl [6/28/2010 10:50 PM 87536]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1/14/2010 12:56 AM 135336]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [8/15/2010 6:04 AM 112592]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [1/14/2010 12:59 AM 10448]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [8/15/2010 6:02 AM 366840]
S3 SureThing Labelflash service;SureThing Labelflash service;c:\program files\Common Files\SureThing Shared\stllssvr.exe [8/14/2010 7:01 AM 74392]

— Other Services/Drivers In Memory —

*Deregistered* - PCTSDInjDriver32

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-07-21 16:20 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-08-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]

2010-08-16 c:\windows\Tasks\User_Feed_Synchronization-{2DA6BE3E-518E-4316-866D-8BC21DE5086F}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://msn.foxsports.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: LastPass - file://c:\program files\LastPass\context.html?cmd=lastpass
IE: LastPass Fill Forms - file://c:\program files\LastPass\context.html?cmd=fillforms
LSP: %SYSTEMROOT%\system32\nvLsp.dll
Trusted Zone: intuit.com\ttlc
FF - ProfilePath - c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\
FF - prefs.js: browser.startup.homepage - hxxp://rivals.yahoo.com/ncaa/football;_ylt=ArvpMQPmZicaZaD72iFcaJs5nYcB
FF - component: c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\[removed]\platform\WINNT_x86-msvc\components\lpxpcom.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************
scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(740)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

- - - - - - - > 'lsass.exe'(796)
c:\windows\system32\nvLsp.dll

- - - - - - - > 'explorer.exe'(2028)
c:\windows\system32\WININET.dll
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-08-16 22:07:03
ComboFix-quarantined-files.txt 2010-08-17 02:07
ComboFix2.txt 2010-08-16 23:58
ComboFix3.txt 2010-08-16 19:27

Pre-Run: 453,573,328,896 bytes free
Post-Run: 453,640,728,576 bytes free

- - End Of File - - C834685B6F9702DDFE65F1C1DCDF3987

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4438

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/16/2010 10:35:53 PM
mbam-log-2010-08-16 (22-35-53).txt

Scan type: Full scan (C:\|)
Objects scanned: 204148
Time elapsed: 27 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{CB83B743-370E-4399-8664-F88A9B29CA6B}\RP282\A0032061.sys (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Tuesday, August 17, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, August 16, 2010 14:06:36
Records in database: 4133591
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\

Scan statistics:
Objects scanned: 63545
Threats found: 3
Infected objects found: 3
Suspicious objects found: 0
Scan duration: 01:08:09

File name / Threat / Threats count
C:\Documents and Settings\Matt\Application Data\Sun\Java\Deployment\cache\6.0\61\2d66577d-7ee15319 Infected: Trojan-Downloader.Java.Agent.ft 1
C:\Documents and Settings\Matt\Application Data\Sun\Java\Deployment\cache\6.0\61\2d66577d-7ee15319 Infected: Trojan-Downloader.Java.Agent.fu 1
C:\Documents and Settings\Matt\Application Data\Sun\Java\Deployment\cache\6.0\61\2d66577d-7ee15319 Infected: Trojan-Downloader.Java.Agent.fv 1

Selected area has been scanned.

RPMcMurphy

Post #13August 17, 2010, 4:27 PM UTC

mstein66,

🖼Click to load external image (Posted Image) Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Files
C:\Documents and Settings\Matt\Application Data\Sun\Java\Deployment\cache\6.0\61\2d66577d-7ee15319
:Commands
[EmptyFlash]
[EmptyTemp]

Then click the Run Fix button at the top
Let the program run unhindered, it will reboot when it is done and produce a log. I don't need to see it unless you have a problem or question.

Now all that we have left to do is some very important cleanup:

🖼Click to load external image (Posted Image) Uninstall ComboFix

Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens and press OK:
Combofix /Uninstall

🖼Click to load external image (Posted Image)

🖼Click to load external image (Posted Image) Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.
Manually delete any remaining logs or tools.

🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:

Restart any anti-malware programs that we disabled while we were cleaning your machine.
Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
Avoid using P2P programs. Refer back to my earlier post for more information.
Consider running in a limited user account. See this post for more information.
Please carefully review the information in our Security - Best Practices and Prevention forum located HERE

Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!

mstein66

Post #14August 18, 2010, 9:02 AM UTC

Hi RP, ComboFix I deleted before seeing your post about the cleanup, which did not find anything; not sure if I need to add this again, then do the cleanup. Want to run kaspersky one more time along with full scans of other software before posting and is there something you can look at again to make sure everything is good like HijackThis or other logs I have done such as the ComboFix… Will do this when I get home from work later today! Thanks…

RPMcMurphy

Post #15August 18, 2010, 9:01 PM UTC

Did you uninstall ComboFix using the command I gave you or did you just delete it from your desktop?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

virtumonde.sdn

✨ Ask AI

Ask AI