JS:FakeWarn-E

Had to run the kill program first to even be able to run the OTL - here are my results: (OTL.txt) and extras too. I noticed my issues began yesterday after downloading Skype. I cannot run any programs without getting the warnings, no program will start up except for Mozilla - cannot access any windows programs at all. Satchfan - I was reading your posts with another user and found out about the kill program so that I could run OTL - it was not even letting me do that either. Thanks for help. [removed] if phone is easier.




OTL logfile created on: 9/13/2010 11:05:47 AM - Run 1
OTL by OldTimer - Version 3.2.12.0 Folder = C:\Documents and Settings\The Head Nigger\My Documents\Downloads\Firefox Downloads
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 57.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 102.63 Gb Free Space | 68.86% Space Free | Partition Type: NTFS
Drive D: | 37.26 Gb Total Space | 19.05 Gb Free Space | 51.13% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HNIC
Current User Name: The Head Nigger
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\The Head Nigger\My Documents\Downloads\Firefox Downloads\OTL.exe (OldTimer Tools)
PRC - c:\Program Files\tbh\base\bin\tbhDaemon.exe ()
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\tbh\base\bin\tbhSystray.exe (eBay)
PRC - C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (MyWebSearch.com)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\Rainmeter\Rainmeter.exe ()
PRC - C:\Program Files\tbh\monitor\bin\tbhMonitor.exe ()
PRC - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
PRC - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\The Head Nigger\My Documents\Downloads\Firefox Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL (MyWebSearch.com)
MOD - C:\Program Files\Alwil Software\Avast4\AhJsctNs.dll (ALWIL Software)
MOD - C:\Program Files\Comcast\Desktop Doctor\bin\sprthook.dll (SupportSoft, Inc.)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcp60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (MyWebSearchService) – C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE (MyWebSearch.com)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (tbhMonitor.exe) – C:\Program Files\tbh\monitor\bin\tbhMonitor.exe ()
SRV - (wlidsvc) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (WLSVC) – C:\Program Files\TRENDnet\TEW-421PC_TEW-423PI\WLSVC.exe ()
SRV - (sprtsvc_ddoctorv2) SupportSoft Sprocket Service (ddoctorv2) – C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)


========== Driver Services (SafeList) ==========

DRV - (PciCon) – F:\PciCon.sys File not found
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software)
DRV - (motport) – C:\WINDOWS\system32\drivers\motport.sys (Motorola)
DRV - (motmodem) – C:\WINDOWS\system32\drivers\motmodem.sys (Motorola)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (motccgp) – C:\WINDOWS\system32\drivers\motccgp.sys (Motorola)
DRV - (AtiHdmiService) – C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (motccgpfl) – C:\WINDOWS\system32\drivers\motccgpfl.sys (Motorola)
DRV - (VIAHdAudAddService) – C:\WINDOWS\system32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (nvsmu) – C:\WINDOWS\system32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (NVHDA) – C:\WINDOWS\system32\drivers\nvhda32.sys (NVIDIA Corporation)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (BVRPMPR5) – C:\WINDOWS\system32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (monfilt) – C:\WINDOWS\system32\drivers\monfilt.sys (Creative Technology Ltd.)
DRV - (WLNdis50) – C:\WINDOWS\system32\drivers\WLNdis50.sys ()
DRV - (sscdmdm) – C:\WINDOWS\system32\drivers\sscdmdm.sys (MCCI)
DRV - (sscdserd) SAMSUNG CDMA Modem Diagnostic Serial Port (WDM) – C:\WINDOWS\system32\drivers\sscdserd.sys (MCCI)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) – C:\WINDOWS\system32\drivers\sscdbus.sys (MCCI)
DRV - (sscdmdfl) – C:\WINDOWS\system32\drivers\sscdmdfl.sys (MCCI)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx
IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=14196&l;=dis
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL (MyWebSearch.com)
IE - HKCU\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)
IE - HKCU\..\URLSearchHook: {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6092

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=MSGTDF&PC;=MSNG&q;="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.aol.com/?src=aim&ncid;=snsusaimc00000001"
FF - prefs.js..extensions.enabledItems: {c2f863cd-0429-48c7-bb54-db756a951760}:5.96.10.6044
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {c38eebda-0a39-4f01-989b-dc3ef3124bc2}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:4.0
FF - prefs.js..extensions.enabledItems: [removed]:1.1
FF - prefs.js..extensions.enabledItems: {27182e60-b5f3-411c-b545-b44205977502}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:2.5.8.6
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src;=kw&tb;=FWV5&o;=14193&locale;=en_US&apn;_uid=D34DD81E-E2A1-4A76-90DD-52A61B6AA76C&apn;_ptnrs=FM&apn;_sauid=8C74FD74-DDA3-435F-B0BB-3D7FEC79DB5E&apn;_dtid=YYYYYYYYUS&q;="


FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009/11/09 12:20:39 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\MyWebSearch\bar\1.bin [2010/02/21 15:17:59 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\MSN Toolbar\Platform\4.0.0360.0\Firefox [2010/05/15 20:32:06 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/05/15 20:32:07 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/03 09:14:11 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/08 19:51:19 | 000,000,000 | —D | M]

[2009/12/24 01:04:25 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\Mozilla\Extensions
[2009/12/24 01:04:25 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\Mozilla\Extensions\[removed]
[2010/09/12 21:42:11 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\extensions
[2010/05/30 12:44:09 | 000,000,000 | —D | M] (Zynga Toolbar) – C:\Documents and Settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2010/08/26 12:16:03 | 000,000,000 | —D | M] (AIM Toolbar) – C:\Documents and Settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}
[2010/01/31 16:20:31 | 000,000,000 | —D | M] (MafiaWarsSecrets Toolbar) – C:\Documents and Settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\extensions\{c38eebda-0a39-4f01-989b-dc3ef3124bc2}
[2010/09/10 15:26:58 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\extensions\[removed]
[2010/08/05 22:01:16 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\extensions\[removed]
[2009/11/09 12:48:58 | 000,004,554 | —- | M] () – C:\Documents and Settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\searchplugins\aim-search.xml
[2010/08/26 12:15:30 | 000,001,490 | —- | M] () – C:\Documents and Settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\searchplugins\AOL Search.xml
[2010/09/12 12:31:34 | 000,002,566 | —- | M] () – C:\Documents and Settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\searchplugins\askcom.xml
[2010/05/24 10:06:17 | 000,001,840 | —- | M] () – C:\Documents and Settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\searchplugins\bing.xml
[2010/09/12 12:41:20 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/11/19 17:16:28 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2009/11/19 17:16:29 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
[2010/08/26 12:15:30 | 000,001,490 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\AOL Search.xml

O1 HOSTS File: ([2010/01/04 19:32:02 | 000,000,736 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (MyWebSearch Search Assistant BHO) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL (MyWebSearch.com)
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (mwsBar BHO) - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (MyWebSearch.com)
O2 - BHO: (AOLSearchHook Class) - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)
O2 - BHO: (MSN Toolbar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\4.0.0360.0\npwinext.dll (Microsoft Corporation)
O2 - BHO: (FrostWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\4.0.0360.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (FrostWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (AIM Toolbar) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (FrostWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [cclbyxuj] C:\Documents and Settings\The Head Nigger\Local Settings\Application Data\blmcpkjmp\kaqqhhbuqiw.exe (Security Suites Corporation)
O4 - HKLM..\Run: [ddoctorv2] C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corporation)
O4 - HKLM..\Run: [MSN Toolbar] C:\Program Files\MSN Toolbar\Platform\4.0.0360.0\mswinext.exe (Microsoft Corp.)
O4 - HKLM..\Run: [My Web Search Bar] C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (MyWebSearch.com)
O4 - HKLM..\Run: [MyWebSearch Email Plugin] C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (MyWebSearch.com)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [tbhSystray] C:\Program Files\tbh\base\bin\tbhSystray.exe (eBay)
O4 - HKCU..\Run: [Aim] C:\Program Files\AIM\aim.exe (AOL Inc.)
O4 - HKCU..\Run: [cclbyxuj] C:\Documents and Settings\The Head Nigger\Local Settings\Application Data\blmcpkjmp\kaqqhhbuqiw.exe (Security Suites Corporation)
O4 - HKCU..\Run: [MyWebSearch Email Plugin] C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (MyWebSearch.com)
O4 - HKCU..\Run: [Pjakofuqoqiwog] C:\WINDOWS\gkuibjap.DLL ()
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\The Head Nigger\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\The Head Nigger\Application Data\Dropbox\bin\Dropbox.exe ()
O4 - Startup: C:\Documents and Settings\The Head Nigger\Start Menu\Programs\Startup\Rainmeter.lnk = C:\Program Files\Rainmeter\Rainmeter.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\The Head Nigger\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\The Head Nigger\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/11/07 12:19:47 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2007/10/24 20:16:52 | 000,000,000 | —- | M] () - D:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (aswBoot.exe /M:c889d1c55cd44) - C:\WINDOWS\System32\aswBoot.exe (ALWIL Software)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/09/13 10:05:14 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/09/13 10:05:12 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/09/13 10:05:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/09/13 10:05:11 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/09/12 21:52:59 | 000,000,000 | RH-D | C] – C:\Documents and Settings\The Head Nigger\Recent
[2010/09/12 21:42:05 | 000,000,000 | —D | C] – C:\Documents and Settings\The Head Nigger\Local Settings\Application Data\blmcpkjmp
[2010/09/12 21:41:53 | 000,245,248 | —- | C] (Security Suites Corporation) – C:\Documents and Settings\The Head Nigger\Local Settings\Application Data\462606001.exe
[2010/09/12 15:11:07 | 000,000,000 | —D | C] – C:\Documents and Settings\The Head Nigger\Application Data\Skype
[2010/09/12 15:11:01 | 000,000,000 | R–D | C] – C:\Program Files\Skype
[2010/09/12 15:11:01 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2010/08/26 12:15:57 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Software Update Utility
[2010/08/26 12:15:30 | 000,000,000 | —D | C] – C:\Program Files\AOL Search
[2010/08/10 11:44:35 | 000,000,000 | —D | C] – C:\Documents and Settings\The Head Nigger\Desktop\palm pics and videos july august 2010
[2010/07/30 14:16:45 | 000,000,000 | —D | C] – C:\Program Files\Geeks Ltd
[2010/07/28 08:48:19 | 000,000,000 | —D | C] – C:\Documents and Settings\The Head Nigger\Desktop\pics on yellow phone
[2010/07/26 19:52:35 | 000,000,000 | —D | C] – C:\Documents and Settings\The Head Nigger\Local Settings\Application Data\AskToolbar
[2010/07/23 16:01:21 | 000,000,000 | —D | C] – C:\Documents and Settings\The Head Nigger\My Documents\FrostWire
[2010/07/23 16:01:17 | 000,000,000 | —D | C] – C:\Documents and Settings\The Head Nigger\Application Data\FrostWire
[2010/07/23 16:01:07 | 000,000,000 | —D | C] – C:\Program Files\Ask.com
[2010/07/23 16:00:56 | 000,000,000 | —D | C] – C:\Program Files\FrostWire
[2010/07/04 09:39:14 | 000,000,000 | R–D | C] – C:\Documents and Settings\The Head Nigger\Desktop\My Pictures
[2009/12/30 11:14:11 | 000,047,360 | —- | C] (VSO Software) – C:\Documents and Settings\The Head Nigger\Application Data\pcouffin.sys
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/09/13 11:01:00 | 000,000,254 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/09/13 10:05:16 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/13 08:26:10 | 003,670,016 | -H– | M] () – C:\Documents and Settings\The Head Nigger\NTUSER.DAT
[2010/09/12 21:41:53 | 000,245,248 | —- | M] (Security Suites Corporation) – C:\Documents and Settings\The Head Nigger\Local Settings\Application Data\462606001.exe
[2010/09/12 21:41:53 | 000,077,824 | —- | M] () – C:\Documents and Settings\The Head Nigger\Local Settings\Application Data\462606000.exe
[2010/09/12 18:39:17 | 000,022,016 | —- | M] () – C:\Documents and Settings\The Head Nigger\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/12 15:11:01 | 000,001,878 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/09/11 09:53:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/09/10 12:01:17 | 000,045,056 | —- | M] () – C:\Documents and Settings\The Head Nigger\My Documents\CYNTHIA.xls
[2010/09/08 19:51:19 | 000,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/09/07 15:42:04 | 000,033,280 | —- | M] () – C:\Documents and Settings\The Head Nigger\My Documents\resumewithcoverletter.doc
[2010/09/07 13:16:30 | 000,458,340 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/09/07 13:16:30 | 000,392,296 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/09/07 13:16:30 | 000,058,596 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/09/07 13:12:02 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/07 13:11:53 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/09/07 13:11:51 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/07 13:11:05 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\The Head Nigger\ntuser.ini
[2010/09/01 21:12:49 | 000,029,184 | —- | M] () – C:\Documents and Settings\The Head Nigger\My Documents\RESUME.doc
[2010/09/01 21:12:25 | 000,021,504 | —- | M] () – C:\Documents and Settings\The Head Nigger\My Documents\COVERLETTER.doc
[2010/08/30 14:49:51 | 003,636,736 | —- | M] () – C:\Documents and Settings\The Head Nigger\Desktop\HEATHER.xls
[2010/08/26 12:18:00 | 000,001,191 | -H– | M] () – C:\IPH.PH
[2010/08/26 12:15:29 | 000,001,594 | —- | M] () – C:\Documents and Settings\The Head Nigger\Application Data\Microsoft\Internet Explorer\Quick Launch\AIM.lnk
[2010/08/26 12:15:29 | 000,001,576 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AIM.lnk
[2010/08/24 12:28:12 | 000,000,894 | —- | M] () – C:\Documents and Settings\The Head Nigger\Application Data\Microsoft\Internet Explorer\Quick Launch\FrostWire 4.20.9.lnk
[2010/08/24 12:28:12 | 000,000,876 | —- | M] () – C:\Documents and Settings\The Head Nigger\Desktop\FrostWire 4.20.9.lnk
[2010/08/23 20:39:16 | 000,000,602 | —- | M] () – C:\WINDOWS\win.ini
[2010/07/20 10:22:32 | 000,002,519 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Comcast Desktop Doctor.lnk
[2010/07/07 12:49:44 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/13 10:52:48 | 000,000,138 | —- | C] () – C:\Documents and Settings\The Head Nigger\exehelperlog.txt
[2010/09/13 10:05:16 | 000,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/12 21:41:53 | 000,077,824 | —- | C] () – C:\Documents and Settings\The Head Nigger\Local Settings\Application Data\462606000.exe
[2010/09/12 15:11:01 | 000,001,878 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/09/07 15:42:04 | 000,033,280 | —- | C] () – C:\Documents and Settings\The Head Nigger\My Documents\resumewithcoverletter.doc
[2010/09/01 21:12:25 | 000,021,504 | —- | C] () – C:\Documents and Settings\The Head Nigger\My Documents\COVERLETTER.doc
[2010/08/26 12:15:29 | 000,001,576 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AIM.lnk
[2010/08/24 12:28:12 | 000,000,894 | —- | C] () – C:\Documents and Settings\The Head Nigger\Application Data\Microsoft\Internet Explorer\Quick Launch\FrostWire 4.20.9.lnk
[2010/08/24 12:28:12 | 000,000,876 | —- | C] () – C:\Documents and Settings\The Head Nigger\Desktop\FrostWire 4.20.9.lnk
[2010/08/20 17:32:54 | 000,001,518 | —- | C] () – C:\Documents and Settings\The Head Nigger\blackra1n.log
[2010/07/23 16:01:10 | 000,000,254 | —- | C] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2009/12/30 11:15:12 | 000,000,671 | —- | C] () – C:\Documents and Settings\The Head Nigger\Application Data\vso_ts_preview.xml
[2009/12/30 11:14:21 | 000,000,033 | —- | C] () – C:\Documents and Settings\The Head Nigger\Application Data\pcouffin.log
[2009/12/30 11:14:11 | 000,087,608 | —- | C] () – C:\Documents and Settings\The Head Nigger\Application Data\inst.exe
[2009/12/30 11:14:11 | 000,007,887 | —- | C] () – C:\Documents and Settings\The Head Nigger\Application Data\pcouffin.cat
[2009/12/30 11:14:11 | 000,001,144 | —- | C] () – C:\Documents and Settings\The Head Nigger\Application Data\pcouffin.inf
[2009/12/30 10:16:21 | 000,168,448 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/12/30 10:16:20 | 000,000,038 | —- | C] () – C:\WINDOWS\avisplitter.ini
[2009/12/30 10:16:19 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2009/12/30 10:16:19 | 000,881,664 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/12/30 10:16:19 | 000,205,824 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/12/30 10:16:18 | 000,085,504 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2009/12/30 10:16:18 | 000,000,547 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009/12/29 15:52:27 | 000,000,067 | —- | C] () – C:\WINDOWS\Easy Avi Divx Xvid to DVD Burner.INI
[2009/12/27 21:50:29 | 000,000,085 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2009/12/11 22:05:36 | 000,022,016 | —- | C] () – C:\Documents and Settings\The Head Nigger\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/09 12:37:32 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/11/09 12:16:36 | 000,001,165 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2009/11/07 13:40:35 | 000,001,746 | —- | C] () – C:\WINDOWS\Language_trs.ini
[2009/11/07 13:40:09 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2009/11/07 13:40:04 | 000,035,716 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2009/11/07 13:40:04 | 000,010,296 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009/11/07 12:26:51 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\drivers\WLNdis50.sys
[2008/10/16 15:46:00 | 001,703,936 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/10/16 15:46:00 | 001,486,848 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008/10/16 15:46:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/10/16 15:46:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008/10/16 15:46:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2008/10/07 09:13:30 | 000,197,912 | —- | C] () – C:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 09:13:22 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelFrench.dll
[2004/08/04 08:00:00 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\ieencode.dll
[2004/08/04 08:00:00 | 000,077,824 | —- | C] () – C:\WINDOWS\gkuibjap.dll
[2004/08/04 08:00:00 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys

========== LOP Check ==========

[2009/11/09 12:47:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2009/11/09 12:47:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM Toolbar
[2010/07/03 16:16:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PhotoStitch
[2010/03/27 16:07:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SupportSoft
[2010/05/19 20:26:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/12/30 11:18:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\vsosdk
[2010/01/06 16:16:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/11/09 12:47:20 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\acccore
[2009/12/30 10:39:52 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\AviDvdBurner
[2009/12/30 15:13:43 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\BitTorrent
[2010/03/29 13:52:29 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\Canon
[2009/12/30 10:54:27 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\DeepBurner
[2010/09/10 22:52:27 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\Dropbox
[2010/06/01 13:37:59 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\Easeware
[2010/09/10 17:52:49 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\FrostWire
[2009/12/24 01:45:06 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\LimeWire
[2010/02/20 10:18:49 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\Rainmeter
[2009/12/26 22:05:30 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\TeamViewer
[2010/03/04 19:34:41 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\VirtualStore
[2010/01/04 20:21:36 | 000,000,000 | —D | M] – C:\Documents and Settings\The Head Nigger\Application Data\Vso
[2010/09/13 11:01:00 | 000,000,254 | —- | M] () – C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/11/07 12:19:47 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/11/07 12:15:57 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2009/11/07 12:19:47 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2009/11/07 12:19:47 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/08/26 12:18:00 | 000,001,191 | -H– | M] () – C:\IPH.PH
[2009/11/07 12:19:47 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2010/03/27 16:06:12 | 000,000,998 | —- | M] () – C:\net_save.dna
[2004/08/04 08:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2004/08/04 08:00:00 | 000,250,032 | RHS- | M] () – C:\ntldr
[2010/09/07 13:11:45 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2010/09/13 10:54:34 | 000,000,536 | —- | M] () – C:\rkill.log

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/11/07 12:19:28 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007/12/17 18:05:32 | 000,278,016 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp5mu.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2009/11/07 08:08:42 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/11/07 08:08:42 | 000,634,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/11/07 08:08:42 | 000,913,408 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/11/07 12:19:52 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/11/07 12:24:06 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\The Head Nigger\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2009/11/07 12:24:06 | 000,000,079 | —- | M] () – C:\Documents and Settings\The Head Nigger\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 48 bytes -> C:\WINDOWS:3BE4B1DF41C5558F
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1AE68282
< End of report >






OTL Extras logfile created on: 9/13/2010 11:05:47 AM - Run 1
OTL by OldTimer - Version 3.2.12.0 Folder = C:\Documents and Settings\The Head Nigger\My Documents\Downloads\Firefox Downloads
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 57.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 102.63 Gb Free Space | 68.86% Space Free | Partition Type: NTFS
Drive D: | 37.26 Gb Total Space | 19.05 Gb Free Space | 51.13% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HNIC
Current User Name: The Head Nigger
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"5191:TCP" = 5191:TCP:*:Enabled:The Browser Highlighter XCOM

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard)
"C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe – (Hewlett-Packard Co.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard)
"C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe – (Hewlett-Packard Co.)
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM – (AOL Inc.)
"D:\Program Files\LimeWire\LimeWire.exe" = D:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire – (Lime Wire, LLC)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox – (Mozilla Corporation)
"C:\Program Files\TeamViewer\Version5\TeamViewer.exe" = C:\Program Files\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application – (TeamViewer GmbH)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent – (BitTorrent, Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\tbh\base\bin\tbhDaemon.exe" = C:\Program Files\tbh\base\bin\tbhDaemon.exe:*:Enabled:The Browser Highlighter - Daemon – ()
"C:\Program Files\tbh\monitor\bin\tbhMonitor.exe" = C:\Program Files\tbh\monitor\bin\tbhMonitor.exe:*:Enabled:The Browser Highlighter - Monitor – ()
"C:\Documents and Settings\The Head Nigger\Application Data\Dropbox\bin\Dropbox.exe" = C:\Documents and Settings\The Head Nigger\Application Data\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox – ()
"C:\Program Files\FrostWire\FrostWire.exe" = C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:FrostWire – (FrostWire Group)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{06B06D3B-C133-B15E-AF47-F7FE7F48DE49}" = CCC Help Turkish
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{07EA4E9F-BD35-4F38-9809-D825B772B833}" = Image Optimizer 3.0
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = MSN Toolbar
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{0915B10F-8597-4FE7-BC4D-EA3E2FDA646A}" = PS_AIO_03_C4400_Software_Min
"{09633A5E-3089-41A8-9FF1-382171423C5D}" = PSSWCORE
"{0A5ECD3B-191A-67C7-A04D-D4900C9501E5}" = Catalyst Control Center Graphics Previews Common
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{15B8AFD9-92E9-4E86-96D9-83FAC510B82E}" = HPPhotoSmartPhotobookWebPack1
"{1E71806D-587E-3DF8-0BA0-6010E3B4F071}" = CCC Help Swedish
"{1EBEC42C-5E3F-4077-933B-411E33A0C3A4}" = Motorola Driver Installation 4.6.0
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{22F761D1-8063-4170-ADF7-2D2F47834CA9}" = VideoToolkit01
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java™ 6 Update 17
"{26CC62F3-F66B-4F41-9679-421FCE3F03ED}" = ccc-core-static
"{27197499-7680-4208-8FD8-5439CDB0FDC1}" = HPProductAssistant
"{276E3ECB-E9E9-494E-A3F9-173BAD7D9643}" = C4400
"{2AFEAA03-2DFE-4519-A629-EDAB6541ABE9}" = HPSSupply
"{2B4508B3-7403-44FF-8FBC-5CCD032E3635}" = MSN Toolbar Platform
"{3113E537-41F6-8C1B-109A-38C76DE69271}" = Catalyst Control Center Localization All
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{37E5CADC-C146-F72B-EEFE-ABB1C5DC7D98}" = CCC Help Spanish
"{3B62CF95-5E25-4720-A3D6-B4A2B0501961}" = Browser Highlighter - Firefox
"{3EC4020D-3D75-ABCD-9BF1-E4D911D4CDED}" = Catalyst Control Center Graphics Full New
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{4918D7C5-9025-B706-DEF2-5E29AB5EAFEA}" = Catalyst Control Center Graphics Light
"{4A3D0CF8-60FF-4CEF-91A4-A1F001424602}" = DocProc
"{4C007A32-9570-725E-4C9A-70BB36785835}" = CCC Help Norwegian
"{4CC59DA1-469B-49A5-9F6B-C4D26990294A}" = PS_AIO_03_C4400_ProductContext
"{4D5CB2B2-DD58-D8B0-FC08-58A2DC897C23}" = CCC Help English
"{4E457212-AD7F-1747-9D9F-76BA98D44CC2}" = CCC Help Portuguese
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{516CB854-B95B-42AB-7887-9CFC24784A42}" = CCC Help Czech
"{53408AC4-2698-A35E-B41C-571BD549E212}" = Catalyst Control Center Core Implementation
"{53F3256D-DB6A-0E06-7874-A60D87B6AE5C}" = CCC Help Chinese Traditional
"{55408879-D7FF-01C2-DAC4-4146E1439304}" = CCC Help Polish
"{58B2C07A-CD58-CC42-2DF3-8F433EEF339B}" = CCC Help Finnish
"{593A6CAF-E114-4e31-884F-74FF349E8E36}" = SolutionCenter
"{5A3FEF2D-0E14-412E-869C-421AB373EE43}" = C4400_Help
"{5B4FA5EA-8C08-4B6D-AAF4-003A1AB8FFBA}" = CCC Help Russian
"{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard
"{61BEA823-ECAF-49F1-8378-A59B3B8AD247}" = Microsoft Default Manager
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{70E1E357-E57C-4284-B04E-58196DC27BC1}" = PanoStandAlone
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{77F09242-A107-4CB6-A295-D8656C2C3795}" = Samsung USB Driver (MCCI 4.24)
"{784B383D-1498-77AA-6085-A9EF197193D0}" = CCC Help Italian
"{78A1F747-520C-E068-ED99-08E7C4F75E2A}" = ccc-core-preinstall
"{79AE776D-FA42-4040-B5F3-F317500D0FCD}" = ATI AVIVO Codecs
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11231247}" = Peggle
"{86732AE7-CB91-4f15-B091-FBA3D3926CD6}" = HP Photosmart C4400 All-In-One Driver Software 11.0 Rel .3
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ACECB7C-5EB2-42B3-A2E1-B91878B6C5D7}" = PS_AIO_03_C4400_Software
"{910FC2D0-4BBF-08B1-DED9-96615AC9C33A}" = ccc-utility
"{913D0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Standard for Students and Teachers
"{94A065E8-455D-41C1-AF1F-F0C1AF8F50F3}" = Microsoft IntelliType Pro 7.0
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96AFFF85-9DBE-BE4A-326E-6F12535D2AA8}" = CCC Help Chinese Standard
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{9F4EE72A-C5C9-42ad-ABEF-427690843577}" = MarketResearch
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{AA2E8A46-B45E-4aea-8A23-88AB57D04523}" = WebReg
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC54E544-3E42-443C-A91D-A00A6974C592}" = NVIDIA PhysX v8.10.13
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.4
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ADD461BD-0409-186A-8056-C1F51B782EDA}" = CCC Help Greek
"{B1BDEA80-95CE-4DFB-B9D3-DC800E7F87B4}" = TRENDnet 802.11g Wireless CardBus/PCI Adapter
"{B3471105-8237-6DC4-C8EF-DD4E71344398}" = CCC Help Dutch
"{B9F8DBD5-EFAF-F5FB-B862-33D4FFC6354C}" = Catalyst Control Center HydraVision Full
"{BCF93617-DD69-74B7-FBDC-0B0AEFAE7D43}" = CCC Help Thai
"{BF08AB1C-3357-4f20-A200-8EBB8EF27C59}" = BufferChm
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C89B5E3A-690F-4CEE-909A-BF869E198B0A}" = Scan
"{CC0E1AE3-091D-4969-B151-7AC142062C28}" = SmartWebPrinting
"{CFCF9764-6D75-2EAD-D274-45278E48167C}" = CCC Help Japanese
"{D063F201-FAC4-4D5C-B10B-615058ADE5A7}" = HP Update
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D16B4BE6-8B10-422f-8034-96D1CA9483B5}" = GPBaseService
"{D3D79A61-3E3A-7D3D-F094-2614CE007D9F}" = CCC Help Korean
"{D3E434C7-8542-5C5C-FE02-1090E7A1C04A}" = Catalyst Control Center Graphics Full Existing
"{D74CFE48-087F-46E1-80E6-E2950E1A8DCE}" = HP Photosmart Essential 2.5
"{D87149B3-7A1D-4548-9CBF-032B791E5908}" = Desktop Doctor
"{D9D93D74-107D-4BD3-87D0-AABCF7C98BD5}" = Catalyst Control Center - Branding
"{E133E97F-5186-4503-BEC8-752EB9E8EBD7}" = Copy
"{E30DFCDA-9CB6-B062-A0DB-B48D295D6545}" = CCC Help Hungarian
"{E535C94A-B87F-4182-BEA8-1E9322078D3E}" = Cards_Calendar_OrderGift_DoMorePlugout
"{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
"{EA14702F-74A1-7A7B-032C-98DEA06F01BE}" = CCC Help German
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{EF9E56EE-0243-4BAD-88F4-5E7508AA7D96}" = Destination Component
"{F4423F03-A62C-57C2-BF6E-6AC06D27E094}" = CCC Help French
"{F7B0E599-C114-4493-BC4D-D8FC7CBBABBB}" = 32 Bit HP CIO Components Installer
"{F8A3C1B6-D2E0-4CE1-80A2-555D6F71C639}" = Microsoft Search Enhancement Pack
"{F9D0A12A-1641-A4DB-4649-F7AB1F3A0F59}" = CCC Help Danish
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AIM Search" = AIM Search
"AIM Toolbar" = AIM Toolbar
"AIM_7" = AIM 7
"All ATI Software" = ATI - Software Uninstall Utility
"AOL Search" = AOL Search
"ATI Display Driver" = ATI Display Driver
"avast!" = avast! Antivirus
"BitTorrent" = BitTorrent
"CAL" = Canon Camera Access Library
"CameraUserGuide-PSSD1200IS_IXUS95IS" = Canon PowerShot SD1200 IS_IXUS 95 IS Camera User Guide
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"CCleaner" = CCleaner
"ComcastHSI" = Comcast High-Speed Internet Install Wizard
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"DriverEasy_is1" = DriverEasy version 1.0.5
"FrostWire" = FrostWire 4.20.9
"HP Imaging Device Functions" = HP Imaging Device Functions 11.0
"HP Photosmart Essential" = HP Photosmart Essential 3.0
"HP Smart Web Printing" = HP Smart Web Printing
"HP Solution Center & Imaging Support Tools" = HP Solution Center 11.0
"HPExtendedCapabilities" = HP Customer Participation Program 11.0
"HPOCR" = OCR Software by I.R.I.S. 11.0
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"InstallShield_{77F09242-A107-4CB6-A295-D8656C2C3795}" = Samsung USB Driver (MCCI 4.24)
"IrfanView" = IrfanView (remove only)
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 5.0.5
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox (3.5.11)" = Mozilla Firefox (3.5.11)
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"MyWebSearch bar Uninstall" = My Web Search (Smiley Central)
"NVIDIA Drivers" = NVIDIA Drivers
"Personal Printing Guide" = Canon Personal Printing Guide
"PhotoStitch" = Canon Utilities PhotoStitch
"Rainmeter" = Rainmeter (remove only)
"Recuva" = Recuva
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"Shop for HP Supplies" = Shop for HP Supplies
"SoftwareStarterGuide-DCSD40_46" = Canon Digital Camera Solution Disk 40-46 Software Starter Guide
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"TeamViewer 5" = TeamViewer 5
"VLC media player" = VLC media player 1.0.3
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WinRAR archiver" = WinRAR archiver
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 12/30/2009 12:05:58 PM | Computer Name = HNIC | Source = avast! | ID = 33554522
Description = Error in aswChestC: chestAddFile Error 112.

Error - 12/30/2009 12:06:04 PM | Computer Name = HNIC | Source = avast! | ID = 33554522
Description = Error in aswChestS: chest s_NewFile Error 112.

Error - 12/30/2009 12:06:04 PM | Computer Name = HNIC | Source = avast! | ID = 33554522
Description = Error in aswChestC: chestAddFile Error 112.

Error - 12/30/2009 12:08:06 PM | Computer Name = HNIC | Source = avast! | ID = 33554522
Description = Error in aswChestS: chest s_NewFile Error 112.

Error - 12/30/2009 12:08:06 PM | Computer Name = HNIC | Source = avast! | ID = 33554522
Description = Error in aswChestC: chestAddFile Error 112.

Error - 12/30/2009 12:08:18 PM | Computer Name = HNIC | Source = avast! | ID = 33554522
Description = Error in aswChestS: chest s_NewFile Error 112.

Error - 12/30/2009 12:08:18 PM | Computer Name = HNIC | Source = avast! | ID = 33554522
Description = Error in aswChestC: chestAddFile Error 112.

Error - 12/30/2009 12:08:30 PM | Computer Name = HNIC | Source = avast! | ID = 33554522
Description = Error in aswChestS: chest s_NewFile Error 112.

Error - 12/30/2009 12:08:30 PM | Computer Name = HNIC | Source = avast! | ID = 33554522
Description = Error in aswChestC: chestAddFile Error 112.

Error - 3/3/2010 6:11:37 PM | Computer Name = HNIC | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://voxel.dl.sourceforge.net/project/gp…ive-0.5.1-3.iso
failed, 00000084.

[ Application Events ]
Error - 6/10/2010 3:55:12 PM | Computer Name = HNIC | Source = Application Hang | ID = 1002
Description = Hanging application rundll32.exe, version 5.1.2600.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/10/2010 4:01:07 PM | Computer Name = HNIC | Source = MsiInstaller | ID = 1013
Description = Product: Motorola Driver Installation 3.2.0 – Unable to install because
a newer version of this product is already installed.

Error - 6/10/2010 4:01:25 PM | Computer Name = HNIC | Source = MsiInstaller | ID = 1013
Description = Product: Motorola Driver Installation 4.2.0 – Unable to install because
a newer version of this product is already installed.

Error - 6/10/2010 4:02:02 PM | Computer Name = HNIC | Source = Application Hang | ID = 1002
Description = Hanging application rundll32.exe, version 5.1.2600.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/11/2010 5:09:10 PM | Computer Name = HNIC | Source = Application Hang | ID = 1002
Description = Hanging application ZoomBrowser.exe, version 6.3.0.7, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/12/2010 11:21:03 AM | Computer Name = HNIC | Source = Application Hang | ID = 1002
Description = Hanging application ZoomBrowser.exe, version 6.3.0.7, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/27/2010 10:51:16 AM | Computer Name = HNIC | Source = Application Hang | ID = 1002
Description = Hanging application ZoomBrowser.exe, version 6.3.0.7, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/27/2010 7:43:29 PM | Computer Name = HNIC | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.1.3726, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 7/3/2010 3:59:26 PM | Computer Name = HNIC | Source = Application Hang | ID = 1002
Description = Hanging application ZoomBrowser.exe, version 6.3.0.7, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 7/3/2010 4:08:28 PM | Computer Name = HNIC | Source = Application Hang | ID = 1002
Description = Hanging application ZoomBrowser.exe, version 6.3.0.7, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 8/27/2010 2:37:36 PM | Computer Name = HNIC | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
HEATHER that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{E43AA038-41B8-4632-9. The master browser is stopping or an election
is being forced.

Error - 8/27/2010 4:13:39 PM | Computer Name = HNIC | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
HEATHER that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{E43AA038-41B8-4632-9. The master browser is stopping or an election
is being forced.

Error - 8/27/2010 5:25:42 PM | Computer Name = HNIC | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
HEATHER that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{E43AA038-41B8-4632-9. The master browser is stopping or an election
is being forced.

Error - 8/27/2010 9:12:29 PM | Computer Name = HNIC | Source = Dhcp | ID = 1002
Description = The IP address lease 10.10.10.100 for the Network Card with network
address 0014D1657639 has been denied by the DHCP server 10.10.10.1 (The DHCP Server
sent a DHCPNACK message).

Error - 8/27/2010 9:14:06 PM | Computer Name = HNIC | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 10.10.10.101
with the system having network hardware address 0C:60:76:6B:06:83. Network operations
on this system may be disrupted as a result.

Error - 8/29/2010 10:50:28 PM | Computer Name = HNIC | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery Service service hung on starting.

Error - 8/30/2010 9:28:11 AM | Computer Name = HNIC | Source = Print | ID = 6161
Description = The document PayPal Website Payment Deta… owned by The Head Nigger
failed to print on printer HP Photosmart C4400 series. Data type: NT EMF 1.008.
Size of the spool file in bytes: 0. Number of bytes printed: 0. Total number of
pages in the document: 0. Number of pages printed: 0. Client machine: \\HNIC. Win32
error code returned by the print processor: 259 (0x103).

Error - 8/30/2010 12:16:13 PM | Computer Name = HNIC | Source = Dhcp | ID = 1002
Description = The IP address lease 10.10.10.101 for the Network Card with network
address 0014D1657639 has been denied by the DHCP server 10.10.10.1 (The DHCP Server
sent a DHCPNACK message).

Error - 9/6/2010 12:16:26 PM | Computer Name = HNIC | Source = Dhcp | ID = 1002
Description = The IP address lease 10.10.10.101 for the Network Card with network
address 0014D1657639 has been denied by the DHCP server 10.10.10.1 (The DHCP Server
sent a DHCPNACK message).

Error - 9/7/2010 1:13:57 PM | Computer Name = HNIC | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery Service service hung on starting.


< End of report >

NEVERMIND, I realized I didn't have it saved to my desktop and it wasn't opening properly because of this. Here is the log after it ran. Thanks!





ComboFix 10-09-14.01 - The Head Nigger 09/14/2010 15:07:48.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2047.1180 [GMT -4:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\Firefox Downloads\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100914-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
ADS - WINDOWS: deleted 48 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\The Head Nigger\Application Data\inst.exe
c:\documents and settings\The Head Nigger\Desktop\recovered files\desktop_1.ini
c:\documents and settings\The Head Nigger\Desktop\recovered files\desktop_2.ini
c:\program files\FunWebProducts
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\Uninstall Fun Web Products.dll

.
((((((((((((((((((((((((( Files Created from 2010-08-14 to 2010-09-14 )))))))))))))))))))))))))))))))
.

2010-09-14 12:35 . 2010-09-14 12:35 ——– d—–w- C:\_OTL
2010-09-13 14:05 . 2010-09-14 12:36 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-09-12 19:11 . 2010-09-13 01:52 ——– d—–w- c:\documents and settings\The Head Nigger\Application Data\Skype
2010-08-26 16:15 . 2010-08-26 16:15 ——– d—–w- c:\program files\Common Files\Software Update Utility
2010-08-26 16:15 . 2010-08-26 16:15 ——– d—–w- c:\program files\AOL Search

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-14 12:37 . 2010-05-27 18:25 ——– d—–w- c:\documents and settings\The Head Nigger\Application Data\Dropbox
2010-09-13 19:02 . 2009-12-29 15:20 ——– d—–w- c:\documents and settings\The Head Nigger\Application Data\CameraWindowDC
2010-09-13 16:49 . 2009-12-29 15:21 ——– d—–w- c:\documents and settings\The Head Nigger\Application Data\ZoomBrowser EX
2010-09-13 16:31 . 2010-01-31 19:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2010-09-13 12:23 . 2009-11-18 17:48 ——– d—–w- c:\documents and settings\The Head Nigger\Application Data\HPAppData
2010-09-12 20:01 . 2010-01-31 19:40 ——– d—–w- c:\documents and settings\The Head Nigger\Application Data\skypePM
2010-09-10 21:52 . 2010-07-23 20:01 ——– d—–w- c:\documents and settings\The Head Nigger\Application Data\FrostWire
2010-08-26 16:15 . 2009-11-09 16:47 ——– d—–w- c:\program files\AIM Toolbar
2010-08-26 16:15 . 2009-11-09 16:46 ——– d—–w- c:\program files\AIM
2010-08-24 16:49 . 2010-07-23 20:00 ——– d—–w- c:\program files\FrostWire
2010-08-06 02:01 . 2010-07-23 20:01 ——– d—–w- c:\program files\Ask.com
2010-07-30 18:16 . 2010-07-30 18:16 10134 —-a-r- c:\documents and settings\The Head Nigger\Application Data\Microsoft\Installer\{07EA4E9F-BD35-4F38-9809-D825B772B833}\_D4424672D4398E0075B8C9.exe
2010-07-30 18:16 . 2010-07-30 18:16 10134 —-a-r- c:\documents and settings\The Head Nigger\Application Data\Microsoft\Installer\{07EA4E9F-BD35-4F38-9809-D825B772B833}\_8D2DDD75F2DEDD31E45B21.exe
2010-07-30 18:16 . 2010-07-30 18:16 ——– d—–w- c:\program files\Geeks Ltd
2010-07-29 16:10 . 2010-07-29 16:10 364544 —-a-w- c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\aimtbres.dll
2010-07-28 15:31 . 2010-01-06 20:16 ——– d—–w- c:\documents and settings\The Head Nigger\Application Data\Apple Computer
2010-07-26 13:28 . 2010-07-26 13:28 2944904 —-a-w- c:\documents and settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\extensions\[removed]\chrome\temp\askToolbar.exe
2010-07-23 20:07 . 2010-07-23 20:07 0 —-a-w- c:\documents and settings\The Head Nigger\Application Data\FrostWire\.NetworkShare\Incomplete\T-4506256-LimeWireWin4.16.6.exe
2010-07-09 13:21 . 2009-10-22 18:57 221184 —-a-w- c:\documents and settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\extensions\[removed]\components\Shim.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-26 19:23 1385864 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\The Head Nigger\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\The Head Nigger\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\The Head Nigger\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim"="c:\program files\AIM\aim.exe" [2010-08-03 4424024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-16 13578240]
"nwiz"="nwiz.exe" [2008-10-16 1630208]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-12-31 33546240]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-16 86016]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-26 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-09 149280]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"tbhSystray"="c:\program files\tbh\base\bin\tbhSystray.exe" [2010-06-10 492840]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-05-21 1501064]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-15 98304]
"MSN Toolbar"="c:\program files\MSN Toolbar\Platform\4.0.0360.0\mswinext.exe" [2009-11-18 240480]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]

c:\documents and settings\The Head Nigger\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\The Head Nigger\Application Data\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]
Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2009-11-1 119296]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Wireless Configuration Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Wireless Configuration Utility.lnk
backup=c:\windows\pss\Wireless Configuration Utility.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"d:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\tbh\\base\\bin\\tbhDaemon.exe"=
"c:\\Program Files\\tbh\\monitor\\bin\\tbhMonitor.exe"=
"c:\\Documents and Settings\\The Head Nigger\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5191:TCP"= 5191:TCP:The Browser Highlighter XCOM

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [12/27/2009 9:46 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/27/2009 9:46 PM 20560]
R2 tbhMonitor.exe;The Browser Highlighter Monitor;c:\program files\tbh\monitor\bin\tbhMonitor.exe [10/22/2009 2:57 PM 70952]
R2 WLNdis50;Wireless Lan NDIS Protocol I/O Control;c:\windows\system32\drivers\WLNdis50.sys [11/7/2009 12:26 PM 20480]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [11/7/2009 2:47 PM 39456]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [11/7/2009 1:43 PM 993280]
S2 WLSVC;WLSVC;c:\program files\TRENDnet\TEW-421PC_TEW-423PI\WLSVC.exe [12/26/2009 5:22 PM 167936]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [6/10/2010 3:51 PM 19712]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [6/10/2010 3:51 PM 8320]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [6/10/2010 3:51 PM 23936]
S3 PciCon;PciCon;\??\f:\pcicon.sys –> f:\PciCon.sys [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - NORMANDY
*Deregistered* - Normandy

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-09-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-09-14 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-05-26 19:23]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.ask.com?o=14196&l=dis
mStart Page = hxxp://www.comcast.net/
mWindow Title = Windows Internet Explorer provided by Comcast
uInternet Settings,ProxyOverride =
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=MSGTDF&PC=MSNG&q=
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.aol.com/?src=aim&ncid=snsusaimc00000001
FF - component: c:\documents and settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - component: c:\documents and settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}\components\MailUtil.dll
FF - component: c:\documents and settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\extensions\{c38eebda-0a39-4f01-989b-dc3ef3124bc2}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\extensions\{c38eebda-0a39-4f01-989b-dc3ef3124bc2}\components\RadioWMPCore.dll
FF - component: c:\documents and settings\The Head Nigger\Application Data\Mozilla\Firefox\Profiles\s5y6ibzs.default\extensions\[removed]\components\Shim.dll
FF - component: c:\program files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\components\SEPsearchhelperff.dll
FF - plugin: c:\program files\Canon\ZoomBrowser EX\Program\NPCIG.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
FF - plugin: c:\program files\MSN Toolbar\Platform\4.0.0360.0\npwinext.dll

—- FIREFOX POLICIES —-
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-HookURL - (no file)
URLSearchHooks-Rank - (no file)
URLSearchHooks-HookURL - (no file)
URLSearchHooks-Rank - (no file)
HKCU-Run-Pjakofuqoqiwog - c:\windows\gkuibjap.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-14 15:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(812)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\COMRes.dll
.
Completion time: 2010-09-14 15:21:53
ComboFix-quarantined-files.txt 2010-09-14 19:21

Pre-Run: 110,204,559,360 bytes free
Post-Run: 110,225,920,000 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 525707E3B472383C0CA4847A2F595233