Spyware / Malware / Virus Removal

computer virus - trojan

17 min read

Looking for the outcome? Ask AI

UrbanSpice Topic Starter

Post #1October 6, 2010, 3:54 AM UTC

Just remembered I had an account here! Anyway, nasty virus or something and I don't know what it is. Started with computer acting really funny, slow, realized my Emisoft program had been turned off. I downloaded kaspersky which deleted trojan program backdoor.win32.sdbot.qzd. Thought I was good, only now my contacts have been receiving strange emails from me. I ran several anti-virus programs - emisoft, avg, panda online, symantec online, kaspersky. Only panda and kaspersky found something. panda found this: 06419169 Bck/Sdbot.JED.worm Virus/Trojan No 1 No No c:\windows\downloaded installations\{90f42154-37ba-4079-85a2-7b2db7ea6a01}\movie magic screenwriter 6.msi[unk_0107][netpub.exe] but couldn't delete it. what Kaspersky is above. All the other programs found nothing. I'll be here for the next 60 minutes or so.

Conspire

Post #2October 6, 2010, 10:03 AM UTC

Hello there, UrbanSpice

I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:

Read the entire procedure
It is important to perform ALL actions in sequence.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Stick with me till you're given the all clear.
Remember, absence of symptoms does not mean the infection is all gone.
Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

Please bear with me, I will post back to you as soon as I can.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

**In any case where you happen to be busy or unable to give us a reply, we would be more than grateful if you keep us informed in advance and we will be more than happy to wait. Failure to do so we will have your thread closed in FIVE(5) days.

UrbanSpice

Post #3October 6, 2010, 11:46 AM UTC

okay, i'm ready when you are.

Conspire

Post #4October 7, 2010, 5:36 AM UTC

Hello there,

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click on Minimal Output at the top
Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
Double click inside the Custom Scan box at the bottom
A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
Click the OK button and navigate to the file scan.txt which we just saved to your desktop
Select scan.txt and click Open. Writing will now appear under the Custom Scan box
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

===================================================

[external image: Posted Image]

Please download GMER from one of the following locations, and save it to your desktop:
Main Mirror
This version will download a randomly named file (Recommended)
Zip Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

Extract the contents of the zipped file to desktop (applicable only to Zip mirror) .
Double click [external image: Posted Image] or [external image: Posted Image] on your desktop.
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
[external image: Posted Image]

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===================================================

Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

===================================================

On your next reply please post :
OTL log
GMER log
Checkup log

Good Day!

UrbanSpice

Post #5October 7, 2010, 2:42 PM UTC

I am running otl now. Gmer gives me an error: c:\windows\system32\config\system: The system file cannot be specified. And I cannot check anything above services, it is grayed out.

Conspire

Post #6October 7, 2010, 2:56 PM UTC

Ok, skip GMER for the time being.

UrbanSpice

Post #7October 7, 2010, 4:21 PM UTC

OTL (can't seem to get the extras.txt file – am I doing something wrong? I ran the scan several times.)

OTL logfile created on: 10/7/2010 12:05:57 PM - Run 8
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Michelle\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 27.00% Memory free
4.00 Gb Paging File | 1.00 Gb Available in Paging File | 36.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 222.47 Gb Total Space | 152.69 Gb Free Space | 68.63% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 27.85 Gb Total Space | 3.77 Gb Free Space | 13.53% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MICHELLE-PC
Current User Name: Michelle
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS\562C4DD5\18.1.0.37\InstStub.exe (Symantec Corporation)
PRC - C:\Users\Michelle\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe (Kaspersky Lab ZAO)
PRC - C:\Users\Michelle\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files (x86)\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG10\avgam.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Backblaze\bzbui.exe ()
PRC - C:\Program Files (x86)\Backblaze\bzserv.exe ()
PRC - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe (Google)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Common Files\Research in Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)
PRC - C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe (Audible, Inc.)
PRC - C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)

========== Modules (SafeList) ==========

MOD - C:\Users\Michelle\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files (x86)\Internet Explorer\ieproxy.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\rsaenh.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\WindowsCodecs.dll (Microsoft Corporation)
MOD - C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\thumbcache.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\StructuredQuery.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\srvcli.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\slc.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\SearchFolder.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\RpcRtRemote.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\ntshrui.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\networkexplorer.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\linkinfo.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\EhStorShell.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\cscapi.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\actxprxy.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV:64bit: - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
SRV:64bit: - (TOSHIBA HDD SSD Alert Service) – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TosCoSrv) – C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TODDSrv) – C:\Windows\SysNative\TODDSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AntiVirSchedulerService) – C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirWebService) – C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH)
SRV - (AntiVirMailService) – C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)
SRV - (AntiVirService) – C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AVP) – C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe (Kaspersky Lab ZAO)
SRV - (avgwd) – C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AVGIDSAgent) – C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (bzserv) – C:\Program Files (x86)\Backblaze\bzserv.exe ()
SRV - (GoogleDesktopManager-051210-111108) – C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (TMachInfo) – C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
SRV - (YahooAUService) – C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)

========== Driver Services (SafeList) ==========

DRV:64bit: - (SymEvent) – C:\windows\SysNative\Drivers\SYMEVENT64x86.SYS File not found
DRV:64bit: - (SymEFA) – C:\windows\SysNative\drivers\N360x64\0401000.020\SYMEFA64.SYS File not found
DRV:64bit: - (SymDS) – C:\windows\SysNative\drivers\N360x64\0401000.020\SYMDS64.SYS File not found
DRV:64bit: - (avipbb) – C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) – C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (KLIF) – C:\Windows\SysNative\drivers\klif.sys (Kaspersky Lab)
DRV:64bit: - (AVGIDSEH) – C:\Windows\SysNative\drivers\AVGIDSEH.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (Avgtdia) – C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgmfx64) – C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgldx64) – C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgrkx64) – C:\Windows\SysNative\drivers\avgrkx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (AVGIDSDriver) – C:\Windows\SysNative\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (AVGIDSFilter) – C:\Windows\SysNative\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (mozyFilter) – C:\Windows\SysNative\drivers\mozy.sys (Mozy, Inc.)
DRV:64bit: - (kl2) – C:\Windows\SysNative\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV:64bit: - (KL1) – C:\Windows\SysNative\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV:64bit: - (KLIM6) – C:\Windows\SysNative\drivers\klim6.sys (Kaspersky Lab ZAO)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (L1C) – C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (RSUSBSTOR) – C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (CnxtHdAudService) – C:\Windows\SysNative\drivers\CHDRT64.sys (Conexant Systems Inc.)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (klmouflt) – C:\Windows\SysNative\drivers\klmouflt.sys (Kaspersky Lab)
DRV:64bit: - (motport) – C:\Windows\SysNative\drivers\motport.sys (Motorola)
DRV:64bit: - (motmodem) – C:\Windows\SysNative\drivers\motmodem.sys (Motorola)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (tdcmdpst) – C:\Windows\SysNative\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV:64bit: - (TVALZ) – C:\Windows\SysNative\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ROOTMODEM) – C:\Windows\SysNative\drivers\rootmdm.sys (Microsoft Corporation)
DRV:64bit: - (FwLnk) – C:\Windows\SysNative\drivers\FwLnk.sys (TOSHIBA Corporation)
DRV:64bit: - (pavboot) – C:\Windows\SysNative\drivers\pavboot64.sys (Panda Security, S.L.)
DRV:64bit: - (motccgp) – C:\Windows\SysNative\drivers\motccgp.sys (Motorola)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (NWADI) – C:\Windows\SysNative\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (motccgpfl) – C:\Windows\SysNative\drivers\motccgpfl.sys (Motorola)
DRV:64bit: - (RimVSerPort) – C:\Windows\SysNative\drivers\RimSerial_AMD64.sys (Research in Motion Ltd)
DRV:64bit: - (JLTECH0227) – C:\Windows\SysNative\drivers\jl2005c.sys (Windows ® Codename Longhorn DDK provider)
DRV:64bit: - (RimUsb) – C:\Windows\SysNative\drivers\RimUsb_AMD64.sys (Research In Motion Limited)
DRV - (SMSIVZAM5X64) – C:\Program Files (x86)\Verizon Wireless\VZAccess Manager\SMSIVZAM5X64.sys (Smith Micro Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?br…A&bmod=TSNA
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?br…A&bmod=TSNA

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig?brand=TSNA&bmod=TSNA
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files (x86)\AVG\AVG10\Firefox\ [2010/10/05 22:17:09 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\THBExt [2010/10/05 22:17:19 | 000,000,000 | —D | M]

[2010/08/02 11:52:06 | 000,000,000 | —D | M] – C:\Users\Michelle\AppData\Roaming\Mozilla\Extensions
[2010/07/21 23:30:56 | 000,000,000 | —D | M] – C:\Users\Michelle\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/08/02 11:52:06 | 000,000,000 | —D | M] – C:\Users\Michelle\AppData\Roaming\Mozilla\Firefox\Profiles\rns3w5uj.default\extensions

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\x64\ievkbd.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg64.dll (Google Inc.)
O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll ()
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [] File not found
O4:64bit: - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4:64bit: - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [BlackBerryAutoUpdate] C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKCU..\Run: [Backblaze] C:\Program Files (x86)\Backblaze\bzbui.exe ()
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [Norton Download Manager{NIS_prod_1.5.30_18.1.0.37}] C:\Users\Public\Downloads\Norton\{NIS_prod_1.5.30_18.1.0.37}\NISDownloader.exe (Symantec Corporation)
O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\windows\SysWow64\StikyNot.exe File not found
O4 - HKCU..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKLM..\RunOnce: [NIS] C:\Program Files (x86)\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS\562C4DD5\18.1.0.37\InstStub.exe (Symantec Corporation)
O4 - Startup: C:\Users\Michelle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy Software Installer.lnk = C:\Program Files (x86)\Best Buy Software Installer\Best Buy Software Installer.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files (x86)\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Michelle\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Michelle\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8:64bit: - Extra context menu item: Google Sidewiki… - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files (x86)\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube Download - C:\Users\Michelle\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Michelle\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O9:64bit: - Extra Button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} http://www.sibelius.com/download/software/…tiveXPlugin.cab (ScorchPlugin Class)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed]
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files (x86)\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (C:\PROGRA~2\Google\GOOGLE~3\GO36F4~1.DLL) - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\mzvkbd3.dll (Kaspersky Lab ZAO)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\klogon: DllName - Reg Error: Key error. - C:\Windows\SysNative\klogon.dll (Kaspersky Lab ZAO)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG10\avgchsva.exe /sync) - C:\Program Files (x86)\AVG\AVG10\avgchsva.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG10\avgrsa.exe /sync /restart) - C:\Program Files (x86)\AVG\AVG10\avgrsa.exe (AVG Technologies CZ, s.r.o.)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\windows\SysWow64\iccvid.dll (Radius Inc.)

SafeBootMin:64bit: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet:64bit: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} -
ActiveX:64bit: >{939BA228-19B1-4739-894E-21DA6C230C15} - RunDLL32 IEDKCS32.DLL,BrandIE4 CUSTOM
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/10/07 11:19:24 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\Michelle\Desktop\OTL.exe
[2010/10/06 20:00:02 | 000,000,000 | —D | C] – C:\Users\Michelle\AppData\Roaming\Research In Motion
[2010/10/06 02:54:15 | 000,000,000 | —D | C] – C:\ProgramData\F-Secure
[2010/10/06 01:49:42 | 000,000,000 | —D | C] – C:\windows\SysNative\AppLogs
[2010/10/06 01:49:37 | 000,000,000 | —D | C] – C:\ProgramData\!SASCORE
[2010/10/06 01:49:05 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/10/06 01:42:12 | 000,000,000 | —D | C] – C:\Users\Michelle\AppData\Roaming\Avira
[2010/10/06 01:36:01 | 000,116,568 | —- | C] (Avira GmbH) – C:\windows\SysNative\drivers\avipbb.sys
[2010/10/06 01:35:59 | 000,081,072 | —- | C] (Avira GmbH) – C:\windows\SysNative\drivers\avgntflt.sys
[2010/10/06 01:35:59 | 000,051,992 | —- | C] (AVIRA GmbH) – C:\windows\SysWow64\drivers\avgntdd.sys
[2010/10/06 01:35:59 | 000,017,016 | —- | C] (AVIRA GmbH) – C:\windows\SysWow64\drivers\avgntmgr.sys
[2010/10/06 01:35:36 | 000,000,000 | —D | C] – C:\ProgramData\Avira
[2010/10/06 01:35:35 | 000,000,000 | —D | C] – C:\Program Files (x86)\Avira
[2010/10/06 01:23:00 | 000,000,000 | —D | C] – C:\ProgramData\PCSettings
[2010/10/06 01:03:45 | 000,000,000 | —D | C] – C:\Users\Michelle\AppData\Roaming\Tific
[2010/10/06 01:03:18 | 000,000,000 | —D | C] – C:\Users\Michelle\AppData\Local\Symantec
[2010/10/06 00:51:57 | 000,126,312 | R— | C] (GEAR Software Inc.) – C:\windows\SysNative\GEARAspi64.dll
[2010/10/06 00:51:57 | 000,107,368 | R— | C] (GEAR Software Inc.) – C:\windows\SysWow64\GEARAspi.dll
[2010/10/06 00:51:57 | 000,034,152 | R— | C] (GEAR Software Inc.) – C:\windows\SysNative\drivers\GEARAspiWDM.sys
[2010/10/06 00:28:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Norton 360
[2010/10/06 00:28:09 | 000,000,000 | —D | C] – C:\Program Files (x86)\NortonInstaller
[2010/10/05 22:35:54 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Michelle\Desktop\HiJackThis.exe
[2010/10/05 17:02:57 | 000,000,000 | —D | C] – C:\ProgramData\Research In Motion
[2010/10/05 17:02:52 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Roxio Shared
[2010/10/05 17:02:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\Research In Motion
[2010/10/05 17:02:12 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2010/10/02 09:41:58 | 000,000,000 | —D | C] – C:\Program Files (x86)\Kaspersky Lab
[2010/10/02 09:41:57 | 000,000,000 | —D | C] – C:\ProgramData\Kaspersky Lab
[2010/10/02 09:41:37 | 000,556,120 | —- | C] (Kaspersky Lab) – C:\windows\SysNative\drivers\klif.sys
[2010/10/02 09:32:37 | 000,000,000 | —D | C] – C:\ProgramData\Kaspersky Lab Setup Files
[2010/10/01 22:02:16 | 096,140,336 | —- | C] (Emsi Software GmbH ) – C:\Users\Michelle\Desktop\a2AntiMalwareSetup.exe
[2010/10/01 18:09:54 | 000,000,000 | —D | C] – C:\Users\Michelle\AppData\Roaming\Malwarebytes
[2010/10/01 18:08:34 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\windows\SysWow64\drivers\mbamswissarmy.sys
[2010/10/01 18:08:33 | 000,024,664 | —- | C] (Malwarebytes Corporation) – C:\windows\SysNative\drivers\mbam.sys
[2010/10/01 18:08:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/10/01 18:08:33 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/10/01 15:57:56 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2010/10/01 15:30:47 | 000,000,000 | -H-D | C] – C:\$AVG
[2010/10/01 12:38:37 | 000,000,000 | —D | C] – C:\Users\Michelle\Desktop\gmer
[2010/10/01 12:07:18 | 000,000,000 | —D | C] – C:\Users\Michelle\AppData\Roaming\AVG10
[2010/10/01 11:58:46 | 000,000,000 | —D | C] – C:\windows\SysWow64\drivers\AVG
[2010/10/01 11:57:59 | 000,000,000 | —D | C] – C:\ProgramData\AVG10
[2010/10/01 11:57:59 | 000,000,000 | —D | C] – C:\windows\SysNative\drivers\AVG
[2010/10/01 11:57:42 | 000,000,000 | —D | C] – C:\Program Files (x86)\AVG
[2010/10/01 10:32:29 | 000,000,000 | —D | C] – C:\ProgramData\MFAData
[2010/09/30 13:19:34 | 000,033,800 | —- | C] (Panda Security, S.L.) – C:\windows\SysNative\drivers\pavboot64.sys
[2010/09/30 13:19:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\Panda Security
[2010/09/30 12:08:36 | 000,000,000 | —D | C] – C:\ProgramData\Noteable
[2010/09/30 12:07:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\The Noteable Software Company
[2010/09/30 10:49:58 | 000,000,000 | —D | C] – C:\Users\Michelle\AppData\Local\PackageAware
[2010/09/30 10:12:22 | 000,243,712 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\drivers\ks.sys
[2010/09/22 21:54:04 | 000,000,000 | —D | C] – C:\Users\Michelle\AppData\Roaming\Softland
[2010/09/22 21:54:03 | 000,000,000 | —D | C] – C:\Softland
[2010/09/22 21:53:58 | 000,024,392 | —- | C] (Softland) – C:\windows\SysNative\dopdfmn7.dll
[2010/09/22 21:53:58 | 000,020,296 | —- | C] (Softland) – C:\windows\SysNative\dopdfmi7.dll
[2010/09/22 21:53:55 | 001,700,352 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\GdiPlus.dll
[2010/09/22 21:53:53 | 000,000,000 | —D | C] – C:\Program Files\Softland
[2010/09/21 09:34:24 | 000,000,000 | —D | C] – C:\ProgramData\GoBoingo
[2010/09/20 20:44:09 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Motorola Shared
[2010/09/20 20:31:06 | 000,000,000 | —D | C] – C:\Program Files (x86)\Motorola
[2010/09/20 20:11:28 | 000,000,000 | —D | C] – C:\Users\Michelle\Documents\bitpim
[2010/09/20 16:00:07 | 000,000,000 | —D | C] – C:\Program Files (x86)\BitPim
[2010/09/20 15:21:03 | 000,000,000 | —D | C] – C:\Users\Michelle\AppData\Roaming\DeviceDoctorSoftware
[2010/09/20 15:20:29 | 000,000,000 | —D | C] – C:\Program Files (x86)\Device Doctor
[2010/09/20 15:20:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\Device_Doctor
[2010/09/14 22:29:19 | 002,441,216 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iertutil.dll
[2010/09/14 09:32:12 | 000,000,000 | —D | C] – C:\Users\Michelle\AppData\Roaming\PrimoPDF
[2010/09/13 16:28:00 | 000,027,216 | —- | C] (AVG Technologies CZ, s.r.o. ) – C:\windows\SysNative\drivers\AVGIDSEH.sys
[2010/09/12 20:49:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\Edraw Mind Map
[2010/09/12 20:46:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\Edraw Max
[2010/09/12 20:26:37 | 000,000,000 | —D | C] – C:\Program Files\Tracker Software
[2010/09/08 11:27:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\Uniblue
[2010/09/08 11:26:52 | 000,000,000 | —D | C] – C:\Users\Michelle\AppData\Local\OpenCandy
[2010/09/08 11:26:51 | 000,000,000 | —D | C] – C:\Users\Michelle\AppData\Roaming\OpenCandy
[2010/09/08 11:26:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\Nitro PDF
[2010/09/07 20:16:59 | 000,000,000 | —D | C] – C:\Users\Michelle\bells of sorrow_data
[3 C:\Users\Michelle\Documents\*.tmp files -> C:\Users\Michelle\Documents\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/10/07 12:12:09 | 003,670,016 | -HS- | M] () – C:\Users\Michelle\ntuser.dat
[2010/10/07 12:11:46 | 000,000,898 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/10/07 12:05:13 | 000,000,920 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2061569285-4122217452-3144007984-1001UA.job
[2010/10/07 10:18:07 | 000,713,888 | —- | M] () – C:\windows\SysNative\PerfStringBackup.INI
[2010/10/07 10:18:07 | 000,615,360 | —- | M] () – C:\windows\SysNative\perfh009.dat
[2010/10/07 10:18:07 | 000,103,702 | —- | M] () – C:\windows\SysNative\perfc009.dat
[2010/10/07 10:09:57 | 000,000,894 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/10/07 10:09:20 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2010/10/06 22:45:15 | 000,270,848 | —- | M] () – C:\Users\Michelle\Documents\ebook - how to write a screenplay.doc
[2010/10/06 21:44:32 | 000,023,552 | —- | M] () – C:\Users\Michelle\Documents\new piano method - oct 3.xls
[2010/10/06 21:44:31 | 000,019,968 | —- | M] () – C:\Users\Michelle\Documents\bernhard.xls
[2010/10/06 21:41:48 | 000,219,886 | —- | M] () – C:\Users\Michelle\Documents\bach invention motif - FULL HS.pdf
[2010/10/06 21:24:19 | 095,473,018 | —- | M] () – C:\windows\SysNative\drivers\AVG\incavi.avm
[2010/10/06 21:12:59 | 000,186,023 | —- | M] () – C:\Users\Michelle\Documents\bach invention motif.pdf
[2010/10/06 21:03:19 | 000,186,023 | —- | M] () – C:\Users\Michelle\Documents\Finale 2003 - [bach invention no.pdf
[2010/10/06 20:09:23 | 000,000,868 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2061569285-4122217452-3144007984-1001Core.job
[2010/10/06 13:58:03 | 000,035,840 | —- | M] () – C:\Users\Michelle\Documents\bernhard - ryhthm.doc
[2010/10/06 08:23:57 | 000,006,162 | —- | M] () – C:\windows\mozy.flt
[2010/10/06 08:23:57 | 000,003,412 | —- | M] () – C:\windows\mozy.blk
[2010/10/06 01:49:30 | 000,001,819 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/10/06 01:37:36 | 000,002,081 | —- | M] () – C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2010/10/06 01:32:56 | 000,116,568 | —- | M] (Avira GmbH) – C:\windows\SysNative\drivers\avipbb.sys
[2010/10/06 01:32:47 | 000,017,016 | —- | M] (AVIRA GmbH) – C:\windows\SysWow64\drivers\avgntmgr.sys
[2010/10/06 01:32:37 | 000,081,072 | —- | M] (Avira GmbH) – C:\windows\SysNative\drivers\avgntflt.sys
[2010/10/06 01:32:35 | 000,051,992 | —- | M] (AVIRA GmbH) – C:\windows\SysWow64\drivers\avgntdd.sys
[2010/10/06 01:15:41 | 000,015,792 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/06 01:15:41 | 000,015,792 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/06 01:03:59 | 000,001,322 | —- | M] () – C:\Users\Michelle\Desktop\Norton Installation Files.lnk
[2010/10/06 01:01:30 | 000,000,006 | -H– | M] () – C:\windows\tasks\SA.DAT
[2010/10/06 01:01:17 | 1506,783,232 | -HS- | M] () – C:\hiberfil.sys
[2010/10/05 22:42:14 | 000,000,000 | —- | M] () – C:\Users\Michelle\defogger_reenable
[2010/10/05 22:22:03 | 000,524,288 | -HS- | M] () – C:\Users\Michelle\ntuser.dat{59cda797-d0ee-11df-89de-00266c67798b}.TMContainer00000000000000000002.regtrans-ms
[2010/10/05 22:22:03 | 000,524,288 | -HS- | M] () – C:\Users\Michelle\ntuser.dat{59cda797-d0ee-11df-89de-00266c67798b}.TMContainer00000000000000000001.regtrans-ms
[2010/10/05 22:22:02 | 000,065,536 | -HS- | M] () – C:\Users\Michelle\ntuser.dat{59cda797-d0ee-11df-89de-00266c67798b}.TM.blf
[2010/10/05 22:02:59 | 000,524,288 | -HS- | M] () – C:\Users\Michelle\ntuser.dat{66bdbeeb-d0ea-11df-a244-00266c67798b}.TMContainer00000000000000000002.regtrans-ms
[2010/10/05 22:02:59 | 000,524,288 | -HS- | M] () – C:\Users\Michelle\ntuser.dat{66bdbeeb-d0ea-11df-a244-00266c67798b}.TMContainer00000000000000000001.regtrans-ms
[2010/10/05 22:02:59 | 000,065,536 | -HS- | M] () – C:\Users\Michelle\ntuser.dat{66bdbeeb-d0ea-11df-a244-00266c67798b}.TM.blf
[2010/10/05 21:52:26 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Michelle\Desktop\HiJackThis.exe
[2010/10/05 21:49:56 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Michelle\Desktop\OTL.exe
[2010/10/05 21:47:49 | 000,524,288 | -HS- | M] () – C:\Users\Michelle\ntuser.dat{26898fb0-d0c5-11df-97ba-00266c67798b}.TMContainer00000000000000000002.regtrans-ms
[2010/10/05 21:47:49 | 000,524,288 | -HS- | M] () – C:\Users\Michelle\ntuser.dat{26898fb0-d0c5-11df-97ba-00266c67798b}.TMContainer00000000000000000001.regtrans-ms
[2010/10/05 21:47:49 | 000,065,536 | -HS- | M] () – C:\Users\Michelle\ntuser.dat{26898fb0-d0c5-11df-97ba-00266c67798b}.TM.blf
[2010/10/05 17:09:54 | 000,022,016 | —- | M] () – C:\Users\Michelle\Documents\Screenplayninja.doc
[2010/10/05 17:09:33 | 000,047,616 | —- | M] () – C:\Users\Michelle\Documents\ebook - the script reviewers reviewv sourcebook.doc
[2010/10/05 17:09:24 | 000,019,456 | —- | M] () – C:\Users\Michelle\Documents\screenplay ninja.xls
[2010/10/05 11:37:57 | 000,020,480 | —- | M] () – C:\Users\Michelle\Documents\Musicteachersresource.doc
[2010/10/04 22:12:02 | 000,021,504 | —- | M] () – C:\Users\Michelle\Documents\The Twinkles.doc
[2010/10/04 20:49:45 | 000,026,417 | —- | M] () – C:\Users\Michelle\Documents\Group Classes.pdf
[2010/10/04 20:48:39 | 000,037,888 | —- | M] () – C:\Users\Michelle\Documents\Group Classe1.doc
[2010/10/03 21:20:56 | 000,024,576 | —- | M] () – C:\Users\Michelle\Documents\MEA Piano Studio EXPENSES 2010 - 2011 MAIN.xls
[2010/10/02 15:30:25 | 000,040,448 | —- | M] () – C:\Users\Michelle\Documents\Novaclassicalpiano.doc
[2010/10/02 13:17:09 | 000,002,429 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2010/10/02 10:10:43 | 000,002,515 | —- | M] () – C:\Users\Public\Desktop\Skype.lnk
[2010/10/02 09:51:53 | 000,556,120 | —- | M] (Kaspersky Lab) – C:\windows\SysNative\drivers\klif.sys
[2010/10/02 09:44:02 | 000,149,773 | —- | M] () – C:\windows\SysNative\drivers\klin.dat
[2010/10/02 09:44:02 | 000,106,765 | —- | M] () – C:\windows\SysNative\drivers\klick.dat
[2010/10/02 00:01:30 | 000,019,968 | —- | M] () – C:\Users\Michelle\Documents\NOVEL TEMPLATE.doc
[2010/10/01 23:47:30 | 000,048,640 | —- | M] () – C:\Users\Michelle\Documents\TEMPLATE FOR WRITING- DRAMATICA.doc
[2010/10/01 22:05:09 | 096,140,336 | —- | M] (Emsi Software GmbH ) – C:\Users\Michelle\Desktop\a2AntiMalwareSetup.exe
[2010/10/01 18:08:36 | 000,001,024 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/10/01 12:31:28 | 000,284,915 | —- | M] () – C:\Users\Michelle\Desktop\gmer.zip
[2010/10/01 12:11:06 | 000,113,461 | —- | M] () – C:\windows\SysNative\drivers\AVG\iavichjw.avm
[2010/10/01 11:59:11 | 000,000,224 | —- | M] () – C:\windows\tasks\SidebarExecute.job
[2010/10/01 11:58:47 | 000,000,964 | —- | M] () – C:\Users\Public\Desktop\AVG 2011.lnk
[2010/10/01 11:58:47 | 000,000,000 | —- | M] () – C:\windows\SysWow64\drivers\AVG\iavichjw.avm
[2010/10/01 11:58:46 | 000,000,000 | —- | M] () – C:\windows\SysWow64\drivers\AVG\incavi.avm
[2010/09/30 16:55:10 | 000,019,968 | —- | M] () – C:\Users\Michelle\Documents\Winning rhythms.doc
[2010/09/30 13:06:46 | 000,013,824 | —- | M] () – C:\Users\Michelle\Documents\bernhard method.xls
[2010/09/30 13:06:02 | 000,029,696 | —- | M] () – C:\Users\Michelle\Documents\group classes.doc
[2010/09/30 12:21:01 | 000,018,198 | —- | M] () – C:\Users\Michelle\Documents\grand staff 3.pdf
[2010/09/30 12:07:51 | 000,002,162 | —- | M] () – C:\Users\Public\Desktop\Noteable.lnk
[2010/09/29 23:46:11 | 000,181,760 | —- | M] () – C:\Users\Michelle\Documents\life.doc
[2010/09/29 13:50:27 | 000,047,104 | —- | M] () – C:\Users\Michelle\Documents\novapianoacademy book.doc
[2010/09/28 11:26:15 | 000,024,576 | —- | M] () – C:\Users\Michelle\Documents\How to write a screenplay step by step.doc
[2010/09/27 23:35:15 | 000,027,136 | —- | M] () – C:\Users\Michelle\Documents\pianoskills.doc
[2010/09/27 20:24:32 | 000,039,936 | —- | M] () – C:\Users\Michelle\Documents\SCHEDULE 2010-2011.xls
[2010/09/26 10:29:39 | 000,000,528 | —- | M] () – C:\windows\win.ini
[2010/09/25 23:31:32 | 000,017,408 | —- | M] () – C:\Users\Michelle\Documents\piano skills.xls
[2010/09/24 15:35:58 | 000,024,576 | —- | M] () – C:\Users\Michelle\Documents\musika.doc
[2010/09/24 12:26:02 | 000,035,840 | —- | M] () – C:\Users\Michelle\Documents\Novagrouppiano.doc
[2010/09/24 08:52:39 | 000,002,431 | —- | M] () – C:\Users\Michelle\Desktop\Google Chrome.lnk
[2010/09/23 22:01:22 | 000,019,968 | —- | M] () – C:\Users\Michelle\Documents\food.xls
[2010/09/23 17:06:47 | 000,000,162 | -H– | M] () – C:\Users\Michelle\Documents\~$rnhard2.doc
[2010/09/23 15:00:45 | 000,000,162 | -H– | M] () – C:\Users\Michelle\Documents\~$vaclassicalpiano.doc
[2010/09/23 11:24:31 | 000,046,360 | —- | M] () – C:\Users\Michelle\Documents\MEA Piano Studio - withdrawalform.pdf
[2010/09/23 11:19:53 | 000,011,160 | —- | M] () – C:\Users\Michelle\Documents\MEA Piano Studio - withdrawal form.pdf
[2010/09/23 11:19:46 | 000,000,060 | —- | M] () – C:\windows\wpd99.drv
[2010/09/22 23:18:17 | 000,029,184 | —- | M] () – C:\Users\Michelle\Documents\imdb answer.doc
[2010/09/20 21:27:03 | 000,000,000 | -H– | M] () – C:\windows\SysNative\drivers\Msft_Kernel_motmodem_01007.Wdf
[2010/09/20 21:26:46 | 000,000,000 | -H– | M] () – C:\windows\SysNative\drivers\Msft_Kernel_motport_01007.Wdf
[2010/09/20 21:24:31 | 000,000,000 | -H– | M] () – C:\windows\SysNative\drivers\Msft_Kernel_motccgpfl_01007.Wdf
[2010/09/20 21:24:29 | 000,000,000 | -H– | M] () – C:\windows\SysNative\drivers\Msft_Kernel_motccgp_01007.Wdf
[2010/09/20 21:18:50 | 003,733,804 | —- | M] () – C:\Users\Michelle\Documents\BOSTON MUSIC TRIP - WITH BWI TO LI boarding pass.pdf
[2010/09/20 21:16:58 | 000,064,935 | —- | M] () – C:\Users\Michelle\Documents\AirTran Check-In - Boarding Pass.pdf
[2010/09/20 21:06:16 | 003,668,683 | —- | M] () – C:\Users\Michelle\Documents\BOSTON MUSIC TRIP.pdf
[2010/09/20 20:59:02 | 000,120,636 | —- | M] () – C:\Users\Michelle\Documents\boston - hotel.pdf
[2010/09/20 20:57:32 | 000,166,627 | —- | M] () – C:\Users\Michelle\Documents\Boston - Airplane Ticket - Part B.pdf
[2010/09/20 20:53:03 | 000,127,989 | —- | M] () – C:\Users\Michelle\Documents\Boston - Airplane Ticket.pdf
[2010/09/20 20:50:35 | 000,211,000 | —- | M] () – C:\Users\Michelle\Documents\boston trip - part A1.pdf
[2010/09/20 20:48:48 | 000,243,200 | —- | M] () – C:\Users\Michelle\Documents\boston trip.doc
[2010/09/20 20:43:22 | 000,206,232 | —- | M] () – C:\Users\Michelle\Documents\boston trip - part A.pdf
[2010/09/20 20:37:01 | 001,220,129 | —- | M] () – C:\Users\Michelle\Documents\WALK stuart Street Playhouse to Copley House - Google Maps.pdf
[2010/09/20 20:31:11 | 000,628,706 | —- | M] () – C:\Users\Michelle\Documents\TRAIN Copley House to Stuart Street Playhouse - Google Maps.pdf
[2010/09/20 20:11:02 | 000,212,543 | —- | M] () – C:\Users\Michelle\Documents\Copley House to Stuart Street Playhouse - Google Maps.pdf
[2010/09/20 15:20:55 | 000,001,109 | —- | M] () – C:\Users\Public\Desktop\Device Doctor.lnk
[2010/09/20 11:04:07 | 000,222,218 | —- | M] () – C:\Users\Michelle\Documents\TRAIN Stuart Street Playhouse to Copley House - Google Maps.pdf
[2010/09/20 11:02:27 | 000,492,318 | —- | M] () – C:\Users\Michelle\Documents\1 Copley House to Stuart Street Playhouse - Google Maps.pdf
[2010/09/20 10:58:16 | 000,196,671 | —- | M] () – C:\Users\Michelle\Documents\2 South Station Bus Terminal to Copley House - Google Maps.pdf
[2010/09/20 10:57:51 | 000,363,692 | —- | M] () – C:\Users\Michelle\Documents\1 South Station Bus Terminal to Copley House - Google Maps.pdf
[2010/09/20 10:32:22 | 000,024,392 | —- | M] (Softland) – C:\windows\SysNative\dopdfmn7.dll
[2010/09/20 10:32:20 | 000,020,296 | —- | M] (Softland) – C:\windows\SysNative\dopdfmi7.dll
[2010/09/19 23:45:55 | 000,019,968 | —- | M] () – C:\Users\Michelle\Documents\theresa.doc
[2010/09/17 10:40:36 | 000,019,232 | —- | M] () – C:\Users\Michelle\Documents\test.pdf
[2010/09/17 00:13:12 | 000,020,480 | —- | M] () – C:\Users\Michelle\Documents\10 tips to a better screenplay.doc
[2010/09/15 23:22:20 | 000,164,656 | —- | M] () – C:\Users\Michelle\Documents\twilight.pdf
[2010/09/15 23:22:15 | 000,036,235 | —- | M] () – C:\Users\Michelle\Documents\test2.pdf
[2010/09/15 22:54:49 | 000,013,824 | —- | M] () – C:\Users\Michelle\Documents\song by rote bernhard.xls
[2010/09/15 13:03:56 | 003,145,770 | —- | M] () – C:\Users\Michelle\Documents\Path to Proluge - Edited.pdf
[2010/09/14 10:49:34 | 000,262,310 | —- | M] () – C:\Users\Michelle\Documents\steph images.pdf
[2010/09/13 16:28:00 | 000,027,216 | —- | M] (AVG Technologies CZ, s.r.o. ) – C:\windows\SysNative\drivers\AVGIDSEH.sys
[2010/09/13 10:30:47 | 000,000,162 | -H– | M] () – C:\Users\Michelle\Documents\~$o Years to Grade 4.doc
[2010/09/12 23:15:08 | 000,031,232 | —- | M] () – C:\Users\Michelle\Documents\Starlight Online Workshop.doc
[2010/09/12 20:27:00 | 000,000,939 | —- | M] () – C:\Users\Michelle\Desktop\PDF-Viewer.lnk
[2010/09/11 13:00:08 | 000,024,064 | —- | M] () – C:\Users\Michelle\Documents\plastic safety.doc
[2010/09/10 20:46:35 | 000,019,968 | —- | M] () – C:\Users\Michelle\Documents\student info.doc
[2010/09/10 20:46:28 | 000,030,208 | —- | M] () – C:\Users\Michelle\Documents\bernhard2.doc
[2010/09/10 20:46:19 | 000,020,992 | —- | M] () – C:\Users\Michelle\Documents\bernhard ideas.doc
[2010/09/08 23:49:38 | 000,020,480 | —- | M] () – C:\Users\Michelle\Documents\SELLING A SCRIPT.doc
[2010/09/08 11:27:08 | 000,001,123 | —- | M] () – C:\Users\Michelle\Application Data\Microsoft\Internet Explorer\Quick Launch\RegistryBooster.lnk
[2010/09/08 11:27:08 | 000,001,099 | —- | M] () – C:\Users\Public\Desktop\RegistryBooster.lnk
[2010/09/08 11:27:07 | 000,001,160 | —- | M] () – C:\Users\Public\Desktop\PrimoPDF - Drop Files Here to Convert!.lnk
[2010/09/08 11:26:53 | 000,000,326 | —- | M] () – C:\windows\primopdf.ini
[2010/09/08 10:56:55 | 000,020,992 | —- | M] () – C:\Users\Michelle\Documents\preschool letter.doc
[2010/09/07 22:29:51 | 000,096,768 | —- | M] () – C:\Users\Michelle\Documents\MEA Piano Studio EXPENSES 2009 - 2010 MAIN.xls
[2010/09/07 20:17:23 | 049,995,820 | —- | M] () – C:\Users\Michelle\Desktop\bells of sorrow.wav
[2010/09/07 20:17:02 | 000,015,931 | —- | M] () – C:\Users\Michelle\bells of sorrow.aup
[3 C:\Users\Michelle\Documents\*.tmp files -> C:\Users\Michelle\Documents\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/10/06 21:24:19 | 095,473,018 | —- | C] () – C:\windows\SysNative\drivers\AVG\incavi.avm
[2010/10/06 21:13:10 | 000,219,886 | —- | C] () – C:\Users\Michelle\Documents\bach invention motif - FULL HS.pdf
[2010/10/06 20:12:34 | 000,186,023 | —- | C] () – C:\Users\Michelle\Documents\bach invention motif.pdf
[2010/10/06 13:59:43 | 000,019,968 | —- | C] () – C:\Users\Michelle\Documents\bernhard.xls
[2010/10/06 13:58:02 | 000,035,840 | —- | C] () – C:\Users\Michelle\Documents\bernhard - ryhthm.doc
[2010/10/06 01:49:30 | 000,001,819 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/10/06 01:37:36 | 000,002,081 | —- | C] () – C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2010/10/06 00:22:58 | 000,001,322 | —- | C] () – C:\Users\Michelle\Desktop\Norton Installation Files.lnk
[2010/10/05 22:42:14 | 000,000,000 | —- | C] () – C:\Users\Michelle\defogger_reenable
[2010/10/05 22:22:03 | 000,524,288 | -HS- | C] () – C:\Users\Michelle\ntuser.dat{59cda797-d0ee-11df-89de-00266c67798b}.TMContainer00000000000000000002.regtrans-ms
[2010/10/05 22:22:03 | 000,524,288 | -HS- | C] () – C:\Users\Michelle\ntuser.dat{59cda797-d0ee-11df-89de-00266c67798b}.TMContainer00000000000000000001.regtrans-ms
[2010/10/05 22:22:02 | 000,065,536 | -HS- | C] () – C:\Users\Michelle\ntuser.dat{59cda797-d0ee-11df-89de-00266c67798b}.TM.blf
[2010/10/05 22:02:59 | 000,524,288 | -HS- | C] () – C:\Users\Michelle\ntuser.dat{66bdbeeb-d0ea-11df-a244-00266c67798b}.TMContainer00000000000000000002.regtrans-ms
[2010/10/05 22:02:59 | 000,524,288 | -HS- | C] () – C:\Users\Michelle\ntuser.dat{66bdbeeb-d0ea-11df-a244-00266c67798b}.TMContainer00000000000000000001.regtrans-ms
[2010/10/05 22:02:59 | 000,065,536 | -HS- | C] () – C:\Users\Michelle\ntuser.dat{66bdbeeb-d0ea-11df-a244-00266c67798b}.TM.blf
[2010/10/05 21:41:32 | 000,524,288 | -HS- | C] () – C:\Users\Michelle\ntuser.dat{26898fb0-d0c5-11df-97ba-00266c67798b}.TMContainer00000000000000000002.regtrans-ms
[2010/10/05 21:41:32 | 000,524,288 | -HS- | C] () – C:\Users\Michelle\ntuser.dat{26898fb0-d0c5-11df-97ba-00266c67798b}.TMContainer00000000000000000001.regtrans-ms
[2010/10/05 21:41:32 | 000,065,536 | -HS- | C] () – C:\Users\Michelle\ntuser.dat{26898fb0-d0c5-11df-97ba-00266c67798b}.TM.blf
[2010/10/05 17:09:48 | 000,022,016 | —- | C] () – C:\Users\Michelle\Documents\Screenplayninja.doc
[2010/10/05 14:02:15 | 000,019,456 | —- | C] () – C:\Users\Michelle\Documents\screenplay ninja.xls
[2010/10/05 11:37:57 | 000,020,480 | —- | C] () – C:\Users\Michelle\Documents\Musicteachersresource.doc
[2010/10/05 10:05:08 | 000,047,616 | —- | C] () – C:\Users\Michelle\Documents\ebook - the script reviewers reviewv sourcebook.doc
[2010/10/04 20:49:43 | 000,026,417 | —- | C] () – C:\Users\Michelle\Documents\Group Classes.pdf
[2010/10/03 13:40:47 | 000,023,552 | —- | C] () – C:\Users\Michelle\Documents\new piano method - oct 3.xls
[2010/10/02 18:46:52 | 000,037,888 | —- | C] () – C:\Users\Michelle\Documents\Group Classe1.doc
[2010/10/02 09:44:02 | 000,149,773 | —- | C] () – C:\windows\SysNative\drivers\klin.dat
[2010/10/02 09:44:02 | 000,106,765 | —- | C] () – C:\windows\SysNative\drivers\klick.dat
[2010/10/01 23:51:31 | 000,019,968 | —- | C] () – C:\Users\Michelle\Documents\NOVEL TEMPLATE.doc
[2010/10/01 23:14:32 | 000,048,640 | —- | C] () – C:\Users\Michelle\Documents\TEMPLATE FOR WRITING- DRAMATICA.doc
[2010/10/01 21:55:13 | 000,022,486 | —- | C] () – C:\windows\SysWow64\msu.ico
[2010/10/01 18:08:36 | 000,001,024 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/10/01 12:31:25 | 000,284,915 | —- | C] () – C:\Users\Michelle\Desktop\gmer.zip
[2010/10/01 12:11:06 | 000,113,461 | —- | C] () – C:\windows\SysNative\drivers\AVG\iavichjw.avm
[2010/10/01 11:59:11 | 000,000,224 | —- | C] () – C:\windows\tasks\SidebarExecute.job
[2010/10/01 11:58:47 | 000,000,964 | —- | C] () – C:\Users\Public\Desktop\AVG 2011.lnk
[2010/10/01 11:58:47 | 000,000,000 | —- | C] () – C:\windows\SysWow64\drivers\AVG\iavichjw.avm
[2010/10/01 11:58:46 | 000,000,000 | —- | C] () – C:\windows\SysWow64\drivers\AVG\incavi.avm
[2010/09/30 16:54:51 | 000,019,968 | —- | C] () – C:\Users\Michelle\Documents\Winning rhythms.doc
[2010/09/30 13:06:46 | 000,013,824 | —- | C] () – C:\Users\Michelle\Documents\bernhard method.xls
[2010/09/30 13:06:02 | 000,029,696 | —- | C] () – C:\Users\Michelle\Documents\group classes.doc
[2010/09/30 12:21:01 | 000,018,198 | —- | C] () – C:\Users\Michelle\Documents\grand staff 3.pdf
[2010/09/30 12:07:50 | 000,002,162 | —- | C] () – C:\Users\Public\Desktop\Noteable.lnk
[2010/09/29 23:46:11 | 000,181,760 | —- | C] () – C:\Users\Michelle\Documents\life.doc
[2010/09/29 11:12:57 | 000,047,104 | —- | C] () – C:\Users\Michelle\Documents\novapianoacademy book.doc
[2010/09/28 12:11:36 | 000,270,848 | —- | C] () – C:\Users\Michelle\Documents\ebook - how to write a screenplay.doc
[2010/09/28 11:07:27 | 000,024,576 | —- | C] () – C:\Users\Michelle\Documents\How to write a screenplay step by step.doc
[2010/09/25 12:46:52 | 000,017,408 | —- | C] () – C:\Users\Michelle\Documents\piano skills.xls
[2010/09/24 12:26:01 | 000,035,840 | —- | C] () – C:\Users\Michelle\Documents\Novagrouppiano.doc
[2010/09/23 21:07:24 | 000,024,576 | —- | C] () – C:\Users\Michelle\Documents\musika.doc
[2010/09/23 17:06:47 | 000,000,162 | -H– | C] () – C:\Users\Michelle\Documents\~$rnhard2.doc
[2010/09/23 15:00:45 | 000,000,162 | -H– | C] () – C:\Users\Michelle\Documents\~$vaclassicalpiano.doc
[2010/09/23 15:00:44 | 000,040,448 | —- | C] () – C:\Users\Michelle\Documents\Novaclassicalpiano.doc
[2010/09/23 11:24:30 | 000,046,360 | —- | C] () – C:\Users\Michelle\Documents\MEA Piano Studio - withdrawalform.pdf
[2010/09/23 11:19:45 | 000,011,160 | —- | C] () – C:\Users\Michelle\Documents\MEA Piano Studio - withdrawal form.pdf
[2010/09/22 23:18:16 | 000,029,184 | —- | C] () – C:\Users\Michelle\Documents\imdb answer.doc
[2010/09/22 21:53:58 | 000,007,549 | —- | C] () – C:\windows\SysNative\dopdf7.ctm
[2010/09/20 21:27:03 | 000,000,000 | -H– | C] () – C:\windows\SysNative\drivers\Msft_Kernel_motmodem_01007.Wdf
[2010/09/20 21:26:46 | 000,000,000 | -H– | C] () – C:\windows\SysNative\drivers\Msft_Kernel_motport_01007.Wdf
[2010/09/20 21:24:31 | 000,000,000 | -H– | C] () – C:\windows\SysNative\drivers\Msft_Kernel_motccgpfl_01007.Wdf
[2010/09/20 21:24:29 | 000,000,000 | -H– | C] () – C:\windows\SysNative\drivers\Msft_Kernel_motccgp_01007.Wdf
[2010/09/20 21:18:42 | 003,733,804 | —- | C] () – C:\Users\Michelle\Documents\BOSTON MUSIC TRIP - WITH BWI TO LI boarding pass.pdf
[2010/09/20 21:16:51 | 000,064,935 | —- | C] () – C:\Users\Michelle\Documents\AirTran Check-In - Boarding Pass.pdf
[2010/09/20 21:06:04 | 003,668,683 | —- | C] () – C:\Users\Michelle\Documents\BOSTON MUSIC TRIP.pdf
[2010/09/20 20:58:58 | 000,120,636 | —- | C] () – C:\Users\Michelle\Documents\boston - hotel.pdf
[2010/09/20 20:57:25 | 000,166,627 | —- | C] () – C:\Users\Michelle\Documents\Boston - Airplane Ticket - Part B.pdf
[2010/09/20 20:52:55 | 000,127,989 | —- | C] () – C:\Users\Michelle\Documents\Boston - Airplane Ticket.pdf
[2010/09/20 20:50:25 | 000,211,000 | —- | C] () – C:\Users\Michelle\Documents\boston trip - part A1.pdf
[2010/09/20 20:43:15 | 000,206,232 | —- | C] () – C:\Users\Michelle\Documents\boston trip - part A.pdf
[2010/09/20 20:11:06 | 000,212,543 | —- | C] () – C:\Users\Michelle\Documents\Copley House to Stuart Street Playhouse - Google Maps.pdf
[2010/09/20 15:20:54 | 000,001,109 | —- | C] () – C:\Users\Public\Desktop\Device Doctor.lnk
[2010/09/20 11:09:29 | 000,628,706 | —- | C] () – C:\Users\Michelle\Documents\TRAIN Copley House to Stuart Street Playhouse - Google Maps.pdf
[2010/09/20 11:07:42 | 001,220,129 | —- | C] () – C:\Users\Michelle\Documents\WALK stuart Street Playhouse to Copley House - Google Maps.pdf
[2010/09/20 11:04:07 | 000,222,218 | —- | C] () – C:\Users\Michelle\Documents\TRAIN Stuart Street Playhouse to Copley House - Google Maps.pdf
[2010/09/20 11:02:19 | 000,492,318 | —- | C] () – C:\Users\Michelle\Documents\1 Copley House to Stuart Street Playhouse - Google Maps.pdf
[2010/09/20 10:58:15 | 000,196,671 | —- | C] () – C:\Users\Michelle\Documents\2 South Station Bus Terminal to Copley House - Google Maps.pdf
[2010/09/20 10:57:51 | 000,363,692 | —- | C] () – C:\Users\Michelle\Documents\1 South Station Bus Terminal to Copley House - Google Maps.pdf
[2010/09/20 10:35:48 | 000,243,200 | —- | C] () – C:\Users\Michelle\Documents\boston trip.doc
[2010/09/19 23:46:14 | 000,027,136 | —- | C] () – C:\Users\Michelle\Documents\pianoskills.doc
[2010/09/19 23:45:54 | 000,019,968 | —- | C] () – C:\Users\Michelle\Documents\theresa.doc
[2010/09/17 10:40:23 | 000,019,232 | —- | C] () – C:\Users\Michelle\Documents\test.pdf
[2010/09/17 00:13:12 | 000,020,480 | —- | C] () – C:\Users\Michelle\Documents\10 tips to a better screenplay.doc
[2010/09/15 22:54:48 | 000,013,824 | —- | C] () – C:\Users\Michelle\Documents\song by rote bernhard.xls
[2010/09/15 21:58:42 | 000,164,656 | —- | C] () – C:\Users\Michelle\Documents\twilight.pdf
[2010/09/15 13:03:45 | 003,145,770 | —- | C] () – C:\Users\Michelle\Documents\Path to Proluge - Edited.pdf
[2010/09/14 10:49:32 | 000,262,310 | —- | C] () – C:\Users\Michelle\Documents\steph images.pdf
[2010/09/14 09:33:22 | 000,036,235 | —- | C] () – C:\Users\Michelle\Documents\test2.pdf
[2010/09/13 10:30:47 | 000,000,162 | -H– | C] () – C:\Users\Michelle\Documents\~$o Years to Grade 4.doc
[2010/09/12 20:27:00 | 000,000,939 | —- | C] () – C:\Users\Michelle\Desktop\PDF-Viewer.lnk
[2010/09/11 22:08:35 | 000,031,232 | —- | C] () – C:\Users\Michelle\Documents\Starlight Online Workshop.doc
[2010/09/11 13:00:07 | 000,024,064 | —- | C] () – C:\Users\Michelle\Documents\plastic safety.doc
[2010/09/10 20:46:35 | 000,019,968 | —- | C] () – C:\Users\Michelle\Documents\student info.doc
[2010/09/10 20:46:28 | 000,030,208 | —- | C] () – C:\Users\Michelle\Documents\bernhard2.doc
[2010/09/10 20:46:19 | 000,020,992 | —- | C] () – C:\Users\Michelle\Documents\bernhard ideas.doc
[2010/09/10 15:21:38 | 000,024,576 | —- | C] () – C:\Users\Michelle\Documents\MEA Piano Studio EXPENSES 2010 - 2011 MAIN.xls
[2010/09/08 23:49:38 | 000,020,480 | —- | C] () – C:\Users\Michelle\Documents\SELLING A SCRIPT.doc
[2010/09/08 11:27:08 | 000,001,123 | —- | C] () – C:\Users\Michelle\Application Data\Microsoft\Internet Explorer\Quick Launch\RegistryBooster.lnk
[2010/09/08 11:27:08 | 000,001,099 | —- | C] () – C:\Users\Public\Desktop\RegistryBooster.lnk
[2010/09/08 11:27:06 | 000,001,160 | —- | C] () – C:\Users\Public\Desktop\PrimoPDF - Drop Files Here to Convert!.lnk
[2010/09/08 11:26:55 | 000,090,624 | —- | C] () – C:\windows\SysNative\Primomonnt.dll
[2010/09/08 10:56:54 | 000,020,992 | —- | C] () – C:\Users\Michelle\Documents\preschool letter.doc
[2010/09/07 20:17:18 | 049,995,820 | —- | C] () – C:\Users\Michelle\Desktop\bells of sorrow.wav
[2010/09/07 20:17:02 | 000,015,931 | —- | C] () – C:\Users\Michelle\bells of sorrow.aup
[2010/08/28 18:49:16 | 000,000,017 | —- | C] () – C:\Users\Michelle\AppData\Local\resmon.resmoncfg
[2010/08/06 16:50:13 | 000,000,978 | —- | C] () – C:\windows\wpo.ini
[2010/07/28 12:45:51 | 000,000,060 | —- | C] () – C:\windows\wpd99.drv
[2010/07/28 12:45:45 | 000,047,616 | —- | C] () – C:\windows\SysWow64\pdf995mon64.dll
[2010/07/25 23:27:13 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/07/23 01:18:38 | 000,000,376 | —- | C] () – C:\windows\ODBC.INI
[2010/07/21 17:03:20 | 000,000,206 | —- | C] () – C:\Users\Michelle\AppData\Roaming\wklnhst.dat
[2010/02/20 11:27:36 | 000,208,896 | —- | C] () – C:\windows\SysWow64\iglhsip32.dll
[2010/02/20 11:27:36 | 000,143,360 | —- | C] () – C:\windows\SysWow64\iglhcp32.dll
[2009/12/20 21:42:18 | 000,000,326 | —- | C] () – C:\windows\primopdf.ini
[2009/07/13 19:42:10 | 000,064,000 | —- | C] () – C:\windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:03:59 | 000,364,544 | —- | C] () – C:\windows\SysWow64\msjetoledb40.dll
[2009/06/02 02:28:17 | 000,000,026 | -H– | C] () – C:\ProgramData\.811261211181235583101118113995

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/07/13 21:38:58 | 000,383,562 | RHS- | M] () – C:\bootmgr
[2010/04/04 17:37:48 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1028.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1031.txt
[2007/11/07 08:00:40 | 000,010,134 | —- | M] () – C:\eula.1033.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1036.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1040.txt
[2007/11/07 08:00:40 | 000,000,118 | —- | M] () – C:\eula.1041.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1042.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.2052.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.3082.txt
[2007/11/07 08:00:40 | 000,001,110 | —- | M] () – C:\globdata.ini
[2010/10/06 01:01:17 | 1506,783,232 | -HS- | M] () – C:\hiberfil.sys
[2007/11/07 08:03:18 | 000,562,688 | —- | M] (Microsoft Corporation) – C:\install.exe
[2007/11/07 08:00:40 | 000,000,843 | —- | M] () – C:\install.ini
[2007/11/07 08:03:18 | 000,076,304 | —- | M] (Microsoft Corporation) – C:\install.res.1028.dll
[2007/11/07 08:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.1031.dll
[2007/11/07 08:03:18 | 000,091,152 | —- | M] (Microsoft Corporation) – C:\install.res.1033.dll
[2007/11/07 08:03:18 | 000,097,296 | —- | M] (Microsoft Corporation) – C:\install.res.1036.dll
[2007/11/07 08:03:18 | 000,095,248 | —- | M] (Microsoft Corporation) – C:\install.res.1040.dll
[2007/11/07 08:03:18 | 000,081,424 | —- | M] (Microsoft Corporation) – C:\install.res.1041.dll
[2007/11/07 08:03:18 | 000,079,888 | —- | M] (Microsoft Corporation) – C:\install.res.1042.dll
[2007/11/07 08:03:18 | 000,075,792 | —- | M] (Microsoft Corporation) – C:\install.res.2052.dll
[2007/11/07 08:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.3082.dll
[2010/08/16 22:05:39 | 000,000,696 | -H– | M] () – C:\IPH.PH
[2010/10/06 01:01:18 | 2009,047,040 | -HS- | M] () – C:\pagefile.sys
[2010/07/21 02:42:41 | 000,045,962 | —- | M] () – C:\setuplog.txt
[2007/11/07 08:00:40 | 000,005,686 | —- | M] () – C:\vcredist.bmp
[2007/11/07 08:09:22 | 001,442,522 | —- | M] () – C:\VC_RED.cab
[2007/11/07 08:12:28 | 000,232,960 | —- | M] () – C:\VC_RED.MSI

< %systemroot%\Fonts\*.com >
[2009/07/14 01:32:31 | 000,026,040 | —- | M] () – C:\windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 01:32:31 | 000,026,489 | —- | M] () – C:\windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 01:32:31 | 000,029,779 | —- | M] () – C:\windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 01:32:31 | 000,043,318 | —- | M] () – C:\windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 16:49:50 | 000,000,065 | —- | M] () – C:\windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/07/10 15:15:46 | 000,306,544 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 00:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/07/19 19:39:55 | 000,000,221 | -HS- | M] () – C:\Users\Michelle\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/10/01 22:05:09 | 096,140,336 | —- | M] (Emsi Software GmbH ) – C:\Users\Michelle\Desktop\a2AntiMalwareSetup.exe
[2009/12/15 11:24:48 | 000,293,376 | —- | M] () – C:\Users\Michelle\Desktop\gmer.exe
[2010/10/05 21:52:26 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Michelle\Desktop\HiJackThis.exe
[2010/10/05 21:49:56 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Michelle\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 17:20:04 | 000,000,802 | —- | M] () – C:\Windows\addins\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/08/04 09:51:46 | 000,000,402 | -HS- | M] () – C:\Users\Michelle\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2009/06/02 02:28:36 | 000,000,026 | -H– | M] () – C:\ProgramData\.811261211181235583101118113995

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >
[2009/11/11 10:47:02 | 000,022,486 | —- | M] () – C:\Windows\SysWOW64\msu.ico
[2009/06/10 17:17:19 | 000,116,288 | —- | M] () – C:\Windows\SysWOW64\PerfCenterCpl.ico

< %systemroot%\system\*.dat >

< %systemroot%\system\*.exe >

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< %systemroot%\system32\services\*.* >

< %systemroot%\Spooler\*.* >

< %ProgramFiles%\system32\*.* >

< %systemroot%\system32\Setup\*.dll /x >

< %systemroot%\system32\*.mine >

< %SYSTEMDRIVE%\cleansweep.exe\*.* >

< %systemroot%\system32\ras\*.dll >

< %systemroot%\system32\ras\*.drv >

< %systemroot%\*.iq >

< %systemroot%\system32\XP\*.* >

< %SYSTEMDRIVE%\Extracted\*.* >

< %systemroot%\system32\windows\*.* >

< %systemroot%\logs\*.* >

< %SYSTEMDRIVE%\Win.Msi\*.* >

< %systemroot%\regedit\*.* >

< %systemroot%\system32\skype\*.* >

< %AppData%\Adobe\dlluplwin25\*.* >

< %UserProfile%\*.dat >
[2010/10/07 12:15:34 | 003,670,016 | -HS- | M] () – C:\Users\Michelle\ntuser.dat

< %UserProfile%\*.dll >

< %systemroot%\system32\*.sxo >

< %SYSTEMDRIVE%\Gazma\*.* /s >

< %systemroot%\system32\spynet\*.* >

< %systemroot%\system32\System\*.* >

< %appdata%\Microsoft\Windows\*.* >

< %systemroot%\system32\WinDir\*.* >

< %systemroot%\_\*.* >

< %systemroot%\system32\windows32\*.* >

< %ProgramFiles%\win\*.* >

< %AppData%\Microsoft\CD Burning\*.* >

< %systemroot%\*.cab >

< %systemroot%\K.Backup\*.* >

< %ProgramFiles%\Massenger\*.* >

< %systemroot%\System32\*.doc >

< %systemroot%\Office12\*.* >

< %systemroot%\System32\Rundl32.exe\*.* >

< %ProgramFiles%\yahoo.net\*.* >

< %systemroot%\system32\*.igo >

< %systemroot%\*.rew >

< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >

< %USERPROFILE%\.COMMgr\*.* >

< %USERPROFILE%\Desktop\*.bat >

< %PROGRAMFILES%\Common Files\Real\visualizations\*.* >

< %PROGRAMFILES%\Internet Explorer\*.Jmp >

< %PROGRAMFILES%\Windows NT\system\*.dll >

< %systemroot%\system32\*.ext >

< %systemroot%\system32\Com\*.cfg >

< %systemroot%\system32\btz\*.* >

< %systemroot%\system32\EMP\*.* >

< %systemroot%\system32\expo\*.* >

< %systemroot%\system32\inet2\*.* >

< %systemroot%\system32\xrem\*.* >

< %ProgramFiles%\Microsoft\*.* >

< %systemroot%\usgwmt\*.* >

< %ProgramFiles%\B\*.* >

< %SYSTEMDRIVE%\lspp\*.* >

< %systemroot%\Kral\*.* >

< %SYSTEMDRIVE%\windowsdvd.exe\*.* >

< %systemroot%\system32\*.ipo >

< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >

< %systemroot%\system32\*.mof >
[2009/07/13 16:29:26 | 000,000,714 | —- | M] () – C:\Windows\SysWOW64\RestartManager.mof
[2009/07/13 16:29:26 | 000,000,176 | —- | M] () – C:\Windows\SysWOW64\RestartManagerUninstall.mof

< %systemroot%\*.atm >

< %systemroot%\system32\svhost\*.* >

< %ProgramFiles%\system32\*.* >

< %ProgramFiles%\Docmentt\*.* >

< %systemroot%\Help\*.vbs >

< %ProgramFiles%\Windows WinSxs\*.* /s >

< %ProgramFiles%\Outlook Express\IDT\*.* /s >

< %ProgramFiles%\Microsoft Office\365\*.* /s >

< %ProgramFiles%\Windows Live\*.* >

< %systemroot%\system32\win32\*.* >

< %SYSTEMDRIVE%\RECYCLER\*.* >

< %systemroot%\Fresh1\*.* >

< %ProgramFiles%\Kekj\*.* /s >

< %systemroot%\GDU\*.* >

< %systemroot%\KA\*.* >

< %systemroot%\R\*.* >

< %systemroot%\system32\*.fyo >

< %USERPROFILE%\System\*.* >

< %systemroot%\Source\*.* >

< %systemroot%\system32\ac\*.* >

< %ProgramFiles%\MSDN\*.* >

< %AppData%\AdobeUM\winvcldll54\*.* /s >

< %ProgramFiles%\Internet Explorer\*.ico >

< %systemroot%\system32\*.ojo >

< %systemroot%\system32\d323s\*.* >

< %systemroot%\system32\re\*.* >

< %UserProfile%\Microsoft\*.dll >

< %UserProfile%\Microsoft\*.log >

< %systemroot%\Bios\*.* >

< %ProgramFiles%\Spool\*.* >

< %ProgramFiles%\promp3\*.* >

< %SYSTEMDRIVE%\Driver\*.* /s >

< %SYSTEMDRIVE%\inetserver.exe\*.* >

< %systemroot%\java\trustlib\*.* >

< %ProgramFiles%\Common Files\designer\*.exe >

< %ProgramFiles%\*. >
[2010/10/05 22:10:03 | 000,000,000 | —D | M] – C:\Program Files (x86)\Adobe
[2010/10/05 22:10:04 | 000,000,000 | —D | M] – C:\Program Files (x86)\AIM
[2010/10/05 22:10:04 | 000,000,000 | —D | M] – C:\Program Files (x86)\Apple Software Update
[2010/10/05 22:10:04 | 000,000,000 | —D | M] – C:\Program Files (x86)\Atheros
[2010/10/05 22:10:04 | 000,000,000 | —D | M] – C:\Program Files (x86)\Audacity 1.3 Beta (Unicode)
[2010/10/05 22:10:04 | 000,000,000 | —D | M] – C:\Program Files (x86)\Audible
[2010/09/04 19:02:40 | 000,000,000 | —D | M] – C:\Program Files (x86)\AutoText
[2010/10/05 22:10:05 | 000,000,000 | —D | M] – C:\Program Files (x86)\AVG
[2010/10/06 01:35:36 | 000,000,000 | —D | M] – C:\Program Files (x86)\Avira
[2010/10/05 22:17:09 | 000,000,000 | —D | M] – C:\Program Files (x86)\Backblaze
[2010/10/05 22:10:13 | 000,000,000 | —D | M] – C:\Program Files (x86)\BitPim
[2010/10/05 22:17:09 | 000,000,000 | —D | M] – C:\Program Files (x86)\Bonjour
[2010/10/05 22:10:14 | 000,000,000 | —D | M] – C:\Program Files (x86)\Celtx
[2010/10/05 22:17:11 | 000,000,000 | —D | M] – C:\Program Files (x86)\Common Files
[2010/10/05 22:10:22 | 000,000,000 | —D | M] – C:\Program Files (x86)\Corel
[2010/10/05 22:10:22 | 000,000,000 | —D | M] – C:\Program Files (x86)\Device Doctor
[2010/09/20 15:20:04 | 000,000,000 | —D | M] – C:\Program Files (x86)\Device_Doctor
[2010/10/05 22:10:22 | 000,000,000 | —D | M] – C:\Program Files (x86)\DVDVideoSoft
[2010/10/05 22:10:22 | 000,000,000 | —D | M] – C:\Program Files (x86)\Edraw Max
[2010/10/05 22:10:22 | 000,000,000 | —D | M] – C:\Program Files (x86)\Edraw Mind Map
[2010/10/05 21:58:00 | 000,000,000 | —D | M] – C:\Program Files (x86)\Emsisoft Anti-Malware
[2010/10/05 22:17:11 | 000,000,000 | —D | M] – C:\Program Files (x86)\Final Draft 6
[2010/10/05 22:10:22 | 000,000,000 | —D | M] – C:\Program Files (x86)\Final Draft 8
[2010/10/05 22:17:11 | 000,000,000 | —D | M] – C:\Program Files (x86)\Final Draft Tagger
[2010/10/05 22:10:23 | 000,000,000 | —D | M] – C:\Program Files (x86)\Finale 2003
[2010/10/05 22:10:24 | 000,000,000 | —D | M] – C:\Program Files (x86)\Google
[2010/10/05 22:10:24 | 000,000,000 | —D | M] – C:\Program Files (x86)\IMBT
[2010/10/05 22:10:24 | 000,000,000 | -H-D | M] – C:\Program Files (x86)\InstallShield Installation Information
[2010/10/05 22:10:24 | 000,000,000 | —D | M] – C:\Program Files (x86)\Intel
[2010/10/05 22:18:44 | 000,000,000 | —D | M] – C:\Program Files (x86)\Internet Explorer
[2010/10/05 22:17:12 | 000,000,000 | —D | M] – C:\Program Files (x86)\iTunes
[2010/10/05 22:10:26 | 000,000,000 | —D | M] – C:\Program Files (x86)\Java
[2010/08/20 19:25:16 | 000,000,000 | —D | M] – C:\Program Files (x86)\JL2005C
[2010/08/20 19:25:16 | 000,000,000 | —D | M] – C:\Program Files (x86)\JL2005D
[2010/10/02 09:41:58 | 000,000,000 | —D | M] – C:\Program Files (x86)\Kaspersky Lab
[2010/08/13 22:55:52 | 000,000,000 | —D | M] – C:\Program Files (x86)\LBE Email Scheduler
[2010/10/05 22:17:19 | 000,000,000 | —D | M] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/10/05 22:10:45 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft
[2010/07/23 01:16:42 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft ActiveSync
[2010/10/05 22:10:44 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Office
[2010/10/05 22:10:43 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Office Suite Activation Assistant
[2010/10/05 22:10:45 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Silverlight
[2010/10/05 22:10:45 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2010/10/05 22:17:21 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Works
[2010/10/05 22:10:45 | 000,000,000 | —D | M] – C:\Program Files (x86)\Miranda IM
[2010/10/05 22:01:28 | 000,000,000 | —D | M] – C:\Program Files (x86)\Motorola
[2010/10/05 22:10:45 | 000,000,000 | —D | M] – C:\Program Files (x86)\MSBuild
[2010/04/04 01:02:18 | 000,000,000 | —D | M] – C:\Program Files (x86)\MSXML 4.0
[2010/08/20 19:25:16 | 000,000,000 | —D | M] – C:\Program Files (x86)\MyDSC2
[2010/10/05 22:10:45 | 000,000,000 | —D | M] – C:\Program Files (x86)\Nitro PDF
[2010/10/06 01:27:44 | 000,000,000 | —D | M] – C:\Program Files (x86)\Norton 360
[2010/10/06 00:28:09 | 000,000,000 | —D | M] – C:\Program Files (x86)\NortonInstaller
[2010/10/05 22:10:45 | 000,000,000 | —D | M] – C:\Program Files (x86)\Novatel Wireless
[2010/08/02 18:41:07 | 000,000,000 | —D | M] – C:\Program Files (x86)\Opera
[2010/07/25 00:06:42 | 000,000,000 | —D | M] – C:\Program Files (x86)\Page 2 Stage
[2010/09/30 13:19:12 | 000,000,000 | —D | M] – C:\Program Files (x86)\Panda Security
[2010/10/05 22:10:49 | 000,000,000 | —D | M] – C:\Program Files (x86)\PDF reDirect
[2010/10/05 22:10:49 | 000,000,000 | —D | M] – C:\Program Files (x86)\pdf995
[2010/10/05 22:17:22 | 000,000,000 | —D | M] – C:\Program Files (x86)\PhoTags Express
[2010/10/05 22:10:51 | 000,000,000 | —D | M] – C:\Program Files (x86)\PinderSoft
[2010/10/05 22:10:52 | 000,000,000 | —D | M] – C:\Program Files (x86)\QuickTime
[2010/10/05 22:10:54 | 000,000,000 | —D | M] – C:\Program Files (x86)\RealArcade
[2010/10/05 22:10:54 | 000,000,000 | —D | M] – C:\Program Files (x86)\Realtek
[2010/10/05 22:10:54 | 000,000,000 | —D | M] – C:\Program Files (x86)\Reference Assemblies
[2010/10/05 22:10:55 | 000,000,000 | —D | M] – C:\Program Files (x86)\Research In Motion
[2010/08/10 14:43:21 | 000,000,000 | —D | M] – C:\Program Files (x86)\RoughDraft
[2010/10/05 22:11:02 | 000,000,000 | —D | M] – C:\Program Files (x86)\Screenplay Systems
[2010/09/04 12:45:08 | 000,000,000 | —D | M] – C:\Program Files (x86)\Script Genie
[2010/08/06 16:17:31 | 000,000,000 | —D | M] – C:\Program Files (x86)\Sharp Writer
[2010/10/05 22:11:02 | 000,000,000 | —D | M] – C:\Program Files (x86)\Sibelius Software
[2010/10/05 22:17:25 | 000,000,000 | R–D | M] – C:\Program Files (x86)\Skype
[2010/10/05 22:11:02 | 000,000,000 | —D | M] – C:\Program Files (x86)\SmartMusic
[2010/10/05 22:11:03 | 000,000,000 | —D | M] – C:\Program Files (x86)\Storyblue
[2010/10/05 22:11:03 | 000,000,000 | —D | M] – C:\Program Files (x86)\The Noteable Software Company
[2010/10/05 22:11:06 | 000,000,000 | —D | M] – C:\Program Files (x86)\TOSHIBA
[2010/10/05 22:11:08 | 000,000,000 | —D | M] – C:\Program Files (x86)\Uniblue
[2009/07/14 00:57:06 | 000,000,000 | -H-D | M] – C:\Program Files (x86)\Uninstall Information
[2010/10/05 22:11:08 | 000,000,000 | —D | M] – C:\Program Files (x86)\VA
[2010/10/05 22:17:27 | 000,000,000 | —D | M] – C:\Program Files (x86)\Verizon Wireless
[2010/10/05 22:11:09 | 000,000,000 | —D | M] – C:\Program Files (x86)\VideoLAN
[2010/10/05 22:18:44 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Defender
[2010/10/05 22:11:09 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Live
[2010/04/04 01:27:22 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Live SkyDrive
[2010/10/05 22:18:44 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Mail
[2010/10/05 22:11:09 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Media Player
[2010/10/05 22:11:09 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows NT
[2010/10/05 22:11:09 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Photo Viewer
[2009/07/14 01:32:40 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Portable Devices
[2010/10/05 22:11:09 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Sidebar
[2010/10/05 22:11:10 | 000,000,000 | —D | M] – C:\Program Files (x86)\Yahoo!
[2010/08/06 22:35:38 | 000,000,000 | —D | M] – C:\Program Files (x86)\yWriter5
[2010/08/18 22:12:18 | 000,000,000 | —D | M] – C:\Program Files (x86)\Zone Labs

< %systemroot%\system32\*.tso >

< %ALLUSERSPROFILE%\Documents\Server\*.* >

< %systemroot%\*.pif >

< %systemroot%\system32\n7533\*.* >

< %systemroot%\Us18336\*.* >

< %systemroot%\system32\*.zip >

< %systemroot%\system32\*.wgo >

< %ProgramFiles%\Microsoft Office\OFFICE11\*.* >

< %systemroot%\system32\dllcache\*.com >

< %systemroot%\system32\dllchache\*.* >

< %systemroot%\system32\038840\*.* >

< %systemroot%\system32\13E92A\*.* >

< %systemroot%\system32\1CB5AD\*.* >

< %systemroot%\system32\52682A\*.* >

< %USERPROFILE%\My Documents\*.htm >

< %SYSTEMDRIVE%\Mr_CF\*.* >

< %USERPROFILE%\My Documents\*.dll >

< %USERPROFILE%\My Documents\*.ccc >

< %systemroot%\system32\Sis\*.* >

< %systemroot%\Microsft\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 1027 bytes -> C:\Users\Michelle\AppData\Roaming\Microsoft\Windows\Cookies:kz0o0F28n9my4j2qSQ5goVhL
< End of report >

check-up scan:

Results of screen317's Security Check version 0.99.5
Windows 7 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Avira AntiVir Premium
Kaspersky Anti-Virus 2011
WMI entry may not exist for antivirus; attempting automatic update.
Avira successfully updated!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java™ 6 Update 17
Out of date Java installed!
Adobe Flash Player
Adobe Reader 9.3.4
Mozilla Firefox (Firefox, Opera, Netscape only..) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVG avgwdsvc.exe
AVG avgtray.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
Kaspersky Lab Kaspersky Anti-Virus 2011 avp.exe
Michelle AppData Local Temp\OnlineScanner\Anti-Virus\fsgk32.exe
Michelle AppData Local Temp\OnlineScanner\Anti-Virus\fssm32.exe
Michelle AppData Local Temp\fsonlinescanner.exe
````````````````````````````````
DNS Vulnerability Check:
Unknown. This method cannot test your vulnerability to DNS cache poisoning. (Wireless connection?)

``````````End of Log````````````

Conspire

Post #8October 8, 2010, 4:49 AM UTC

Your Extra.txt should be on your desktop. Can you see it?

UrbanSpice

Post #9October 8, 2010, 5:02 AM UTC

no. And whenever otl finished, two black window screens came up, but only one txt\notepad window.

Conspire

Post #10October 8, 2010, 8:14 AM UTC

Hi,

Multiple AntiVirus Running

Since you have more than one AV installed in your computer, I would strongly advice you to first uninstall whichever you don't prefer.

While this may seem like greater protection, it can cause problems including slowdowns, system hangs or even crashes. This can happen if both AntiVirus applications attempt to access the same file at the same time. This may cause the applications to interfere with each other, or cause the system to lock up. It can also be a drain on system resources, making a machine run slower than it should.

You have AVG, Avira, Symantec, and Kaspersky. Choose either one of them and uninstall the rest.

Any antivirus program must be removed via add/remove program.
For any program that doesn't have an add/remove entry, you will have to do this:

Re-install the program -> Reboot -> Uninstall

===================================================

Once you are done with the AV, please do the following :-

Please download MBRCheck.exe to your desktop.

Be sure to disable your security programs
Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
A window will open on your desktop
if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
If nothing unusual is found just press Enter
A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
Please post the contents of that file.

===================================================

On your next reply please post :
MBRCheck log

Good Day!

UrbanSpice

Post #11October 8, 2010, 3:32 PM UTC

removed avg, symantec, avira, kept kaspersky attached file

Attachments:

📎MBRCheck_10.08.10_11.28.02.txt

Conspire

Post #12October 9, 2010, 1:48 AM UTC

Hi,

Please get a new OTL scan log. Please set OTL up this way for the scan.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
UNCheck the boxes beside LOP Check and Purity Check.
Under Extra Registry box select All
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
OTL should now produce Extra.txt log for you.

===================================================

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Go here to run an online scannner from
ESET

(Note: You must use Internet Explorer for this scan.)

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
Click Start
Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
Click Scan.
Wait for the scan to finish.
Re-enable your Antivirus software.
A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txtWe will need this later.

Please post back with the ESET log.
===================================================

On your next reply please post :
Fresh OTL log
Extra log
ESET log

Good Day!

Conspire

Post #13October 9, 2010, 4:25 PM UTC

Hi, I am here to inform you that I won't be available starting from today onwards till at night, so I'm afraid you would have to wait a while longer before I can respond to you. I sincerely apologize for the delay. Thank you

UrbanSpice

Post #14October 10, 2010, 3:30 AM UTC

extra otl log attached

Attachments:

Conspire

Post #15October 11, 2010, 8:17 AM UTC

Hi,

You posted the wrong log for ESET, ensure that you copy/paste the log from C:\Program Files\ESET\log.txt

You still have AVG and Panda running in your system. Please download AVG Removal Tool x64 for complete removal.

Double click avgremoverx64.exe and follow the instructions from there.

To remove Panda,

Please uninstall the following Programs using the Add/Remove Programs utility if they exist.
Panda ActiveScan 2.0

Detailed steps below :-
On the Windows XP taskbar:
Click Start > Control Panel.
In the Control Panel window, click Programs -> Under Programs and Features click on Uninstall a Program

===================================================

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.

Copy the content of the following codebox into the main textfield:

:Dir
c:\windows\downloaded installations\{90f42154-37ba-4079-85a2-7b2db7ea6a01} /s

:File
C:\ProgramData\.811261211181235583101118113995

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

===================================================

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O4:64bit: - HKLM..\Run: [] File not found
O4 - HKCU..\Run: [Norton Download Manager{N360S_NUC_prod_1.19_4.1.0.32}] C:\Users\Public\Downloads\Norton\{N360S_NUC_prod_1.19_4.1.0.32}\N360Downloader.exe (Symantec Corporation)
O4 - HKCU..\Run: [Norton Download Manager{NIS_prod_1.5.30_18.1.0.37}] C:\Users\Public\Downloads\Norton\{NIS_prod_1.5.30_18.1.0.37}\NISDownloader.exe (Symantec Corporation)
[2010/10/06 01:03:18 | 000,000,000 | —D | C] – C:\Users\Michelle\AppData\Local\Symantec
[2010/10/08 21:25:27 | 000,001,322 | —- | M] () – C:\Users\Michelle\Desktop\Norton Installation Files.lnk
[2010/10/08 21:25:27 | 000,001,130 | —- | M] () – C:\Users\Michelle\Desktop\Norton Download Manager.lnk

:Files
C:\ProgramData\ezsidmv.dat

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

===================================================

On your next reply please post :
SystemLook log
Fresh OTL log
OTL fix log
ESET log

Good Day!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

computer virus - trojan

✨ Ask AI

Ask AI