Spyware / Malware / Virus Removal

Broswer re-directs- Hijack this log

16 min read

Looking for the outcome? Ask AI

AnthonySzum Topic Starter

Post #1October 21, 2010, 4:10 PM UTC

My browser directs me to another page other than the one I was intending to go to. It happens a lot and I have to keep going back and forth and eventually it will go to the correct page. I have pasted my log here. Thank you.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:10:00 PM, on 10/21/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18975)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Users\patricia\AppData\Roaming\Microsoft\Windows\shell.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe
C:\Users\patricia\AppData\Roaming\Microsoft\svchost.exe
C:\Program Files\Common Files\aol\1247175231\ee\aolsoftware.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\patricia\AppData\Local\Temp\dwm.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\AOL 9.1\waol.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\AOL 9.1\shellmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Paltalk Messenger\paltalk.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\patricia\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mirarsearch.com/?useie5=1&q=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:50370
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 - REG:win.ini: load=C:\Users\patricia\AppData\Local\Temp\dwm.exe
O2 - BHO: ToggleEN Toolbar - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTogg.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: PlaySushi - {21608B66-026F-4DCB-9244-0DACA328DCED} - C:\Program Files\PlaySushi\PSText.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll
O2 - BHO: FCTBPos00Pos - {399C60D2-38B1-4E25-B9E7-6498C1BC2DCD} - C:\Program Files\Dogpile Toolbar\Toolbar.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20100916034804.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ToggleEN Toolbar - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTogg.dll
O3 - Toolbar: Dogpile Toolbar - {C53FE659-316A-4F56-A194-A5BE491BE866} - C:\Program Files\Dogpile Toolbar\Toolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell DataSafe Online] "C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe" /m
O4 - HKLM\..\Run: [Dell Webcam Central] "C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1247175231\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NBAgent] "C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [svchost] C:\Users\patricia\AppData\Roaming\Microsoft\svchost.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Vidalia] "C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.1\AOL.EXE" -b
O4 - HKCU\..\Run: [svchost] C:\Users\patricia\AppData\Roaming\Microsoft\svchost.exe
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Startup: OneNote Table Of Contents.onetoc2
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Go PlaySushi! - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - C:\Program Files\PlaySushi\PSText.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F965D7B6-EFF4-4CD4-8472-5F7A994A99A5}: NameServer = 205.188.146.145
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - (no file)
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdate1ca16e365ac7a30) (gupdate1ca16e365ac7a30) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McShield - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe (file missing)
O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks - C:\Program Files\Dell DataSafe Local Backup\sftservice.EXE
O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_DellSupportCenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\STacSV.exe
O23 - Service: TabQuery Service - Unknown owner - C:\ProgramData\TabQuery\tabquery119.exe (file missing)
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

–
End of file - 14256 bytes

Conspire

Post #2October 22, 2010, 12:19 PM UTC

Hello there, AnthonySzum

I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:

Read the entire procedure
It is important to perform ALL actions in sequence.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Stick with me till you're given the all clear.
Remember, absence of symptoms does not mean the infection is all gone.
Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

Please bear with me, I will post back to you as soon as I can.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

**In any case where you happen to be busy or unable to give us a reply, we would be more than grateful if you keep us informed in advance and we will be more than happy to wait. Failure to do so we will have your thread closed in THREE(3) days.

Conspire

Post #3October 22, 2010, 2:43 PM UTC

Hello there,

1. All tools MUST be run from the executable. (.exe)
With Admin Rights (Right click, choose "Run as Administrator")

Malwarebytes' Anti-Malware
Download Malwarebytes' Anti-Malware here and save to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program. (Note to Vista users, please right-click and select Run as Administrator.)
At the end, be sure a checkmark is placed next to:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please copy and paste the log back into your next reply

Note:

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
Or via the Logs tab when Malwarebytes' Anti-Malware is started.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so. Failure to reboot will prevent MBAM from removing all the malware.

===================================================

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click on Minimal Output at the top
Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
Double click inside the Custom Scan box at the bottom
A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
Click the OK button and navigate to the file scan.txt which we just saved to your desktop
Select scan.txt and click Open. Writing will now appear under the Custom Scan box
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

===================================================

[external image: Posted Image]

Please download GMER from one of the following locations, and save it to your desktop:
Main Mirror
This version will download a randomly named file (Recommended)
Zip Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

Extract the contents of the zipped file to desktop (applicable only to Zip mirror) .
Double click [external image: Posted Image] or [external image: Posted Image] on your desktop.
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
[external image: Posted Image]

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===================================================

On your next reply please post :
OTL log
GMER log
MBAM log

Good Day!

AnthonySzum

Post #4October 22, 2010, 5:34 PM UTC

OTL logfile created on: 10/22/2010 12:18:23 PM - Run 1
OTL by OldTimer - Version 3.2.16.0 Folder = C:\Users\patricia\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 65.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 217.81 Gb Total Space | 112.69 Gb Free Space | 51.74% Space Free | Partition Type: NTFS
Drive D: | 15.00 Gb Total Space | 14.91 Gb Free Space | 99.41% Space Free | Partition Type: NTFS

Computer Name: PATRICIA-PC | User Name: patricia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\patricia\AppData\Roaming\Microsoft\svchost.exe ()
PRC - C:\Users\patricia\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\patricia\AppData\Local\temp\dwm.exe ()
PRC - C:\Users\patricia\AppData\Roaming\Microsoft\Windows\shell.exe ()
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe ()
PRC - C:\Program Files\Vidalia Bundle\Tor\tor.exe ()
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\Vidalia Bundle\Polipo\polipo.exe ()
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe ()
PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Dell DataSafe Local Backup\SftService.exe (SoftThinks)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
PRC - C:\Program Files\AOL 9.1\shellmon.exe (AOL, LLC.)
PRC - C:\Program Files\AOL 9.1\waol.exe (AOL, LLC.)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
PRC - C:\Program Files\Common Files\aol\1247175231\ee\aolsoftware.exe (AOL LLC)
PRC - C:\Program Files\Common Files\aol\acs\AOLacsd.exe (AOL LLC)

========== Modules (SafeList) ==========

MOD - C:\Users\patricia\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msshsq.dll (Microsoft Corporation)
MOD - C:\Windows\System32\WindowsCodecs.dll (Microsoft Corporation)
MOD - C:\Windows\System32\networkexplorer.dll (Microsoft Corporation)
MOD - C:\Windows\System32\SLC.dll (Microsoft Corporation)
MOD - C:\Windows\System32\EhStorShell.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cscapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\rsaenh.dll (Microsoft Corporation)
MOD - C:\Windows\System32\duser.dll (Microsoft Corporation)
MOD - C:\Windows\System32\actxprxy.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\System32\thumbcache.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (TabQuery Service) – C:\ProgramData\TabQuery\tabquery119.exe File not found
SRV - (MyWebSearchService) – C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe File not found
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (mfevtp) – C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (WPFFontCache_v0400) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (MSK80Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (GameConsoleService) – C:\Program Files\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (SftService) – C:\Program Files\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks)
SRV - (STacSV) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (DockLoginService) – C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)

========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (catchme) – C:\ComboFix\catchme.sys File not found
DRV - (fssfltr) – C:\Windows\System32\drivers\fssfltr.sys (Microsoft Corporation)
DRV - (mfehidk) – C:\Windows\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfewfpk) – C:\Windows\System32\drivers\mfewfpk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\Windows\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfenlfk) – C:\Windows\System32\drivers\mfenlfk.sys (McAfee, Inc.)
DRV - (cfwids) – C:\Windows\System32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (Netaapl) – C:\Windows\System32\drivers\netaapl.sys (Apple Inc.)
DRV - (itecir) – C:\Windows\System32\drivers\itecir.sys (ITE Tech. Inc. )
DRV - (mfesmfk) – C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (OA001Vid) – C:\Windows\System32\drivers\OA001Vid.sys (Creative Technology Ltd.)
DRV - (OA001Ufd) – C:\Windows\System32\drivers\OA001Ufd.sys (Creative Technology Ltd.)
DRV - (CtClsFlt) – C:\Windows\System32\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV - (BCM42RLY) – C:\Windows\System32\drivers\bcm42rly.sys (Broadcom Corporation)
DRV - (LMouFilt) – C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (BCM43XX) – C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (PCD5SRVC{3F6A8B78-EC003E00-05040104}) – C:\Program Files\Dell Support Center\HWDiag\bin\pcd5srvc.pkms (PC-Doctor, Inc.)
DRV - (k57nd60x) Broadcom NetLink ™ – C:\Windows\System32\drivers\k57nd60x.sys (Broadcom Corporation)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (MegaSR) – C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\Windows\System32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
IE - HKLM\..\URLSearchHook: {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTogg.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50370

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.2.0
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: openinregedit@firefox:0.1.2.4
FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 50370
FF - prefs.js..network.proxy.type: 1

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/10/20 14:02:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/20 14:02:05 | 000,000,000 | —D | M]

[2010/03/21 21:03:44 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Extensions
[2009/09/13 18:32:03 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/03/21 21:03:44 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\extensions
[2010/03/21 21:03:44 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\extensions\[removed]
[2010/10/21 23:49:15 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions
[2010/05/24 17:59:24 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/24 17:59:24 | 000,000,000 | —D | M] (No name found) – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}-trash
[2010/09/23 15:33:06 | 000,000,000 | —D | M] (Torbutton) – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2010/09/02 20:54:38 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions\openinregedit@firefox
[2010/10/19 22:20:29 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/06/08 19:36:17 | 000,000,000 | —D | M] (Skype extension for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/08/24 14:57:38 | 000,024,376 | —- | M] (McAfee, Inc.) – C:\Program Files\Mozilla Firefox\components\Scriptff.dll

O1 HOSTS File: ([2009/09/10 15:22:19 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (ToggleEN Toolbar) - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTogg.dll (Conduit Ltd.)
O2 - BHO: (PlaySushi) - {21608B66-026F-4DCB-9244-0DACA328DCED} - C:\Program Files\PlaySushi\PSText.dll ()
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (Freecause Toolbar BHO) - {399C60D2-38B1-4E25-B9E7-6498C1BC2DCD} - C:\Program Files\Dogpile Toolbar\Toolbar.dll ()
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20100916034804.dll (McAfee, Inc.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (ToggleEN Toolbar) - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTogg.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Dogpile Toolbar) - {C53FE659-316A-4F56-A194-A5BE491BE866} - C:\Program Files\Dogpile Toolbar\Toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (ToggleEN Toolbar) - {038CB5C7-48EA-4AF9-94E0-A1646542E62B} - C:\Program Files\ToggleEN\tbTogg.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Dogpile Toolbar) - {C53FE659-316A-4F56-A194-A5BE491BE866} - C:\Program Files\Dogpile Toolbar\Toolbar.dll ()
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe ()
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\aol\1247175231\ee\aolsoftware.exe (AOL LLC)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NBAgent] C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKCU..\Run: [AOL Fast Start] C:\Program Files\AOL 9.1\AOL.EXE (AOL, LLC.)
O4 - HKCU..\Run: [svchost] C:\Users\patricia\AppData\Roaming\Microsoft\svchost.exe ()
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [Vidalia] C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe ()
O4 - Startup: C:\Users\patricia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote Table Of Contents.onetoc2 ()
F3 - HKCU WinNT: Load - (C:\Users\patricia\AppData\Local\Temp\dwm.exe) - C:\Users\patricia\AppData\Local\temp\dwm.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr =
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\paltalk.exe (AVM Software Inc.)
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe File not found
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Go PlaySushi! - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - C:\Program Files\PlaySushi\PSText.dll ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (C:\Users\patricia\AppData\Roaming\Microsoft\Windows\shell.exe) - C:\Users\patricia\AppData\Roaming\Microsoft\Windows\shell.exe ()
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Users\patricia\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\patricia\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~2\SPYWAR~1\sp_rsdel.exe \??\C:\PROGRA~2\SPYWAR~1\sp_rsdel.dat) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.scg726 - C:\Windows\System32\scg726.acm (SHARP Corporation)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

MsConfig - StartUpFolder: C:^Users^patricia^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk - C:\PROGRA~1\MICROS~3\Office12\ONENOTEM.EXE - File not found
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: PDVDDXSrv - hkey= - key= - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
MsConfig - StartUpReg: StartCCC - hkey= - key= - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: WMPNSCFG - hkey= - key= - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
MsConfig - State: "startup" - 2

SafeBootMin: AppMgmt - C:\Windows\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: mcmscsvc - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SafeBootMin: MCODS - C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - C:\Windows\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SafeBootNet: HelpSvc - Service
SafeBootNet: McMPFSvc - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SafeBootNet: mcmscsvc - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SafeBootNet: MCODS - C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SafeBootNet: Messenger - File not found
SafeBootNet: mfefire - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SafeBootNet: mfefirek - C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.)
SafeBootNet: mfefirek.sys - C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.)
SafeBootNet: mfehidk - C:\Windows\system32\drivers\mfehidk.sys (McAfee, Inc.)
SafeBootNet: mfehidk.sys - C:\Windows\system32\drivers\mfehidk.sys (McAfee, Inc.)
SafeBootNet: mfevtp - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/10/22 11:04:02 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\patricia\Desktop\OTL.exe
[2010/10/21 19:36:19 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Roaming\Elephant Games
[2010/10/21 19:36:19 | 000,000,000 | —D | C] – C:\ProgramData\Elephant Games
[2010/10/21 19:35:01 | 000,000,000 | —D | C] – C:\Program Files\Mystery Trackers - The Void Collector's Edition
[2010/10/21 12:09:16 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\patricia\Desktop\HijackThis.exe
[2010/10/21 12:00:16 | 000,000,000 | —D | C] – C:\Windows\en
[2010/10/21 11:59:35 | 000,039,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\fssfltr.sys
[2010/10/21 11:54:41 | 000,000,000 | —D | C] – C:\Program Files\MSN Toolbar
[2010/10/21 11:54:22 | 000,000,000 | —D | C] – C:\Program Files\Bing Bar Installer
[2010/10/21 11:54:17 | 000,515,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_5.dll
[2010/10/21 11:54:17 | 000,453,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_42.dll
[2010/10/21 11:54:17 | 000,069,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAPOFX1_3.dll
[2010/10/21 11:35:56 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Local\Windows Live
[2010/10/21 11:34:54 | 000,754,688 | —- | C] (Microsoft Corporation) – C:\Windows\System32\webservices.dll
[2010/10/19 11:00:51 | 000,000,000 | —D | C] – C:\Windows\System32\WindowsPowerShell
[2010/10/19 10:58:17 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrsmgr.dll
[2010/10/19 10:58:03 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrs.exe
[2010/10/19 10:58:03 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrshost.exe
[2010/10/19 10:58:03 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsmprovhost.exe
[2010/10/19 10:58:00 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsmplpxy.dll
[2010/10/19 10:58:00 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrssrv.dll
[2010/10/19 10:57:59 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wevtfwd.dll
[2010/10/19 10:57:59 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wecutil.exe
[2010/10/19 10:57:59 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wecapi.dll
[2010/10/19 10:57:59 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmRes.dll
[2010/10/19 10:57:58 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pwrshplugin.dll
[2010/10/19 10:57:53 | 000,252,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSManMigrationPlugin.dll
[2010/10/19 10:57:53 | 000,246,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSManHTTPConfig.exe
[2010/10/19 10:57:53 | 000,241,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrscmd.dll
[2010/10/19 10:57:53 | 000,214,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmWmiPl.dll
[2010/10/19 10:57:53 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmAuto.dll
[2010/10/18 22:01:29 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Dirty Dancing 1987 20th Anniversary Edition DvDrip[Eng]-greenbud1969
[2010/10/14 17:10:53 | 000,000,000 | —D | C] – C:\Program Files\Paltalk Messenger
[2010/10/14 16:52:11 | 008,147,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2010/10/14 16:51:20 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netevent.dll
[2010/10/14 16:50:36 | 000,157,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\t2embed.dll
[2010/10/14 16:50:29 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2010/10/14 16:50:29 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2010/10/14 16:50:29 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2010/10/14 16:50:28 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2010/10/14 16:50:28 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/10/14 16:50:28 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/10/14 16:50:28 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/10/14 16:50:27 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/10/14 16:50:27 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2010/10/14 16:50:27 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2010/10/14 16:50:27 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2010/10/14 16:50:27 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2010/10/14 16:50:27 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2010/10/14 16:50:27 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2010/10/14 16:50:27 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/10/14 16:50:27 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/10/14 16:50:27 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2010/10/14 16:50:22 | 000,954,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40.dll
[2010/10/14 16:50:22 | 000,954,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40u.dll
[2010/10/14 16:50:19 | 002,038,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2010/10/14 16:50:16 | 000,231,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msshsq.dll
[2010/10/14 16:50:14 | 000,867,328 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpmde.dll
[2010/10/10 19:04:25 | 000,000,000 | —D | C] – C:\Program Files\Redemption Cemetery - Curse of the Raven
[2010/10/10 13:53:00 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Jersey Shore - Season 01
[2010/10/08 13:01:14 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2010/10/05 03:11:05 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Roaming\Paltalk
[2010/10/03 17:33:11 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Sons of Anarchy Season 1 & 2
[2010/10/03 17:14:25 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Linkin_Park-A_Thousand_Suns-2010-pLAN9
[2010/09/30 16:29:06 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\images
[2010/09/28 19:04:04 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Human Weapon
[2010/09/28 18:23:49 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/09/28 16:20:00 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Roaming\Notepad++
[2010/09/28 16:20:00 | 000,000,000 | —D | C] – C:\Program Files\Notepad++
[2010/09/24 18:31:15 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Roaming\Ghost Ship Studios
[2010/09/24 16:43:46 | 000,000,000 | —D | C] – C:\Program Files\Nightmare Adventures - The Witch's Prison
[2010/09/23 15:32:52 | 000,000,000 | —D | C] – C:\Program Files\Vidalia Bundle
[2010/09/23 15:32:52 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Roaming\Vidalia
[2010/09/23 15:28:56 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Roaming\Tor
[2010/09/23 00:47:28 | 000,049,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sirenacm.dll
[2010/09/23 00:32:56 | 000,301,936 | —- | C] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR
[2010/09/02 20:22:56 | 000,047,360 | —- | C] (VSO Software) – C:\Users\patricia\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2010/10/22 12:21:04 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/10/22 12:14:14 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/22 12:14:14 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/22 12:14:08 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/10/22 12:14:07 | 000,000,246 | —- | M] () – C:\Windows\tasks\PersonalSec.job
[2010/10/22 12:13:55 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/10/22 12:13:50 | 3213,815,808 | -HS- | M] () – C:\hiberfil.sys
[2010/10/22 11:05:16 | 000,294,912 | —- | M] () – C:\Users\patricia\Desktop\lerkblms.exe
[2010/10/22 11:04:09 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\patricia\Desktop\OTL.exe
[2010/10/22 10:11:39 | 000,381,248 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/10/21 22:10:15 | 000,050,176 | —- | M] () – C:\Users\patricia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/21 22:07:43 | 000,000,000 | -H– | M] () – C:\Users\patricia\Documents\Default.rdp
[2010/10/21 21:52:11 | 000,000,424 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{3665EB40-7FE9-4CC9-A94B-EAE9FD7003FC}.job
[2010/10/21 19:35:48 | 000,002,007 | —- | M] () – C:\Users\Public\Desktop\Play Mystery Trackers - The Void Collector's Edition.lnk
[2010/10/21 19:35:48 | 000,001,260 | —- | M] () – C:\Users\Public\Desktop\More Great Games.lnk
[2010/10/21 12:09:22 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\patricia\Desktop\HijackThis.exe
[2010/10/19 15:50:52 | 000,000,258 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2010/10/17 19:08:52 | 006,600,795 | —- | M] () – C:\Users\patricia\Documents\Monkey_with_a_deathwish.wmv
[2010/10/10 19:06:17 | 000,001,952 | —- | M] () – C:\Users\Public\Desktop\Play Redemption Cemetery - Curse of the Raven.lnk
[2010/10/03 18:35:24 | 000,134,733 | —- | M] () – C:\Users\patricia\Documents\IMG00377-20100925-1846.jpg
[2010/09/24 16:44:48 | 000,001,947 | —- | M] () – C:\Users\Public\Desktop\Play Nightmare Adventures - The Witch's Prison.lnk
[2010/09/24 16:40:21 | 000,001,686 | —- | M] () – C:\Users\patricia\Application Data\Microsoft\Internet Explorer\Quick Launch\Game Manager.lnk
[2010/09/24 16:40:21 | 000,001,662 | —- | M] () – C:\Users\Public\Desktop\Game Manager.lnk
[2010/09/23 00:47:28 | 000,049,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sirenacm.dll
[2010/09/23 00:32:56 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR
[2010/09/23 00:21:24 | 000,039,272 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drivers\fssfltr.sys
[2010/09/22 20:49:12 | 000,242,684 | —- | M] () – C:\Users\patricia\Documents\Momma_Mia.jpg
[2010/09/22 20:47:20 | 002,236,416 | —- | M] () – C:\Users\patricia\Documents\BrazilGrannies1.pps

========== Files Created - No Company Name ==========

[2010/10/22 11:05:15 | 000,294,912 | —- | C] () – C:\Users\patricia\Desktop\lerkblms.exe
[2010/10/21 22:07:43 | 000,000,000 | -H– | C] () – C:\Users\patricia\Documents\Default.rdp
[2010/10/21 19:35:48 | 000,002,007 | —- | C] () – C:\Users\Public\Desktop\Play Mystery Trackers - The Void Collector's Edition.lnk
[2010/10/21 19:35:48 | 000,001,260 | —- | C] () – C:\Users\Public\Desktop\More Great Games.lnk
[2010/10/19 10:57:54 | 000,201,184 | —- | C] () – C:\Windows\System32\winrm.vbs
[2010/10/19 10:57:54 | 000,004,675 | —- | C] () – C:\Windows\System32\wsmanconfig_schema.xml
[2010/10/19 10:57:54 | 000,002,426 | —- | C] () – C:\Windows\System32\WsmTxt.xsl
[2010/10/17 19:08:41 | 006,600,795 | —- | C] () – C:\Users\patricia\Documents\Monkey_with_a_deathwish.wmv
[2010/10/10 19:06:17 | 000,001,952 | —- | C] () – C:\Users\Public\Desktop\Play Redemption Cemetery - Curse of the Raven.lnk
[2010/10/03 18:35:23 | 000,134,733 | —- | C] () – C:\Users\patricia\Documents\IMG00377-20100925-1846.jpg
[2010/09/24 16:44:48 | 000,001,947 | —- | C] () – C:\Users\Public\Desktop\Play Nightmare Adventures - The Witch's Prison.lnk
[2010/09/22 20:49:11 | 000,242,684 | —- | C] () – C:\Users\patricia\Documents\Momma_Mia.jpg
[2010/09/22 20:47:16 | 002,236,416 | —- | C] () – C:\Users\patricia\Documents\BrazilGrannies1.pps
[2010/09/02 20:22:56 | 000,087,608 | —- | C] () – C:\Users\patricia\AppData\Roaming\inst.exe
[2010/09/02 20:22:56 | 000,007,887 | —- | C] () – C:\Users\patricia\AppData\Roaming\pcouffin.cat
[2010/09/02 20:22:56 | 000,001,144 | —- | C] () – C:\Users\patricia\AppData\Roaming\pcouffin.inf
[2010/09/02 20:22:56 | 000,000,055 | —- | C] () – C:\Users\patricia\AppData\Roaming\pcouffin.log
[2010/08/31 22:00:15 | 000,000,146 | —- | C] () – C:\Windows\WININIT.INI
[2010/06/08 19:39:39 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/01/01 11:22:12 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2009/09/16 19:17:19 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/08/14 09:39:45 | 000,050,176 | —- | C] () – C:\Users\patricia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/26 18:38:24 | 000,007,728 | —- | C] () – C:\Users\patricia\AppData\Local\d3d9caps.dat
[2009/06/30 14:21:40 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2009/06/30 11:48:49 | 000,006,656 | —- | C] () – C:\Windows\System32\bcmwlrc.dll
[2009/06/30 11:48:48 | 000,054,784 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2006/11/02 08:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 03:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/10/28 03:55:19 | 000,000,095 | —- | M] () – C:\9.Pr0_Collect.dat
[2009/08/11 17:32:27 | 000,000,461 | —- | M] () – C:\aaw7boot.log
[2006/09/18 17:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/09/07 21:51:53 | 000,000,000 | —- | M] () – C:\backup.reg
[2009/04/11 02:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2009/09/07 21:51:48 | 000,000,574 | —- | M] () – C:\cleanup.bat
[2009/09/10 18:01:48 | 000,024,328 | —- | M] () – C:\ComboFix.txt
[2006/09/18 17:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2009/06/30 14:21:51 | 000,005,234 | RH– | M] () – C:\dell.sdr
[2010/10/22 12:13:50 | 3213,815,808 | -HS- | M] () – C:\hiberfil.sys
[2010/04/22 16:33:01 | 000,000,000 | —- | M] () – C:\install.rdf
[2009/09/06 22:00:42 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/09/06 22:00:42 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2010/10/22 12:13:49 | 3529,682,944 | -HS- | M] () – C:\pagefile.sys
[2009/09/10 20:21:22 | 000,001,838 | —- | M] () – C:\RootRepeal.txt
[2009/09/07 21:51:48 | 000,135,168 | —- | M] () – C:\zip.exe

< %systemroot%\Fonts\*.com >
[2006/11/02 08:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 08:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 08:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/10/11 17:52:24 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 17:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/01/20 22:23:14 | 000,089,600 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 08:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
[2009/11/28 10:40:05 | 000,003,656 | -HS- | M] () – C:\Windows\System32\spool\prtprocs\w32x86\OneNote Table Of Contents.onetoc2

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/23 00:32:56 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2010/10/22 00:23:34 | 000,019,967 | —- | M] () – C:\Users\patricia\AppData\Roaming\Microsoft\stor.cfg
[2010/10/22 12:14:26 | 000,096,256 | —- | M] () – C:\Users\patricia\AppData\Roaming\Microsoft\svchost.exe

< %PROGRAMFILES%\*.* >
[2008/01/20 22:43:21 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/01/20 23:14:18 | 016,846,848 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 23:14:08 | 000,106,496 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 23:14:18 | 000,020,480 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 06:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 06:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >
[2009/11/03 17:36:34 | 000,003,656 | -HS- | M] () – C:\Windows\System32\config\systemprofile\OneNote Table Of Contents.onetoc2

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/09/07 15:46:37 | 000,000,286 | -HS- | M] () – C:\Users\patricia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/10/21 12:09:22 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\patricia\Desktop\HijackThis.exe
[2010/10/22 11:05:16 | 000,294,912 | —- | M] () – C:\Users\patricia\Desktop\lerkblms.exe
[2010/10/22 11:04:09 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\patricia\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >
[2010/03/29 09:44:39 | 000,061,224 | —- | M] () – C:\Users\patricia\GoToAssistDownloadHelper.exe

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/07/08 16:40:49 | 000,000,402 | -HS- | M] () – C:\Users\patricia\Favorites\desktop.ini
[2010/10/13 18:50:02 | 000,001,158 | —- | M] () – C:\Users\patricia\Favorites\WildTangent Games.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010/10/19 15:50:52 | 000,000,258 | RHS- | M] () – C:\ProgramData\ntuser.pol

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >
[2009/11/03 17:36:24 | 000,003,656 | -HS- | M] () – C:\Windows\System32\IME\OneNote Table Of Contents.onetoc2

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >
[2006/09/18 17:31:55 | 000,107,620 | —- | M] () – C:\Windows\System32\acwizard.ico

< %systemroot%\system\*.dat >

< %systemroot%\system\*.exe >

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< %systemroot%\system32\services\*.* >

< %systemroot%\Spooler\*.* >

< %ProgramFiles%\system32\*.* >

< %systemroot%\system32\Setup\*.dll /x >
[2009/11/03 17:36:14 | 000,003,656 | -HS- | M] () – C:\Windows\System32\setup\OneNote Table Of Contents.onetoc2

< %systemroot%\system32\*.mine >

< %SYSTEMDRIVE%\cleansweep.exe\*.* >

< %systemroot%\system32\ras\*.dll >

< %systemroot%\system32\ras\*.drv >

< %systemroot%\*.iq >

< %systemroot%\system32\XP\*.* >

< %SYSTEMDRIVE%\Extracted\*.* >

< %systemroot%\system32\windows\*.* >

< %systemroot%\logs\*.* >
[2010/10/21 11:54:18 | 000,337,806 | —- | M] () – C:\Windows\Logs\DirectX.log

< %SYSTEMDRIVE%\Win.Msi\*.* >

< %systemroot%\regedit\*.* >

< %systemroot%\system32\skype\*.* >

< %AppData%\Adobe\dlluplwin25\*.* >

< %UserProfile%\*.dat >
[2010/08/01 19:01:39 | 000,000,046 | —- | M] () – C:\Users\patricia\jagex_runescape_preferences.dat
[2010/08/01 19:02:24 | 000,000,099 | —- | M] () – C:\Users\patricia\jagex_runescape_preferences2.dat
[2010/08/01 18:50:57 | 000,000,000 | —- | M] () – C:\Users\patricia\jagex__preferences3.dat
[2010/10/22 12:28:50 | 003,407,872 | -HS- | M] () – C:\Users\patricia\NTUSER.DAT

< %UserProfile%\*.dll >

< %systemroot%\system32\*.sxo >

< %SYSTEMDRIVE%\Gazma\*.* /s >

< %systemroot%\system32\spynet\*.* >

< %systemroot%\system32\System\*.* >

< %appdata%\Microsoft\Windows\*.* >
[2010/10/19 11:27:05 | 000,122,368 | —- | M] () – C:\Users\patricia\AppData\Roaming\Microsoft\Windows\shell.exe

< %systemroot%\system32\WinDir\*.* >

< %systemroot%\_\*.* >

< %systemroot%\system32\windows32\*.* >

< %ProgramFiles%\win\*.* >

< %AppData%\Microsoft\CD Burning\*.* >

< %systemroot%\*.cab >

< %systemroot%\K.Backup\*.* >

< %ProgramFiles%\Massenger\*.* >

< %systemroot%\System32\*.doc >

< %systemroot%\Office12\*.* >

< %systemroot%\System32\Rundl32.exe\*.* >

< %ProgramFiles%\yahoo.net\*.* >

< %systemroot%\system32\*.igo >

< %systemroot%\*.rew >

< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >

< %USERPROFILE%\.COMMgr\*.* >

< %USERPROFILE%\Desktop\*.bat >

< %PROGRAMFILES%\Common Files\Real\visualizations\*.* >

< %PROGRAMFILES%\Internet Explorer\*.Jmp >

< %PROGRAMFILES%\Windows NT\system\*.dll >

< %systemroot%\system32\*.ext >

< %systemroot%\system32\Com\*.cfg >

< %systemroot%\system32\btz\*.* >

< %systemroot%\system32\EMP\*.* >

< %systemroot%\system32\expo\*.* >

< %systemroot%\system32\inet2\*.* >

< %systemroot%\system32\xrem\*.* >

< %ProgramFiles%\Microsoft\*.* >

< %systemroot%\usgwmt\*.* >

< %ProgramFiles%\B\*.* >

< %SYSTEMDRIVE%\lspp\*.* >

< %systemroot%\Kral\*.* >

< %SYSTEMDRIVE%\windowsdvd.exe\*.* >

< %systemroot%\system32\*.ipo >

< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >

< %systemroot%\system32\*.mof >

< %systemroot%\*.atm >

< %systemroot%\system32\svhost\*.* >

< %ProgramFiles%\system32\*.* >

< %ProgramFiles%\Docmentt\*.* >

< %systemroot%\Help\*.vbs >

< %ProgramFiles%\Windows WinSxs\*.* /s >

< %ProgramFiles%\Outlook Express\IDT\*.* /s >

< %ProgramFiles%\Microsoft Office\365\*.* /s >

< %ProgramFiles%\Windows Live\*.* >

< %systemroot%\system32\win32\*.* >

< %SYSTEMDRIVE%\RECYCLER\*.* >

< %systemroot%\Fresh1\*.* >

< %ProgramFiles%\Kekj\*.* /s >

< %systemroot%\GDU\*.* >

< %systemroot%\KA\*.* >

< %systemroot%\R\*.* >

< %systemroot%\system32\*.fyo >

< %USERPROFILE%\System\*.* >

< %systemroot%\Source\*.* >

< %systemroot%\system32\ac\*.* >

< %ProgramFiles%\MSDN\*.* >

< %AppData%\AdobeUM\winvcldll54\*.* /s >

< %ProgramFiles%\Internet Explorer\*.ico >

< %systemroot%\system32\*.ojo >

< %systemroot%\system32\d323s\*.* >

< %systemroot%\system32\re\*.* >

< %UserProfile%\Microsoft\*.dll >

< %UserProfile%\Microsoft\*.log >

< %systemroot%\Bios\*.* >

< %ProgramFiles%\Spool\*.* >

< %ProgramFiles%\promp3\*.* >

< %SYSTEMDRIVE%\Driver\*.* /s >

< %SYSTEMDRIVE%\inetserver.exe\*.* >

< %systemroot%\java\trustlib\*.* >

< %ProgramFiles%\Common Files\designer\*.exe >

< %ProgramFiles%\*. >
[2010/10/08 13:01:14 | 000,000,000 | —D | M] – C:\Program Files\Adobe
[2009/07/09 17:35:56 | 000,000,000 | —D | M] – C:\Program Files\AOL
[2009/10/16 21:31:10 | 000,000,000 | —D | M] – C:\Program Files\AOL 9.1
[2010/04/02 20:15:28 | 000,000,000 | —D | M] – C:\Program Files\Apple Software Update
[2009/06/30 11:48:25 | 000,000,000 | —D | M] – C:\Program Files\ATI Technologies
[2010/05/16 11:32:32 | 000,000,000 | —D | M] – C:\Program Files\AV Vcs 6.0 DIAMOND
[2010/02/22 21:33:35 | 000,000,000 | —D | M] – C:\Program Files\Awakening - The Dreamless Castle
[2010/09/24 16:40:21 | 000,000,000 | —D | M] – C:\Program Files\bfgclient
[2010/10/21 11:55:00 | 000,000,000 | —D | M] – C:\Program Files\Bing Bar Installer
[2010/10/11 15:42:03 | 000,000,000 | —D | M] – C:\Program Files\BitTorrent
[2010/05/04 18:47:07 | 000,000,000 | —D | M] – C:\Program Files\Bonjour
[2010/10/17 23:02:35 | 000,000,000 | —D | M] – C:\Program Files\CCleaner
[2009/06/30 11:50:29 | 000,000,000 | —D | M] – C:\Program Files\Cisco
[2009/06/30 11:58:48 | 000,000,000 | —D | M] – C:\Program Files\Citrix
[2009/07/16 19:20:09 | 000,000,000 | —D | M] – C:\Program Files\CleanUp!
[2009/09/13 22:49:44 | 000,000,000 | —D | M] – C:\Program Files\CoD RconTool
[2010/10/08 13:01:14 | 000,000,000 | —D | M] – C:\Program Files\Common Files
[2009/12/13 21:39:08 | 000,000,000 | —D | M] – C:\Program Files\Conduit
[2009/06/30 12:23:59 | 000,000,000 | —D | M] – C:\Program Files\Creative
[2009/06/30 12:22:35 | 000,000,000 | —D | M] – C:\Program Files\Creative Live! Cam
[2009/08/30 15:52:56 | 000,000,000 | —D | M] – C:\Program Files\CyberLink
[2010/01/18 21:00:14 | 000,000,000 | —D | M] – C:\Program Files\Dell
[2009/07/29 15:13:50 | 000,000,000 | —D | M] – C:\Program Files\Dell DataSafe Local Backup
[2009/12/02 14:42:59 | 000,000,000 | —D | M] – C:\Program Files\Dell DataSafe Online
[2009/06/30 11:45:49 | 000,000,000 | —D | M] – C:\Program Files\Dell Inc
[2009/08/11 22:58:15 | 000,000,000 | —D | M] – C:\Program Files\Dell Remote Access
[2009/06/30 12:13:06 | 000,000,000 | —D | M] – C:\Program Files\Dell Support Center
[2009/06/30 11:56:11 | 000,000,000 | —D | M] – C:\Program Files\Dell Video Chat
[2009/06/30 12:23:48 | 000,000,000 | —D | M] – C:\Program Files\Dell Webcam
[2009/06/30 14:21:30 | 000,000,000 | —D | M] – C:\Program Files\DellTPad
[2010/08/31 21:46:03 | 000,000,000 | —D | M] – C:\Program Files\DivX
[2010/03/21 21:03:52 | 000,000,000 | —D | M] – C:\Program Files\Dogpile Toolbar
[2010/09/02 20:31:04 | 000,000,000 | —D | M] – C:\Program Files\DVDFab 8
[2010/05/08 14:59:03 | 000,000,000 | —D | M] – C:\Program Files\Escape the Lost Kingdom
[2009/09/10 19:05:14 | 000,000,000 | —D | M] – C:\Program Files\ESET
[2010/07/31 09:04:29 | 000,000,000 | —D | M] – C:\Program Files\Google
[2009/06/30 06:28:14 | 000,000,000 | —D | M] – C:\Program Files\IDT
[2009/07/14 16:11:49 | 000,000,000 | -H-D | M] – C:\Program Files\InstallShield Installation Information
[2010/10/15 03:13:03 | 000,000,000 | —D | M] – C:\Program Files\Internet Explorer
[2010/05/04 18:50:27 | 000,000,000 | —D | M] – C:\Program Files\iPod
[2010/05/04 18:51:05 | 000,000,000 | —D | M] – C:\Program Files\iTunes
[2010/09/12 21:26:10 | 000,000,000 | —D | M] – C:\Program Files\iWonEI
[2010/01/18 20:38:20 | 000,000,000 | —D | M] – C:\Program Files\Java
[2009/09/13 18:29:15 | 000,000,000 | —D | M] – C:\Program Files\LimeWire
[2009/07/14 16:11:41 | 000,000,000 | —D | M] – C:\Program Files\Logitech
[2010/01/18 20:22:04 | 000,000,000 | —D | M] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/08/02 09:12:23 | 000,000,000 | —D | M] – C:\Program Files\McAfee
[2010/05/06 13:53:22 | 000,000,000 | —D | M] – C:\Program Files\McAfee Security Scan
[2010/08/13 03:29:11 | 000,000,000 | —D | M] – C:\Program Files\McAfee.com
[2009/06/30 12:15:16 | 000,000,000 | —D | M] – C:\Program Files\Microsoft
[2006/11/02 08:37:34 | 000,000,000 | —D | M] – C:\Program Files\Microsoft Games
[2010/01/18 21:54:04 | 000,000,000 | —D | M] – C:\Program Files\Microsoft Office
[2010/10/02 19:39:13 | 000,000,000 | —D | M] – C:\Program Files\Microsoft Silverlight
[2009/06/30 12:16:28 | 000,000,000 | —D | M] – C:\Program Files\Microsoft SQL Server Compact Edition
[2010/01/18 21:53:59 | 000,000,000 | —D | M] – C:\Program Files\Microsoft Visual Studio
[2010/08/13 03:10:30 | 000,000,000 | —D | M] – C:\Program Files\Microsoft Works
[2010/06/25 13:45:23 | 000,000,000 | —D | M] – C:\Program Files\Microsoft.NET
[2010/08/10 12:23:57 | 000,000,000 | —D | M] – C:\Program Files\mIRC
[2010/08/13 03:26:38 | 000,000,000 | —D | M] – C:\Program Files\Movie Maker
[2010/10/20 14:02:13 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox
[2006/11/02 08:37:34 | 000,000,000 | —D | M] – C:\Program Files\MSBuild
[2009/09/09 14:47:23 | 000,000,000 | —D | M] – C:\Program Files\MSECACHE
[2010/10/21 11:54:41 | 000,000,000 | —D | M] – C:\Program Files\MSN Toolbar
[2010/06/25 03:01:27 | 000,000,000 | —D | M] – C:\Program Files\MSXML 4.0
[2010/10/21 19:35:48 | 000,000,000 | —D | M] – C:\Program Files\Mystery Trackers - The Void Collector's Edition
[2010/08/14 18:28:15 | 000,000,000 | —D | M] – C:\Program Files\Mystic Diary - Haunted Island
[2010/09/02 20:50:28 | 000,000,000 | —D | M] – C:\Program Files\Nero
[2010/08/04 18:53:50 | 000,000,000 | —D | M] – C:\Program Files\Nightfall Mysteries - Asylum Conspiracy
[2010/09/24 16:44:48 | 000,000,000 | —D | M] – C:\Program Files\Nightmare Adventures - The Witch's Prison
[2010/09/28 16:20:03 | 000,000,000 | —D | M] – C:\Program Files\Notepad++
[2010/10/14 17:11:04 | 000,000,000 | —D | M] – C:\Program Files\Paltalk Messenger
[2010/04/22 22:19:34 | 000,000,000 | —D | M] – C:\Program Files\Panda Security
[2010/01/23 20:43:10 | 000,000,000 | —D | M] – C:\Program Files\PlayPond
[2010/03/21 21:03:44 | 000,000,000 | —D | M] – C:\Program Files\PlaySushi
[2010/04/02 20:16:53 | 000,000,000 | —D | M] – C:\Program Files\QuickTime
[2010/08/04 18:47:38 | 000,000,000 | —D | M] – C:\Program Files\RealArcade
[2010/10/10 19:06:18 | 000,000,000 | —D | M] – C:\Program Files\Redemption Cemetery - Curse of the Raven
[2010/08/11 20:04:01 | 000,000,000 | —D | M] – C:\Program Files\Redrum - Time Lies
[2006/11/02 08:37:34 | 000,000,000 | —D | M] – C:\Program Files\Reference Assemblies
[2009/08/12 14:58:43 | 000,000,000 | —D | M] – C:\Program Files\RegCleaner
[2010/06/08 19:36:16 | 000,000,000 | R–D | M] – C:\Program Files\Skype
[2009/12/21 20:56:12 | 000,000,000 | —D | M] – C:\Program Files\Snood 4
[2010/05/28 21:42:21 | 000,000,000 | —D | M] – C:\Program Files\Special Enquiry Detail - The Hand that Feeds
[2009/08/30 15:55:52 | 000,000,000 | —D | M] – C:\Program Files\SpellRead
[2009/08/10 19:14:24 | 000,000,000 | —D | M] – C:\Program Files\Strange Cases - The Tarot Card Mystery
[2010/10/19 00:07:58 | 000,000,000 | —D | M] – C:\Program Files\TabQuery
[2009/12/13 21:39:08 | 000,000,000 | —D | M] – C:\Program Files\ToggleEN
[2009/08/11 17:39:05 | 000,000,000 | —D | M] – C:\Program Files\Trend Micro
[2006/11/02 09:01:55 | 000,000,000 | -H-D | M] – C:\Program Files\Uninstall Information
[2010/09/23 15:32:53 | 000,000,000 | —D | M] – C:\Program Files\Vidalia Bundle
[2009/07/09 17:35:53 | 000,000,000 | —D | M] – C:\Program Files\Viewpoint
[2010/05/12 16:32:28 | 000,000,000 | —D | M] – C:\Program Files\WildGames
[2009/06/30 12:03:27 | 000,000,000 | —D | M] – C:\Program Files\WildTangent
[2009/10/12 09:25:59 | 000,000,000 | —D | M] – C:\Program Files\Windows Calendar
[2009/10/12 09:25:56 | 000,000,000 | —D | M] – C:\Program Files\Windows Collaboration
[2009/10/12 09:25:50 | 000,000,000 | —D | M] – C:\Program Files\Windows Defender
[2009/09/09 14:47:47 | 000,000,000 | —D | M] – C:\Program Files\Windows Installer Clean Up
[2009/10/12 09:25:56 | 000,000,000 | —D | M] – C:\Program Files\Windows Journal
[2010/10/21 12:00:24 | 000,000,000 | —D | M] – C:\Program Files\Windows Live
[2010/09/16 03:23:03 | 000,000,000 | —D | M] – C:\Program Files\Windows Mail
[2010/10/15 03:13:06 | 000,000,000 | —D | M] – C:\Program Files\Windows Media Player
[2006/11/02 08:37:34 | 000,000,000 | —D | M] – C:\Program Files\Windows NT
[2009/10/12 09:25:54 | 000,000,000 | —D | M] – C:\Program Files\Windows Photo Gallery
[2009/11/01 03:08:54 | 000,000,000 | —D | M] – C:\Program Files\Windows Portable Devices
[2009/10/12 09:25:57 | 000,000,000 | —D | M] – C:\Program Files\Windows Sidebar
[2010/05/23 09:50:44 | 000,000,000 | —D | M] – C:\Program Files\WinRAR
[2009/08/11 16:03:32 | 000,000,000 | —D | M] – C:\Program Files\WinZip
[2010/04/02 19:53:32 | 000,000,000 | —D | M] – C:\Program Files\Xilisoft
[2009/08/06 18:15:41 | 000,000,000 | —D | M] – C:\Program Files\Zylom Games

< %systemroot%\system32\*.tso >

< %ALLUSERSPROFILE%\Documents\Server\*.* >

< %systemroot%\*.pif >
[2006/09/18 17:43:58 | 000,000,707 | —- | M] () – C:\Windows\_default.pif

< %systemroot%\system32\n7533\*.* >

< %systemroot%\Us18336\*.* >

< %systemroot%\system32\*.zip >

< %systemroot%\system32\*.wgo >

< %systemroot%\system32\dllcache\*.com >

< %systemroot%\system32\dllchache\*.* >

< %systemroot%\system32\038840\*.* >

< %systemroot%\system32\13E92A\*.* >

< %systemroot%\system32\1CB5AD\*.* >

< %systemroot%\system32\52682A\*.* >

< %USERPROFILE%\My Documents\*.htm >

< %SYSTEMDRIVE%\Mr_CF\*.* >

< %USERPROFILE%\My Documents\*.dll >

< %USERPROFILE%\My Documents\*.ccc >

< %systemroot%\system32\Sis\*.* >

< %systemroot%\Microsft\*.* >

< %SYSTEMDRIVE%\driverwinx.exe\*.* >

< %systemroot%\BifroXx\*.* >

< %SYSTEMDRIVE%\TSTP\*.* >

< %systemroot%\winsn\*.* >

< %ProgramFiles%\windata\*.* >

< %SYSTEMDRIVE%\msixxxxxxx.exe\*.* >

< %systemroot%\system32\*.sao >

< %systemroot%\system32\*.iem >

< %systemroot%\system32\*.mdd >

< %systemroot%\system32\*.wlo >

< %systemroot%\system32\*.skn >

< %SYSTEMDRIVE%\Winup\*.* >

< %SYSTEMDRIVE%\test\*.* >

< %systemroot%\system32\med\*.* >

< %systemroot%\Bifrost\*.* >

< %systemroot%\system32\explorer.exe\*.* >

< %UserProfile%\UserData\*.dat /x >

< %SYSTEMDRIVE%\Arquivo de programas\*.* >

< %ProgramFiles%\tcpview\*.* >

< %systemroot%\system32\*.lyo >

< %ProgramFiles%\huanbang2\*.* >

< %systemroot%\winhuanbang\*.* >

< %systemroot%\minrsv.ini\*.* >

< %systemroot%\assembly\GAC\*.* >

< %AppData%\Adobe\crtmswin91\*.* >

< %ProgramFiles%\Windows NT\Accessories\*.exe >
[2010/06/28 10:54:38 | 000,339,968 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows NT\Accessories\wordpad.exe

< %systemroot%\system32\*.pdo >

< %SYSTEMDRIVE%\APPDATASH\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-10-21 16:08:30

========== Alternate Data Streams ==========

@Alternate Data Stream - 957 bytes -> C:\Users\patricia\Documents\Fw_Fwd_Fwd_Fw_FW_howtocallthepolicewhenyou'reold.eml:OECustomProperty
@Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:BD13A410
@Alternate Data Stream - 2421 bytes -> C:\Users\patricia\Documents\32709-Mizfour;[eDED]download;30018960.eml:OECustomProperty
@Alternate Data Stream - 237 bytes -> C:\ProgramData\TEMP:3D6B89CE
@Alternate Data Stream - 230 bytes -> C:\ProgramData\TEMP:B54E4B5A
@Alternate Data Stream - 227 bytes -> C:\ProgramData\TEMP:3086B95F
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:D3A89E47
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:68B61847
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:206470A5
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:FAB64002
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:5EF1AD34
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:A02025CE
@Alternate Data Stream - 198 bytes -> C:\ProgramData\TEMP:D31BE97C
@Alternate Data Stream - 197 bytes -> C:\ProgramData\TEMP:EEB25EAE
@Alternate Data Stream - 197 bytes -> C:\ProgramData\TEMP:5197985B
@Alternate Data Stream - 192 bytes -> C:\ProgramData\TEMP:3D36932D
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:517DBC32
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:A819A132
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:0EC7A545
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:B4F0E275
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:9E9A3410
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:526B3022
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:627153F1
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:1AC933DC
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:C7F08EA3
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:895A78C5
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:7FCB9D0D
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:C5CE2DF6
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:89C28CF6
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:737160C1
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:ED51D3ED
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:E6C6EB3B
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:5D432CE3
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:C9CDDE5E
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:71004506
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:98982C88
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:ED2998F5
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:FED25C29
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:E80802C7
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:A58B27C9
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:EC855C73
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:60EA2068
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:E91ADC66
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:7B2BB690
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:40D8F125
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:A4ACFB14

< End of report >

OTL Extras logfile created on: 10/22/2010 12:18:23 PM - Run 1
OTL by OldTimer - Version 3.2.16.0 Folder = C:\Users\patricia\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 65.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 217.81 Gb Total Space | 112.69 Gb Free Space | 51.74% Space Free | Partition Type: NTFS
Drive D: | 15.00 Gb Total Space | 14.91 Gb Free Space | 99.41% Space Free | Partition Type: NTFS

Computer Name: PATRICIA-PC | User Name: patricia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AntiVirusDisableNotify" =
"FirewallDisableNotify" =
"AntiVirusOverride" =
"FirewallOverride" =
"FirstRunDisabled" =
"UpdatesDisableNotify" =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0114ECFE-88ED-4749-8751-7F7C5CDEFEAC}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{082E7019-7219-423F-9654-9898FEC8C43B}" = rport=139 | protocol=6 | dir=out | app=system |
"{1268C4D7-EE30-451B-80DA-443CF385C6A5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{15F1B6EE-3BF5-4768-A85B-3D4FFBB881C4}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{17E0682B-D14C-4E4B-B6C8-8FBDE56B548A}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{23E9995B-3BEA-497E-BA29-83461BEA6152}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{2DBB556A-0BAA-4E1F-9F56-F9799D5F53E2}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{30C09B6E-D310-4B4F-B6D7-DEB6F8754E96}" = rport=10243 | protocol=6 | dir=out | app=system |
"{3FD92E82-1344-4BFC-B83F-11941A391256}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{4545FE12-CD2C-4E71-8A39-D81AEFF82872}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{588598A4-853F-4BA7-BBCA-A3F861EC3C6A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5A6A2E32-23DD-488F-923E-8528B2C3A725}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{5AF58B14-F6B6-4377-B627-3F031CFFEB30}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{5C36C575-A3E6-437C-ABB7-DA9E88EC5B2A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{67FCF424-D574-4154-B349-D48113A13F77}" = rport=2869 | protocol=6 | dir=out | app=system |
"{7037C5BD-259F-4C5A-97B8-E124E8DA29A9}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{74202CD4-594F-421C-AA70-0E9A5B436F50}" = rport=445 | protocol=6 | dir=out | app=system |
"{7518C16D-203D-4AB7-A7A0-6B540A1E3A3E}" = lport=138 | protocol=17 | dir=in | app=system |
"{75F6B489-42DC-44F4-8D7C-81126B9C78B4}" = rport=137 | protocol=17 | dir=out | app=system |
"{789341FE-1535-4CAF-96EA-0EE3F13AD1CD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{78ED03D3-D5D7-4CAB-8808-D8D27C8008C6}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{82C0608C-EBA8-4010-9073-0936FB07F3FE}" = lport=137 | protocol=17 | dir=in | app=system |
"{8300CF1E-5092-4C14-8B69-3762955FA2EB}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{8E8AF9CF-506F-47F4-A29B-31A62DD3490E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{93BF271F-B19C-4D13-9F26-128357907E12}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{98219C7E-179F-43D4-A3C5-1D5ABC17D6A2}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{A041D472-C2C8-4685-B956-6AB146437D20}" = rport=138 | protocol=17 | dir=out | app=system |
"{A4867394-CF72-4411-B1A8-B18BA3AD64A6}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{A99237C8-B9E2-458D-8F9B-8C66FF139F59}" = lport=445 | protocol=6 | dir=in | app=system |
"{CB1024E4-727F-43E3-980E-6C6F742070B7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CECDC46D-2D0A-4255-AD9D-7A4EC7A25375}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D1399DB2-68B4-4236-B64A-E203CDC703ED}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D3A2C7AD-83B0-459D-90B6-7B1B1494C587}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D9AA408C-B8F8-441E-9047-200ADDE069EB}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DDDF7895-BA5A-4D9B-BF8C-FE704350E63C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E3B3116B-B164-463F-8121-060D291DF4FF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{E8EA3EFD-CE84-41B6-AD56-9AF5A0E76E2C}" = lport=2869 | protocol=6 | dir=in | app=system |
"{F39DC77B-A509-4310-9503-36723154AF6F}" = lport=139 | protocol=6 | dir=in | app=system |
"{FBA5E69A-5DF6-4C1A-8188-CC495A4849E1}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{FE3DC614-CFE0-4978-A6C9-2F10502BC71C}" = lport=10243 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0000D566-A5C2-411F-8F1E-8F7BE7663561}" = protocol=17 | dir=in | app=c:\program files\aol 9.1\waol.exe |
"{0580A9E7-8750-4C75-AC7D-73D47B2AB2C1}" = protocol=6 | dir=in | app=c:\program files\dogpile toolbar\troubleshooter.exe |
"{0C4FC8F9-2563-41F4-9B30-DD918226B60B}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{166981A2-DCF9-4643-855E-5AA02B6658A8}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{18C9FA2A-E333-436D-B158-4C7B79948C31}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{18F8572A-D7DC-4260-AB52-1B90455C2389}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{1AD84E2A-F2CD-4D78-88C5-A950F6A489F6}" = protocol=17 | dir=in | app=c:\program files\common files\aol\1247175231\ee\aolsoftware.exe |
"{1FB61DB5-14EA-4CBA-A2D1-DDF228DEB011}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{22740BC9-AFE1-418C-B1C8-0255E712ADDC}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{25686483-7285-4C67-84C9-9EEEF042525B}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{26BE4F13-C653-4D94-8833-A923988A7087}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{345FF411-34DA-4729-987C-34253BC7CD83}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{39239684-E90E-4521-B573-A79585C656BE}" = protocol=6 | dir=out | app=system |
"{3DA0A23E-AC45-4A4C-BAE5-A9640366B3D2}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{431BBFF6-F38D-410B-8960-7F0F59FF3192}" = protocol=6 | dir=in | app=c:\program files\dogpile toolbar\toolbarupdate.exe |
"{491674AE-AA69-48C1-8967-2BA3C1AF57F5}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{4AE82622-7092-4CAE-9020-BA040A8B4ED4}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4FB1598D-D1E9-4206-A85C-DDAE8AECCAF0}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{524B8F2A-F1A6-4B16-ACA3-F044AEEACA09}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{53B77009-1B7F-4042-AE8C-C36C54FC6D0B}" = protocol=17 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe |
"{55F3634B-EB41-4C48-9B88-B9A035344879}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{5A1C1231-70DD-4FD9-B30B-332C8612F82A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{5B595263-0320-487D-A7BB-0A07C0DE0AA6}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{5B912EBF-4A2C-48C6-88AE-E5718FFF4B93}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{658A1FF3-B442-4EE0-94AC-F4F593A80546}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{6D3EB0C1-27EB-45F9-98C8-B33105A64A5D}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{7143047E-C044-4699-8800-C20CD6954386}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{75F8A714-2C0E-41B1-821E-2DF74C2905A4}" = protocol=6 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe |
"{767F081D-284D-4697-B783-545C7C38D169}" = protocol=6 | dir=in | app=c:\program files\aol 9.1\waol.exe |
"{7FCFE5A3-A006-4310-A473-69308A357BF8}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{813F70DB-717F-4282-BFCE-04ABFC1FCA4F}" = protocol=6 | dir=in | app=c:\program files\common files\aol\1247175231\ee\aolsoftware.exe |
"{818E4265-8BB8-4AC2-B2E0-69B5559993EE}" = protocol=17 | dir=in | app=c:\program files\dogpile toolbar\troubleshooter.exe |
"{83D40F2B-614C-4B83-B3C3-58E64DEE0E92}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{86D8A298-2B3F-47A1-AA68-DD0729577BC9}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{87C8A4BD-DEA1-43DB-BFE8-9A41C3D520E9}" = dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{89C8A3F4-0529-4027-826E-5C403551C3D5}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{901D5C72-6910-4331-A2EE-81B28D647811}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\pdvddxsrv.exe |
"{943B0BF2-E93B-4C71-86D3-7E6C3A1ED5B2}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{9F6D3715-D679-4CE5-B35A-57C53B396186}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A1ED1D60-9DF3-4122-9FE6-B187B0F6C484}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{A33A0B70-344E-4FAC-A863-0216496A9061}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{A412AA82-226E-404E-908C-6B6857A200A2}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\powerdvd.exe |
"{ADEFD7B6-FF1E-4E3E-BE14-4578FA967018}" = protocol=17 | dir=in | app=c:\program files\dogpile toolbar\toolbarupdate.exe |
"{B3AFBF8D-5EE4-4EAE-A2D1-743F396C115E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B47A7218-ECBD-487E-AAA6-563DA7E7BC32}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{B5DD87F7-898B-4813-9BBD-2AE3710E55B3}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C7611845-E425-49AA-9DEC-6CB96CEB17E0}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{C80C1F27-DF52-484D-A5A7-6E41828CA3E0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CCC6928F-087B-4E99-AB93-B12A48798882}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{CFA32FAC-7E74-44ED-89EC-2C98FB32F79F}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{DA826795-BFB2-4820-8A3E-D89D6A78A06F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{DD48B2D1-59DA-4D5B-AFC3-DF1AB6FC331E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DD49A77A-39A0-4611-A279-7CA8EF6B3FFC}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{E267CB99-EED9-4FA0-A782-1900AA55C7E0}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{E7F391FA-C2DA-4BAC-A7B7-BF4E84B2CC2C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{EB5CE462-FF28-4C76-93A4-37DD0F5FA947}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{EE12E96E-0E6D-4A55-8F7C-02AF0E18AE90}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{F008D351-B43D-42AD-A3F1-06DA5487D22F}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{F56614AC-7FE7-4102-B197-763E96BDBE73}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{0537D3F9-7F3A-4A21-AB0E-076A2E2A67DC}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{11577FF1-44A9-4347-BC97-052BEAB3F259}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=6 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
"TCP Query User{3985B8FD-2A78-4CC5-9B05-20058DAF7568}C:\program files\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files\mirc\mirc.exe |
"TCP Query User{66876DAE-DF08-4E0B-BB20-75D8CF213E5D}C:\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"TCP Query User{6E4C043F-5087-43BA-9DA0-B89E08348125}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{C5163E26-A370-4420-9977-F749BD15A278}C:\program files\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files\mirc\mirc.exe |
"TCP Query User{ECDE436C-60C6-4669-BF4C-A7D8972DA683}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{0436DD74-0D57-461C-A636-B069F5D907F2}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{15E5FE34-EDBB-4D74-BF1F-A2183F0E057F}C:\program files\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files\mirc\mirc.exe |
"UDP Query User{76220FEE-756F-48BF-9AE1-CD888DFAF986}C:\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"UDP Query User{8D36EED2-7E84-4199-A416-E7245B7CA6CA}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{9A99ED54-5C27-4FCC-B6D3-CC65AED10B4F}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{B0651297-E071-425B-9240-E1591C7118C1}C:\program files\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files\mirc\mirc.exe |
"UDP Query User{ED36FD34-BD48-4389-97EC-F924130736AC}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=17 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{053C30EA-D4C6-47A0-8537-8D231D9BE873}" = DELL0703
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar
"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)
"{0904ED3B-0FCD-A153-2F80-F7F5AB0329BA}" = Catalyst Control Center Graphics Previews Vista
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup
"{0F090069-6450-9559-72BD-2437FF935EEC}" = CCC Help Swedish
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{13766F76-6C8C-4E57-A9F3-3212D1C6E0D1}" = Dell DataSafe Online
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM)
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback 10
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 17
"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{294BF709-D758-4363-8D75-01479AD20927}" = Windows Live Family Safety
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{3138EAD3-700B-4A10-B617-B3F8096EE30D}" = Dell Edoc Viewer
"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)
"{34386C65-FD55-CEBD-AF7F-5126751BAA98}" = Catalyst Control Center InstallProxy
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3643D422-9AFF-81D6-252C-14A8A3AD88D3}" = CCC Help Korean
"{3889CA7B-A8FC-09CB-C6D4-B134A2336DD9}" = CCC Help Portuguese
"{394B918B-47B0-D281-6AB8-E58871B54C91}" = Catalyst Control Center Core Implementation
"{3B7E26A8-4B67-D878-3AE3-0079686C52B6}" = CCC Help Spanish
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{415B2719-AD3A-4944-B404-C472DB6085B3}" = Cisco EAP-FAST Module
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{51B6CDCD-8802-B41A-61E4-FC6A65FF217B}" = CCC Help French
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{531DDC1D-6563-8796-764A-A9C4E83C23E0}" = CCC Help English
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{56F4CA69-B3BC-81E6-304A-E650F3BB93A8}" = Catalyst Control Center Graphics Previews Common
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F548A02-80BC-404D-BAE6-F05F9BF6B449}" = Nero DiscCopyGadget 10 Help (CHM)
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{61D9B6B3-B72E-C642-F0B0-8659EADB4CAA}" = Skins
"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic
"{65C0025A-2CDE-43C5-82D0-C7A56EF0DB39}" = Bing Bar Platform
"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)
"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{6FB141D8-1543-6588-623A-7D95969CB330}" = Catalyst Control Center Localization All
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{791A4569-E893-CA1F-664D-1DE63A5600A1}" = ccc-utility
"{797EE0CA-8165-405C-B5CE-F11EC20F1BB0}" = Microsoft VC9 runtime libraries
"{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM)
"{7C0AEF0E-BB23-5C44-4933-88F6AE1057D8}" = Catalyst Control Center Graphics Full New
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{80052E79-4A36-69BA-F44F-882A2E321116}" = CCC Help German
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{87460EB7-E62D-C963-4DDB-D2146478F59F}" = CCC Help Finnish
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour
"{8BD8412A-40FB-9114-A8AE-CFB94C24C078}" = CCC Help Norwegian
"{8C2522F0-8B10-139C-3379-3620EA6A254D}" = CCC Help Dutch
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}" = Nero Recode 10
"{8FCE7358-DA6B-789A-44AB-E52256ACB330}" = CCC Help Chinese Traditional
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{92EC1A84-7FFC-42DF-A8F6-79C21C4765A5}" = Nero DiscCopy Gadget 10
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-007A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{958DF0E4-CC0D-BDD5-28D1-A1B961E48A85}" = ccc-core-static
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10
"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A8E83877-671C-A1A3-F4D3-C3D74E5AE8B9}" = CCC Help Chinese Standard
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0
"{ADB4809A-3857-F18D-153F-391EB1D37C59}" = Catalyst Control Center Graphics Full Existing
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B354E49B-DBDC-442D-5615-BD07B3A0B932}" = Catalyst Control Center Graphics Light
"{B787CD67-506B-4C9A-8A99-D2C4460D055F}" = Catalyst Control Center - Branding
"{B935C985-A17F-484B-8470-09E4FC27DC26}" = Dell-eBay
"{B96C8D6D-B0E5-CD7B-BC5D-739D5051E911}" = CCC Help Japanese
"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)
"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)
"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C4972073-2BFE-475D-8441-564EA97DA161}" = QuickSet
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CB72877A-D2BF-6F18-2D0A-52C4036E2DF6}" = CCC Help Russian
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B7}" = WinZip 12.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D809E781-A654-3530-2B92-91FF959C507A}" = CCC Help Danish
"{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM)
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}" = Nero SoundTrax 10
"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}" = Adobe Flash Player 10 Plugin
"{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F31D838B-E7F3-1E70-F54F-B009CD9219EE}" = CCC Help Italian
"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10
"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F6BB6248-C507-46FE-8A35-1B16F35E0441}" = ITECIR
"{F6CB42B9-F033-4152-8813-FF11DA8E6A78}" = Dell Dock
"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"AOL Emergency Connect Utility 1.0" = Uninstall AOL Emergency Connect Utility 1.0
"AOL Uninstaller" = AOL Uninstaller (Choose which Products to Remove)
"AV Voice Changer Software DIAMOND 6.0" = AV Voice Changer Software DIAMOND 6.0
"BFG-Awakening - The Dreamless Castle" = Awakening: The Dreamless Castle
"BFGC" = Big Fish Games: Game Manager
"BFG-Escape the Lost Kingdom" = Escape the Lost Kingdom
"BFG-Mystery Trackers - The Void Collector's Edition" = Mystery Trackers: The Void Collector's Edition
"BFG-Mystic Diary - Haunted Island" = Mystic Diary: Haunted Island
"BFG-Nightfall Mysteries - Asylum Conspiracy" = Nightfall Mysteries: Asylum Conspiracy
"BFG-Nightmare Adventures - The Witch's Prison" = Nightmare Adventures: The Witch's Prison
"BFG-Redemption Cemetery - Curse of the Raven" = Redemption Cemetery: Curse of the Raven
"BFG-Redrum - Time Lies" = Redrum: Time Lies
"BFG-Special Enquiry Detail - The Hand that Feeds" = Special Enquiry Detail: The Hand that Feeds
"BFG-Strange Cases - The Tarot Card Mystery" = Strange Cases: The Tarot Card Mystery
"Broadcom 802.11 Application" = Dell Wireless WLAN Card Utility
"CCleaner" = CCleaner
"CleanUp!" = CleanUp!
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Creative OA001" = Integrated Webcam Driver (1.06.03.0309)
"Dell Video Chat" = Dell Video Chat
"Dell Webcam Central" = Dell Webcam Central
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX Setup
"Dogpile Toolbar" = Dogpile Toolbar
"DVDFab 8_is1" = DVDFab 8.0.0.5 (25/08/2010)
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ESET Online Scanner" = ESET Online Scanner v3
"GameHouse" = GameHouse
"Google Chrome" = Google Chrome
"GoToAssist" = GoToAssist 8.0.0.514
"LimeWire" = LimeWire PRO 5.1.2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"mIRC" = mIRC
"Mozilla Firefox (3.6.11)" = Mozilla Firefox (3.6.11)
"MSC" = McAfee SecurityCenter
"Notepad++" = Notepad++
"PalTalk8.2" = PaltalkScene
"Playsushi" = Playsushi
"Polipo" = Polipo [removed]
"Snood 4_is1" = Snood 4
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"SpellRead P.A.T ® Builder Exercise" = SpellRead P.A.T ® Builder Exercise
"ToggleEN Toolbar" = ToggleEN Toolbar
"Tor" = Tor 0.2.1.26
"Vidalia" = Vidalia 0.2.10
"ViewpointMediaPlayer" = Viewpoint Media Player
"Web Games Player Plugin" = Web Games Player Plugin
"WildTangent dell Master Uninstall" = WildTangent Games
"WildTangent wildgames Master Uninstall" = WildTangent Games
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WT079614" = Zuma's Revenge
"WT087308" = Cradle of Rome
"Xilisoft iPhone Ringtone Maker" = Xilisoft iPhone Ringtone Maker

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Adobe Acrobat Connect Add-in" = Adobe Acrobat Connect Add-in
"BitTorrent" = BitTorrent
"Move Media Player" = Move Media Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 10/12/2010 6:07:03 PM | Computer Name = patricia-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2137

Error - 10/12/2010 6:07:03 PM | Computer Name = patricia-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2137

Error - 10/12/2010 6:07:04 PM | Computer Name = patricia-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 10/12/2010 6:07:04 PM | Computer Name = patricia-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4009

Error - 10/12/2010 6:07:04 PM | Computer Name = patricia-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4009

Error - 10/12/2010 7:09:43 PM | Computer Name = patricia-PC | Source = Application Hang | ID = 1002
Description = The program waol.exe version 9.5.0.1 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Problem Reports and Solutions control panel. Process
ID: 1f94 Start Time: 01cb6a6249e0f550 Termination Time: 10

Error - 10/12/2010 7:13:58 PM | Computer Name = patricia-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/12/2010 10:10:33 PM | Computer Name = patricia-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 10/12/2010 10:10:33 PM | Computer Name = patricia-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1139

Error - 10/12/2010 10:10:33 PM | Computer Name = patricia-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1139

[ Media Center Events ]
Error - 10/7/2009 4:22:36 PM | Computer Name = patricia-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 10/31/2009 5:46:49 PM | Computer Name = patricia-PC | Source = MCUpdate | ID = 0
Description = Failed to wait on MCUpdate mutex with exception: 'The wait completed
due to an abandoned mutex.'.

Error - 1/30/2010 5:46:05 PM | Computer Name = patricia-PC | Source = MCUpdate | ID = 0
Description = Failed to wait on MCUpdate mutex with exception: 'The wait completed
due to an abandoned mutex.'.

[ System Events ]
Error - 10/22/2010 12:22:16 PM | Computer Name = patricia-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 10/22/2010 12:22:16 PM | Computer Name = patricia-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 10/22/2010 12:22:16 PM | Computer Name = patricia-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 10/22/2010 12:22:16 PM | Computer Name = patricia-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 10/22/2010 12:22:16 PM | Computer Name = patricia-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 10/22/2010 12:22:16 PM | Computer Name = patricia-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 10/22/2010 12:22:16 PM | Computer Name = patricia-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 10/22/2010 12:22:16 PM | Computer Name = patricia-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 10/22/2010 12:22:16 PM | Computer Name = patricia-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 10/22/2010 12:22:16 PM | Computer Name = patricia-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

< End of report >

Malwarebytes' Anti-Malware 1.44
Database version: 3596
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18975

10/22/2010 11:10:45 AM
mbam-log-2010-10-22 (11-10-36).txt

Scan type: Quick Scan
Objects scanned: 103405
Time elapsed: 6 minute(s), 28 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
C:\Users\patricia\AppData\Roaming\Microsoft\svchost.exe (Backdoor.Bot) -> No action taken.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost (Backdoor.Bot) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\patricia\AppData\Roaming\Microsoft\svchost.exe (Backdoor.Bot) -> No action taken.

Attachments:

📎Gmer.txt

Conspire

Post #5October 23, 2010, 10:14 AM UTC

Hi,

ComboFix should not be run unless requested by a Malware Team member. It is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert", NOT for private use. Please read Combofix's Disclaimer. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.

Delete the Combofix copy(if any) and download a new one.

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

AnthonySzum

Post #6October 24, 2010, 2:08 AM UTC

I have come into a couple of problems after running combofix.
After it ran and my computer rebooted, everything I tried to open including IE and firefox and AOL gave me an error saying " Illegal operation attempted on a registry key that has been marked for deletion"
I had to restart the computer manually and everything seemed to start working again. I fould that rather odd.
Another problem is Firefox won't connect to the internet now. It says " Problem loading page. The proxy is refusing connections"

Also, what is so dangerous about running firefox to do what it just did and delete files?

Anyway, here is the log:

ComboFix 10-10-22.05 - patricia 10/23/2010 21:32:54.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3066.1793 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\PlaySushi\PSTExt.dll
c:\users\patricia\AppData\Roaming\inst.exe
c:\users\patricia\AppData\Roaming\Microsoft\stor.cfg
c:\users\patricia\AppData\Roaming\Microsoft\svchost.exe
c:\users\patricia\AppData\Roaming\Microsoft\Windows\shell.exe
c:\users\patricia\Desktop\Internet Explorer.lnk
c:\users\patricia\GoToAssistDownloadHelper.exe
c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf
c:\windows\system32\drivers\xwxk.sys
C:\zip.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_MyWebSearchService
——-\Service_jsyxxkm

((((((((((((((((((((((((( Files Created from 2010-09-24 to 2010-10-24 )))))))))))))))))))))))))))))))
.

2010-10-24 01:41 . 2010-10-24 01:46 ——– d—–w- c:\users\patricia\AppData\Local\temp
2010-10-24 01:41 . 2010-10-24 01:41 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-10-24 01:41 . 2010-10-24 01:41 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-10-21 23:36 . 2010-10-21 23:36 ——– d—–w- c:\users\patricia\AppData\Roaming\Elephant Games
2010-10-21 23:36 . 2010-10-21 23:36 ——– d—–w- c:\programdata\Elephant Games
2010-10-21 23:35 . 2010-10-21 23:35 ——– d—–w- c:\program files\Mystery Trackers - The Void Collector's Edition
2010-10-21 16:00 . 2010-10-21 16:00 ——– d—–w- c:\windows\en
2010-10-21 15:59 . 2010-09-23 04:21 39272 —-a-w- c:\windows\system32\drivers\fssfltr.sys
2010-10-21 15:54 . 2010-10-21 15:54 ——– d—–w- c:\program files\MSN Toolbar
2010-10-21 15:54 . 2010-10-21 15:55 ——– d—–w- c:\program files\Bing Bar Installer
2010-10-21 15:54 . 2009-09-04 21:44 69464 —-a-w- c:\windows\system32\XAPOFX1_3.dll
2010-10-21 15:54 . 2009-09-04 21:44 515416 —-a-w- c:\windows\system32\XAudio2_5.dll
2010-10-21 15:54 . 2009-09-04 21:29 453456 —-a-w- c:\windows\system32\d3dx10_42.dll
2010-10-21 15:38 . 2010-10-21 15:38 469256 —-a-w- c:\program files\Common Files\Windows Live\.cache\4a732301cb71362b\InstallManager_WLE_WLE.exe
2010-10-21 15:38 . 2010-10-21 15:38 15712 —-a-w- c:\program files\Common Files\Windows Live\.cache\f12b8e401cb71351f\MeshBetaRemover.exe
2010-10-21 15:37 . 2010-10-21 15:37 94040 —-a-w- c:\program files\Common Files\Windows Live\.cache\dc5deee01cb713518\DSETUP.dll
2010-10-21 15:37 . 2010-10-21 15:37 525656 —-a-w- c:\program files\Common Files\Windows Live\.cache\dc5deee01cb713518\DXSETUP.exe
2010-10-21 15:37 . 2010-10-21 15:37 1691480 —-a-w- c:\program files\Common Files\Windows Live\.cache\dc5deee01cb713518\dsetup32.dll
2010-10-21 15:37 . 2010-10-21 15:37 94040 —-a-w- c:\program files\Common Files\Windows Live\.cache\d96d10801cb713517\DSETUP.dll
2010-10-21 15:37 . 2010-10-21 15:37 525656 —-a-w- c:\program files\Common Files\Windows Live\.cache\d96d10801cb713517\DXSETUP.exe
2010-10-21 15:37 . 2010-10-21 15:37 1691480 —-a-w- c:\program files\Common Files\Windows Live\.cache\d96d10801cb713517\dsetup32.dll
2010-10-21 15:35 . 2010-10-22 20:18 ——– d—–w- c:\users\patricia\AppData\Local\Windows Live
2010-10-21 15:34 . 2009-08-04 08:02 754688 —-a-w- c:\windows\system32\webservices.dll
2010-10-19 14:58 . 2009-10-09 21:56 2048 —-a-w- c:\windows\system32\winrsmgr.dll
2010-10-19 14:58 . 2009-10-09 21:56 12800 —-a-w- c:\windows\system32\wsmprovhost.exe
2010-10-19 14:58 . 2009-10-09 21:56 20480 —-a-w- c:\windows\system32\winrshost.exe
2010-10-19 14:58 . 2009-10-09 21:56 40448 —-a-w- c:\windows\system32\winrs.exe
2010-10-19 14:58 . 2009-10-09 21:56 10240 —-a-w- c:\windows\system32\wsmplpxy.dll
2010-10-19 14:58 . 2009-10-09 21:56 10240 —-a-w- c:\windows\system32\winrssrv.dll
2010-10-14 21:10 . 2010-10-14 21:11 ——– d—–w- c:\program files\Paltalk Messenger
2010-10-14 20:52 . 2010-09-13 13:56 8147456 —-a-w- c:\windows\system32\wmploc.DLL
2010-10-14 20:52 . 2010-09-13 13:56 168960 —-a-w- c:\program files\Windows Media Player\wmplayer.exe
2010-10-14 20:51 . 2010-09-06 16:20 125952 —-a-w- c:\windows\system32\srvsvc.dll
2010-10-14 20:51 . 2010-09-06 16:19 17920 —-a-w- c:\windows\system32\netevent.dll
2010-10-14 20:51 . 2010-09-06 13:45 304128 —-a-w- c:\windows\system32\drivers\srv.sys
2010-10-14 20:51 . 2010-09-06 13:45 145408 —-a-w- c:\windows\system32\drivers\srv2.sys
2010-10-14 20:51 . 2010-09-06 13:45 102400 —-a-w- c:\windows\system32\drivers\srvnet.sys
2010-10-10 23:04 . 2010-10-10 23:06 ——– d—–w- c:\program files\Redemption Cemetery - Curse of the Raven
2010-10-08 17:01 . 2010-10-08 17:01 ——– d—–w- c:\program files\Common Files\Adobe
2010-10-05 07:11 . 2010-10-20 01:53 ——– d—–w- c:\users\patricia\AppData\Roaming\Paltalk
2010-09-28 22:23 . 2010-06-22 13:30 2048 —-a-w- c:\windows\system32\tzres.dll
2010-09-28 22:23 . 2010-08-26 04:23 13312 —-a-w- c:\program files\Internet Explorer\iecompat.dll
2010-09-28 20:20 . 2010-09-28 20:20 ——– d—–w- c:\users\patricia\AppData\Roaming\Notepad++
2010-09-28 20:20 . 2010-09-28 20:20 ——– d—–w- c:\program files\Notepad++
2010-09-24 22:31 . 2010-09-24 22:31 ——– d—–w- c:\users\patricia\AppData\Roaming\Ghost Ship Studios
2010-09-24 20:43 . 2010-09-24 20:44 ——– d—–w- c:\program files\Nightmare Adventures - The Witch's Prison

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-23 04:47 . 2010-09-23 04:47 49016 —-a-w- c:\windows\system32\sirenacm.dll
2010-09-23 04:32 . 2010-09-23 04:32 301936 —-a-w- c:\windows\WLXPGSS.SCR
2010-09-03 00:22 . 2010-09-03 00:22 47360 —-a-w- c:\users\patricia\AppData\Roaming\pcouffin.sys
2010-08-24 18:57 . 2010-08-01 23:53 9344 —-a-w- c:\windows\system32\drivers\mfeclnk.sys
2010-08-24 18:57 . 2010-08-01 23:53 164808 —-a-w- c:\windows\system32\drivers\mfewfpk.sys
2010-08-24 18:57 . 2010-08-01 23:53 95600 —-a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-08-24 18:57 . 2010-08-01 23:53 84264 —-a-w- c:\windows\system32\drivers\mferkdet.sys
2010-08-24 18:57 . 2010-08-01 23:53 64304 —-a-w- c:\windows\system32\drivers\mfenlfk.sys
2010-08-24 18:57 . 2010-08-01 23:53 55840 —-a-w- c:\windows\system32\drivers\cfwids.sys
2010-08-24 18:57 . 2010-08-01 23:53 312904 —-a-w- c:\windows\system32\drivers\mfefirek.sys
2010-08-24 18:57 . 2009-06-30 16:37 52104 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2010-08-24 18:57 . 2009-06-30 16:37 386712 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2010-08-24 18:57 . 2009-06-30 16:37 152992 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-08-17 14:11 . 2010-09-15 17:28 128000 —-a-w- c:\windows\system32\spoolsv.exe
2010-07-26 12:15 . 2010-07-26 12:15 690952 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-08-24 18:57 . 2010-08-01 23:53 24376 —-a-w- c:\program files\mozilla firefox\components\Scriptff.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
2009-07-02 15:18 2215960 —-a-w- c:\program files\ToggleEN\tbTogg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{399C60D2-38B1-4E25-B9E7-6498C1BC2DCD}]
2009-05-26 15:41 1297920 —-a-w- c:\program files\Dogpile Toolbar\Toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{038cb5c7-48ea-4af9-94e0-a1646542e62b}"= "c:\program files\ToggleEN\tbTogg.dll" [2009-07-02 2215960]
"{C53FE659-316A-4F56-A194-A5BE491BE866}"= "c:\program files\Dogpile Toolbar\Toolbar.dll" [2009-05-26 1297920]

[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]

[HKEY_CLASSES_ROOT\clsid\{c53fe659-316a-4f56-a194-a5be491be866}]
[HKEY_CLASSES_ROOT\FCTB000060231.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{587A2AD9-5F47-4029-8123-77327768C9F3}]
[HKEY_CLASSES_ROOT\FCTB000060231.IEToolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{038CB5C7-48EA-4AF9-94E0-A1646542E62B}"= "c:\program files\ToggleEN\tbTogg.dll" [2009-07-02 2215960]
"{C53FE659-316A-4F56-A194-A5BE491BE866}"= "c:\program files\Dogpile Toolbar\Toolbar.dll" [2009-05-26 1297920]

[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]

[HKEY_CLASSES_ROOT\clsid\{c53fe659-316a-4f56-a194-a5be491be866}]
[HKEY_CLASSES_ROOT\FCTB000060231.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{587A2AD9-5F47-4029-8123-77327768C9F3}]
[HKEY_CLASSES_ROOT\FCTB000060231.IEToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-09-23 4240760]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-07-31 39408]
"Vidalia"="c:\program files\Vidalia Bundle\Vidalia\vidalia.exe" [2010-08-23 5636136]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"AOL Fast Start"="c:\program files\AOL 9.1\AOL.EXE" [2008-11-06 50472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-04-27 233472]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-12-22 3810304]
"Dell DataSafe Online"="c:\program files\Dell DataSafe Online\DataSafeOnline.exe" [2009-11-13 1807600]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-01-09 405639]
"HostManager"="c:\program files\Common Files\AOL\1247175231\ee\AOLSoftware.exe" [2008-06-24 41824]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-06-03 206064]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-12-19 76304]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-30 483428]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]
"NBAgent"="c:\program files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2010-04-03 1234216]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-06-25 1193848]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-08-20 1164584]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-07 1394000]

c:\users\patricia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote Table Of Contents.onetoc2 [2009-8-12 3656]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-7-14 809488]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-7-31 1616976]

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-2-27 1316192]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2009-06-30 15:58 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\SPYWAR~1\sp_rsdel.exe \??\c:\progra~2\SPYWAR~1\sp_rsdel.dat

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^patricia^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\patricia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 03:07 932288 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 08:47 35760 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
2009-02-05 02:26 128232 ——w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-02-14 02:31 61440 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 09:17 149280 —-a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25 202240 —-a-w- c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=""
"FirewallOverride"=""

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-08-06 133104]
R2 gupdate1ca16e365ac7a30;Google Update Service (gupdate1ca16e365ac7a30);c:\program files\Google\Update\GoogleUpdate.exe [2009-08-06 133104]
R2 TabQuery Service;TabQuery Service;c:\programdata\TabQuery\tabquery119.exe [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-08-24 84264]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2010-03-16 17408]
R3 PCD5SRVC{3F6A8B78-EC003E00-05040104};PCD5SRVC{3F6A8B78-EC003E00-05040104} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms [2008-11-04 22904]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2010-08-24 64304]
S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-08-24 164808]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe [2009-03-30 81920]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-03-10 271480]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2010-08-24 188136]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2010-08-24 141792]
S2 SftService;SoftThinks Agent Service;c:\program files\Dell DataSafe Local Backup\sftservice.EXE [2009-04-17 636144]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-08-24 55840]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2008-12-31 144128]
S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [2010-03-08 62496]
S3 k57nd60x;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2008-08-25 203264]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-08-24 312904]
S3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\DRIVERS\OA001Ufd.sys [2009-03-06 133632]
S3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\DRIVERS\OA001Vid.sys [2009-03-08 280096]

— Other Services/Drivers In Memory —

*Deregistered* - mfeavfk01

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-10-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-06 22:15]

2010-10-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-06 22:15]

2010-10-24 c:\windows\Tasks\User_Feed_Synchronization-{3665EB40-7FE9-4CC9-A94B-EAE9FD7003FC}.job
- c:\windows\system32\msfeedssync.exe [2010-10-14 04:25]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://www.mirarsearch.com/?useie5=1&q=
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:50370
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\Windows Live\Companion\companioncore.dll
TCP: {F965D7B6-EFF4-4CD4-8472-5F7A994A99A5} = 205.188.146.145
FF - ProfilePath - c:\users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 50370
FF - prefs.js: network.proxy.type - 1
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - component: c:\users\patricia\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\PlaySushiFF.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\iWonEI\Installr\1.bin\NPjfEISb.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\programdata\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\users\patricia\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

AddRemove-PalTalk8.2 - c:\windows\PaltalkScene\uninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-23 21:46
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCD5SRVC{3F6A8B78-EC003E00-05040104}]
"ImagePath"="\??\c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'Explorer.exe'(5400)
c:\program files\Logitech\SetPoint\lgscroll.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\STacSV.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\system32\WLANExt.exe
c:\windows\System32\bcmwltry.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Common Files\McAfee\SystemCore\mcshield.exe
c:\program files\Common Files\McAfee\SystemCore\mfefire.exe
c:\program files\DellTPad\ApMsgFwd.exe
c:\program files\DellTPad\HidFind.exe
c:\program files\DellTPad\Apntex.exe
c:\windows\ehome\ehmsas.exe
c:\program files\AOL 9.1\waol.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\AOL 9.1\shellmon.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Completion time: 2010-10-23 21:53:06 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-24 01:52
ComboFix2.txt 2009-09-10 22:01
ComboFix3.txt 2009-09-10 19:26

Pre-Run: 119,318,749,184 bytes free
Post-Run: 119,120,846,848 bytes free

- - End Of File - - 3A97F246E2CD8E0CD645F963728F67B3

Conspire

Post #7October 24, 2010, 9:01 AM UTC

Hello there,

Also, what is so dangerous about running firefox to do what it just did and delete files?

Your FF wouldn't connect is due to the changes made in your registry during the fix and a proxy connection has been unknowingly set by a trojan backdoor to gain access to your computer which leads to a redirect.

***Read through this entire procedure and if you have any questions, please ask them before you begin. Then either print out, or copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. Do take note that if you could not run any tools requested, carry on with the next instruction(if any) and let us know.

Please follow all previous instructions regarding security programs.

Backing Up Your Registry

Go HERE and download ERUNT
(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)
Install ERUNT by following the prompts
(use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)
Start ERUNT
(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)
Choose a location for the backup
(the default location is C:\WINDOWS\ERDNT which is acceptable).
Make sure that at least the first two check boxes are ticked
Press OK
Press YES to create the folder.

For detailed instruction on how to back-up registry via ERUNT, please visit HERE

===================================================

Open a new Notepad session

Click the Start button, click run
in the run box type notepad
click ok
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

http://forums.whatthetech.com/index.php?s=&showtopic=115153&view=findpost&p=690455

Collect::
C:\Users\patricia\AppData\Local\temp\dwm.exe

DDS::
mSearch Bar = hxxp://www.mirarsearch.com/?useie5=1&q=
uInternet Settings,ProxyServer = http=127.0.0.1:50370

Firefox::
FF - ProfilePath - c:\users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 50370
FF - prefs.js: network.proxy.type - 1
FF - component: c:\users\patricia\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\PlaySushiFF.dll

Folder::
c:\program files\ToggleEN
c:\program files\Dogpile Toolbar
c:\programdata\TabQuery
c:\users\patricia\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

Driver::
TabQuery Service

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{399C60D2-38B1-4E25-B9E7-6498C1BC2DCD}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{038cb5c7-48ea-4af9-94e0-a1646542e62b}"=-
"{C53FE659-316A-4F56-A194-A5BE491BE866}"=-
[-HKEY_CLASSES_ROOT\FCTB000060231.IEToolbar.3]
[-HKEY_CLASSES_ROOT\TypeLib\{587A2AD9-5F47-4029-8123-77327768C9F3}]
[-HKEY_CLASSES_ROOT\FCTB000060231.IEToolbar]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{038CB5C7-48EA-4AF9-94E0-A1646542E62B}"=-
"{C53FE659-316A-4F56-A194-A5BE491BE866}"=-

In the notepad

Click File, Save as…, and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

AnthonySzum

Post #8October 24, 2010, 9:20 PM UTC

After running combofix again, I encountered the same thing again when trying to open something "" Illegal operation attempted on a registry key that has been marked for deletion"
I again had to restart the computer manually to get everything working again.
Why is this happening?

Here is the new log:

ComboFix 10-10-22.05 - patricia 10/24/2010 16:14:46.4.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3066.1952 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\patricia\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Dogpile Toolbar
c:\program files\Dogpile Toolbar\aboutTabs.7.js
c:\program files\Dogpile Toolbar\aboutTabs.8.js
c:\program files\Dogpile Toolbar\audio.bmp
c:\program files\Dogpile Toolbar\blockcursor.cur
c:\program files\Dogpile Toolbar\blocksound.wav
c:\program files\Dogpile Toolbar\bookmark_off.bmp
c:\program files\Dogpile Toolbar\bookmark_on.bmp
c:\program files\Dogpile Toolbar\bookmarksplugin.dll
c:\program files\Dogpile Toolbar\bubble_permissions.html
c:\program files\Dogpile Toolbar\build
c:\program files\Dogpile Toolbar\caching_banner.html
c:\program files\Dogpile Toolbar\chevron.bmp
c:\program files\Dogpile Toolbar\component.xsl
c:\program files\Dogpile Toolbar\default.xml
c:\program files\Dogpile Toolbar\efolder.bmp
c:\program files\Dogpile Toolbar\email.bmp
c:\program files\Dogpile Toolbar\email2.bmp
c:\program files\Dogpile Toolbar\emailchecker_plugin.dll
c:\program files\Dogpile Toolbar\facebook.feature
c:\program files\Dogpile Toolbar\fbrss.xsl
c:\program files\Dogpile Toolbar\ff.xsl
c:\program files\Dogpile Toolbar\folder.bmp
c:\program files\Dogpile Toolbar\icons.bmp
c:\program files\Dogpile Toolbar\iefavelem.bmp
c:\program files\Dogpile Toolbar\ImageConversion.dll
c:\program files\Dogpile Toolbar\images\msgbox\down.gif
c:\program files\Dogpile Toolbar\images\msgbox\hr.bmp
c:\program files\Dogpile Toolbar\images\msgbox\mark.png
c:\program files\Dogpile Toolbar\images\msgbox\mark_do.png
c:\program files\Dogpile Toolbar\images\msgbox\mark_na.png
c:\program files\Dogpile Toolbar\images\msgbox\navbg.bmp
c:\program files\Dogpile Toolbar\images\msgbox\refresh.png
c:\program files\Dogpile Toolbar\images\msgbox\refresh_do.png
c:\program files\Dogpile Toolbar\images\msgbox\refresh_na.png
c:\program files\Dogpile Toolbar\images\msgbox\trash.png
c:\program files\Dogpile Toolbar\images\msgbox\trash_do.png
c:\program files\Dogpile Toolbar\images\msgbox\trash_na.png
c:\program files\Dogpile Toolbar\images\msgbox\unmark.png
c:\program files\Dogpile Toolbar\images\msgbox\unmark_do.png
c:\program files\Dogpile Toolbar\images\msgbox\unmark_na.png
c:\program files\Dogpile Toolbar\images\msgbox\up.gif
c:\program files\Dogpile Toolbar\images\ticker\left.gif
c:\program files\Dogpile Toolbar\images\ticker\right.gif
c:\program files\Dogpile Toolbar\images\weather\0.bmp
c:\program files\Dogpile Toolbar\images\weather\1.bmp
c:\program files\Dogpile Toolbar\images\weather\10.bmp
c:\program files\Dogpile Toolbar\images\weather\11.bmp
c:\program files\Dogpile Toolbar\images\weather\12.bmp
c:\program files\Dogpile Toolbar\images\weather\13.bmp
c:\program files\Dogpile Toolbar\images\weather\14.bmp
c:\program files\Dogpile Toolbar\images\weather\15.bmp
c:\program files\Dogpile Toolbar\images\weather\16.bmp
c:\program files\Dogpile Toolbar\images\weather\17.bmp
c:\program files\Dogpile Toolbar\images\weather\18.bmp
c:\program files\Dogpile Toolbar\images\weather\19.bmp
c:\program files\Dogpile Toolbar\images\weather\2.bmp
c:\program files\Dogpile Toolbar\images\weather\20.bmp
c:\program files\Dogpile Toolbar\images\weather\21.bmp
c:\program files\Dogpile Toolbar\images\weather\22.bmp
c:\program files\Dogpile Toolbar\images\weather\23.bmp
c:\program files\Dogpile Toolbar\images\weather\24.bmp
c:\program files\Dogpile Toolbar\images\weather\25.bmp
c:\program files\Dogpile Toolbar\images\weather\26.bmp
c:\program files\Dogpile Toolbar\images\weather\27.bmp
c:\program files\Dogpile Toolbar\images\weather\28.bmp
c:\program files\Dogpile Toolbar\images\weather\29.bmp
c:\program files\Dogpile Toolbar\images\weather\3.bmp
c:\program files\Dogpile Toolbar\images\weather\30.bmp
c:\program files\Dogpile Toolbar\images\weather\31.bmp
c:\program files\Dogpile Toolbar\images\weather\32.bmp
c:\program files\Dogpile Toolbar\images\weather\33.bmp
c:\program files\Dogpile Toolbar\images\weather\34.bmp
c:\program files\Dogpile Toolbar\images\weather\35.bmp
c:\program files\Dogpile Toolbar\images\weather\36.bmp
c:\program files\Dogpile Toolbar\images\weather\37.bmp
c:\program files\Dogpile Toolbar\images\weather\38.bmp
c:\program files\Dogpile Toolbar\images\weather\39.bmp
c:\program files\Dogpile Toolbar\images\weather\4.bmp
c:\program files\Dogpile Toolbar\images\weather\40.bmp
c:\program files\Dogpile Toolbar\images\weather\41.bmp
c:\program files\Dogpile Toolbar\images\weather\42.bmp
c:\program files\Dogpile Toolbar\images\weather\43.bmp
c:\program files\Dogpile Toolbar\images\weather\44.bmp
c:\program files\Dogpile Toolbar\images\weather\45.bmp
c:\program files\Dogpile Toolbar\images\weather\46.bmp
c:\program files\Dogpile Toolbar\images\weather\47.bmp
c:\program files\Dogpile Toolbar\images\weather\5.bmp
c:\program files\Dogpile Toolbar\images\weather\6.bmp
c:\program files\Dogpile Toolbar\images\weather\7.bmp
c:\program files\Dogpile Toolbar\images\weather\8.bmp
c:\program files\Dogpile Toolbar\images\weather\9.bmp
c:\program files\Dogpile Toolbar\images\weather\hr.bmp
c:\program files\Dogpile Toolbar\images\weather\na.bmp
c:\program files\Dogpile Toolbar\images\weather\png\0.png
c:\program files\Dogpile Toolbar\images\weather\png\1.png
c:\program files\Dogpile Toolbar\images\weather\png\10.png
c:\program files\Dogpile Toolbar\images\weather\png\11.png
c:\program files\Dogpile Toolbar\images\weather\png\12.png
c:\program files\Dogpile Toolbar\images\weather\png\13.png
c:\program files\Dogpile Toolbar\images\weather\png\14.png
c:\program files\Dogpile Toolbar\images\weather\png\15.png
c:\program files\Dogpile Toolbar\images\weather\png\16.png
c:\program files\Dogpile Toolbar\images\weather\png\17.png
c:\program files\Dogpile Toolbar\images\weather\png\18.png
c:\program files\Dogpile Toolbar\images\weather\png\19.png
c:\program files\Dogpile Toolbar\images\weather\png\2.png
c:\program files\Dogpile Toolbar\images\weather\png\20.png
c:\program files\Dogpile Toolbar\images\weather\png\21.png
c:\program files\Dogpile Toolbar\images\weather\png\22.png
c:\program files\Dogpile Toolbar\images\weather\png\23.png
c:\program files\Dogpile Toolbar\images\weather\png\24.png
c:\program files\Dogpile Toolbar\images\weather\png\25.png
c:\program files\Dogpile Toolbar\images\weather\png\26.png
c:\program files\Dogpile Toolbar\images\weather\png\27.png
c:\program files\Dogpile Toolbar\images\weather\png\28.png
c:\program files\Dogpile Toolbar\images\weather\png\29.png
c:\program files\Dogpile Toolbar\images\weather\png\3.png
c:\program files\Dogpile Toolbar\images\weather\png\30.png
c:\program files\Dogpile Toolbar\images\weather\png\31.png
c:\program files\Dogpile Toolbar\images\weather\png\32.png
c:\program files\Dogpile Toolbar\images\weather\png\33.png
c:\program files\Dogpile Toolbar\images\weather\png\34.png
c:\program files\Dogpile Toolbar\images\weather\png\35.png
c:\program files\Dogpile Toolbar\images\weather\png\36.png
c:\program files\Dogpile Toolbar\images\weather\png\37.png
c:\program files\Dogpile Toolbar\images\weather\png\38.png
c:\program files\Dogpile Toolbar\images\weather\png\39.png
c:\program files\Dogpile Toolbar\images\weather\png\4.png
c:\program files\Dogpile Toolbar\images\weather\png\40.png
c:\program files\Dogpile Toolbar\images\weather\png\41.png
c:\program files\Dogpile Toolbar\images\weather\png\42.png
c:\program files\Dogpile Toolbar\images\weather\png\43.png
c:\program files\Dogpile Toolbar\images\weather\png\44.png
c:\program files\Dogpile Toolbar\images\weather\png\45.png
c:\program files\Dogpile Toolbar\images\weather\png\46.png
c:\program files\Dogpile Toolbar\images\weather\png\47.png
c:\program files\Dogpile Toolbar\images\weather\png\5.png
c:\program files\Dogpile Toolbar\images\weather\png\6.png
c:\program files\Dogpile Toolbar\images\weather\png\7.png
c:\program files\Dogpile Toolbar\images\weather\png\8.png
c:\program files\Dogpile Toolbar\images\weather\png\9.png
c:\program files\Dogpile Toolbar\images\weather\png\na.png
c:\program files\Dogpile Toolbar\location.xsl
c:\program files\Dogpile Toolbar\magglass.ico
c:\program files\Dogpile Toolbar\manage_bookmarks.html
c:\program files\Dogpile Toolbar\marquee.html
c:\program files\Dogpile Toolbar\marquee_permissions.html
c:\program files\Dogpile Toolbar\messaging.bmp
c:\program files\Dogpile Toolbar\MimeSniffer.dll
c:\program files\Dogpile Toolbar\minus.bmp
c:\program files\Dogpile Toolbar\msgbox_bubble.tmpl
c:\program files\Dogpile Toolbar\msgbox_openmsg.tmpl
c:\program files\Dogpile Toolbar\msgboxplugin.dll
c:\program files\Dogpile Toolbar\patch.bat
c:\program files\Dogpile Toolbar\plus.bmp
c:\program files\Dogpile Toolbar\podcast.bmp
c:\program files\Dogpile Toolbar\podcast.xsl
c:\program files\Dogpile Toolbar\radio.bmp
c:\program files\Dogpile Toolbar\RadioPlugin.dll
c:\program files\Dogpile Toolbar\resize.bmp
c:\program files\Dogpile Toolbar\rssfeed.bmp
c:\program files\Dogpile Toolbar\RSSReader_plugin.dll
c:\program files\Dogpile Toolbar\search.xsl
c:\program files\Dogpile Toolbar\SearchComponent.dll
c:\program files\Dogpile Toolbar\settings
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_dropdwn_down.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_dropdwn_over.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_dropdwn_up.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_max_down.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_max_over.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_max_up.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_min_down.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_min_over.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_min_up.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_pause_down.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_pause_over.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_pause_up.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_play_down.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_play_over.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_play_up.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_playcntrl_over.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_playcntrl_up.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_stop_down.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_stop_over.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_stop_up.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_volcntrl_over.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\btn_volcntrl_up.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\Equalizer1.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\Equalizer2.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\Equalizer3.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\Equalizer4.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\Equalizer5.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\Equalizer6.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\playcntrl_bg.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\radio.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\radio_mask.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\radio_minimalized.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\radio_minimalized_mask.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\station.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\vol_01.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\vol_02.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\vol_03.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\volslide_bg.bmp
c:\program files\Dogpile Toolbar\skins\radio\gray03\volslide_track.bmp
c:\program files\Dogpile Toolbar\star_on.gif
c:\program files\Dogpile Toolbar\statplugin.dll
c:\program files\Dogpile Toolbar\ticker.html
c:\program files\Dogpile Toolbar\Toolbar.dll
c:\program files\Dogpile Toolbar\ToolbarUpdate.exe
c:\program files\Dogpile Toolbar\TroubleShooter.exe
c:\program files\Dogpile Toolbar\Uninst.exe
c:\program files\Dogpile Toolbar\version.txt
c:\program files\Dogpile Toolbar\version.xsl
c:\program files\Dogpile Toolbar\weather_bubble.tmpl
c:\program files\Dogpile Toolbar\weatherplugin.dll
c:\program files\ToggleEN
c:\program files\ToggleEN\INSTALL.LOG
c:\program files\ToggleEN\tbTogg.dll
c:\program files\ToggleEN\ToggleENToolbarHelper.exe
c:\program files\ToggleEN\toolbar.cfg
c:\program files\ToggleEN\UNWISE.EXE
c:\programdata\TabQuery
c:\users\patricia\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
c:\users\patricia\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\chrome.manifest
c:\users\patricia\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\chrome\pstextlinks.jar
c:\users\patricia\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\PlaySushiFF.dll
c:\users\patricia\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\PSTextLinks.xpt
c:\users\patricia\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\install.rdf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_TabQuery Service

((((((((((((((((((((((((( Files Created from 2010-09-24 to 2010-10-24 )))))))))))))))))))))))))))))))
.

2010-10-24 20:26 . 2010-10-24 20:26 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-10-24 20:26 . 2010-10-24 20:26 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-10-24 20:09 . 2010-10-24 20:09 ——– d—–w- c:\program files\ERUNT
2010-10-24 01:41 . 2010-10-24 20:29 ——– d—–w- c:\users\patricia\AppData\Local\temp
2010-10-21 23:36 . 2010-10-21 23:36 ——– d—–w- c:\users\patricia\AppData\Roaming\Elephant Games
2010-10-21 23:36 . 2010-10-21 23:36 ——– d—–w- c:\programdata\Elephant Games
2010-10-21 23:35 . 2010-10-21 23:35 ——– d—–w- c:\program files\Mystery Trackers - The Void Collector's Edition
2010-10-21 16:00 . 2010-10-21 16:00 ——– d—–w- c:\windows\en
2010-10-21 15:59 . 2010-09-23 04:21 39272 —-a-w- c:\windows\system32\drivers\fssfltr.sys
2010-10-21 15:54 . 2010-10-21 15:54 ——– d—–w- c:\program files\MSN Toolbar
2010-10-21 15:54 . 2010-10-21 15:55 ——– d—–w- c:\program files\Bing Bar Installer
2010-10-21 15:54 . 2009-09-04 21:44 69464 —-a-w- c:\windows\system32\XAPOFX1_3.dll
2010-10-21 15:54 . 2009-09-04 21:44 515416 —-a-w- c:\windows\system32\XAudio2_5.dll
2010-10-21 15:54 . 2009-09-04 21:29 453456 —-a-w- c:\windows\system32\d3dx10_42.dll
2010-10-21 15:38 . 2010-10-21 15:38 469256 —-a-w- c:\program files\Common Files\Windows Live\.cache\4a732301cb71362b\InstallManager_WLE_WLE.exe
2010-10-21 15:38 . 2010-10-21 15:38 15712 —-a-w- c:\program files\Common Files\Windows Live\.cache\f12b8e401cb71351f\MeshBetaRemover.exe
2010-10-21 15:37 . 2010-10-21 15:37 94040 —-a-w- c:\program files\Common Files\Windows Live\.cache\dc5deee01cb713518\DSETUP.dll
2010-10-21 15:37 . 2010-10-21 15:37 525656 —-a-w- c:\program files\Common Files\Windows Live\.cache\dc5deee01cb713518\DXSETUP.exe
2010-10-21 15:37 . 2010-10-21 15:37 1691480 —-a-w- c:\program files\Common Files\Windows Live\.cache\dc5deee01cb713518\dsetup32.dll
2010-10-21 15:37 . 2010-10-21 15:37 94040 —-a-w- c:\program files\Common Files\Windows Live\.cache\d96d10801cb713517\DSETUP.dll
2010-10-21 15:37 . 2010-10-21 15:37 525656 —-a-w- c:\program files\Common Files\Windows Live\.cache\d96d10801cb713517\DXSETUP.exe
2010-10-21 15:37 . 2010-10-21 15:37 1691480 —-a-w- c:\program files\Common Files\Windows Live\.cache\d96d10801cb713517\dsetup32.dll
2010-10-21 15:35 . 2010-10-24 14:36 ——– d—–w- c:\users\patricia\AppData\Local\Windows Live
2010-10-21 15:34 . 2009-08-04 08:02 754688 —-a-w- c:\windows\system32\webservices.dll
2010-10-19 14:58 . 2009-10-09 21:56 2048 —-a-w- c:\windows\system32\winrsmgr.dll
2010-10-19 14:58 . 2009-10-09 21:56 12800 —-a-w- c:\windows\system32\wsmprovhost.exe
2010-10-19 14:58 . 2009-10-09 21:56 20480 —-a-w- c:\windows\system32\winrshost.exe
2010-10-19 14:58 . 2009-10-09 21:56 40448 —-a-w- c:\windows\system32\winrs.exe
2010-10-19 14:58 . 2009-10-09 21:56 10240 —-a-w- c:\windows\system32\wsmplpxy.dll
2010-10-19 14:58 . 2009-10-09 21:56 10240 —-a-w- c:\windows\system32\winrssrv.dll
2010-10-14 21:10 . 2010-10-14 21:11 ——– d—–w- c:\program files\Paltalk Messenger
2010-10-14 20:52 . 2010-09-13 13:56 8147456 —-a-w- c:\windows\system32\wmploc.DLL
2010-10-14 20:52 . 2010-09-13 13:56 168960 —-a-w- c:\program files\Windows Media Player\wmplayer.exe
2010-10-14 20:51 . 2010-09-06 16:20 125952 —-a-w- c:\windows\system32\srvsvc.dll
2010-10-14 20:51 . 2010-09-06 16:19 17920 —-a-w- c:\windows\system32\netevent.dll
2010-10-14 20:51 . 2010-09-06 13:45 304128 —-a-w- c:\windows\system32\drivers\srv.sys
2010-10-14 20:51 . 2010-09-06 13:45 145408 —-a-w- c:\windows\system32\drivers\srv2.sys
2010-10-14 20:51 . 2010-09-06 13:45 102400 —-a-w- c:\windows\system32\drivers\srvnet.sys
2010-10-10 23:04 . 2010-10-10 23:06 ——– d—–w- c:\program files\Redemption Cemetery - Curse of the Raven
2010-10-08 17:01 . 2010-10-08 17:01 ——– d—–w- c:\program files\Common Files\Adobe
2010-10-05 07:11 . 2010-10-20 01:53 ——– d—–w- c:\users\patricia\AppData\Roaming\Paltalk
2010-09-28 22:23 . 2010-06-22 13:30 2048 —-a-w- c:\windows\system32\tzres.dll
2010-09-28 22:23 . 2010-08-26 04:23 13312 —-a-w- c:\program files\Internet Explorer\iecompat.dll
2010-09-28 20:20 . 2010-09-28 20:20 ——– d—–w- c:\users\patricia\AppData\Roaming\Notepad++
2010-09-28 20:20 . 2010-09-28 20:20 ——– d—–w- c:\program files\Notepad++
2010-09-24 22:31 . 2010-09-24 22:31 ——– d—–w- c:\users\patricia\AppData\Roaming\Ghost Ship Studios
2010-09-24 20:43 . 2010-09-24 20:44 ——– d—–w- c:\program files\Nightmare Adventures - The Witch's Prison

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-23 04:47 . 2010-09-23 04:47 49016 —-a-w- c:\windows\system32\sirenacm.dll
2010-09-23 04:32 . 2010-09-23 04:32 301936 —-a-w- c:\windows\WLXPGSS.SCR
2010-09-03 00:22 . 2010-09-03 00:22 47360 —-a-w- c:\users\patricia\AppData\Roaming\pcouffin.sys
2010-08-24 18:57 . 2010-08-01 23:53 9344 —-a-w- c:\windows\system32\drivers\mfeclnk.sys
2010-08-24 18:57 . 2010-08-01 23:53 164808 —-a-w- c:\windows\system32\drivers\mfewfpk.sys
2010-08-24 18:57 . 2010-08-01 23:53 95600 —-a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-08-24 18:57 . 2010-08-01 23:53 84264 —-a-w- c:\windows\system32\drivers\mferkdet.sys
2010-08-24 18:57 . 2010-08-01 23:53 64304 —-a-w- c:\windows\system32\drivers\mfenlfk.sys
2010-08-24 18:57 . 2010-08-01 23:53 55840 —-a-w- c:\windows\system32\drivers\cfwids.sys
2010-08-24 18:57 . 2010-08-01 23:53 312904 —-a-w- c:\windows\system32\drivers\mfefirek.sys
2010-08-24 18:57 . 2009-06-30 16:37 52104 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2010-08-24 18:57 . 2009-06-30 16:37 386712 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2010-08-24 18:57 . 2009-06-30 16:37 152992 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-08-17 14:11 . 2010-09-15 17:28 128000 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-24 18:57 . 2010-08-01 23:53 24376 —-a-w- c:\program files\mozilla firefox\components\Scriptff.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-09-23 4240760]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-07-31 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-04-27 233472]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-12-22 3810304]
"Dell DataSafe Online"="c:\program files\Dell DataSafe Online\DataSafeOnline.exe" [2009-11-13 1807600]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-01-09 405639]
"HostManager"="c:\program files\Common Files\AOL\1247175231\ee\AOLSoftware.exe" [2008-06-24 41824]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-06-03 206064]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-12-19 76304]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-30 483428]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]
"NBAgent"="c:\program files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2010-04-03 1234216]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-06-25 1193848]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-08-20 1164584]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-07 1394000]

c:\users\patricia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote Table Of Contents.onetoc2 [2009-8-12 3656]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-7-14 809488]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-7-31 1616976]

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-2-27 1316192]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2009-06-30 15:58 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\SPYWAR~1\sp_rsdel.exe \??\c:\progra~2\SPYWAR~1\sp_rsdel.dat

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^patricia^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\patricia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 03:07 932288 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 08:47 35760 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
2009-02-05 02:26 128232 ——w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-02-14 02:31 61440 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 09:17 149280 —-a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25 202240 —-a-w- c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=""
"FirewallOverride"=""

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-08-06 133104]
R2 gupdate1ca16e365ac7a30;Google Update Service (gupdate1ca16e365ac7a30);c:\program files\Google\Update\GoogleUpdate.exe [2009-08-06 133104]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-08-24 84264]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2010-03-16 17408]
R3 PCD5SRVC{3F6A8B78-EC003E00-05040104};PCD5SRVC{3F6A8B78-EC003E00-05040104} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms [2008-11-04 22904]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2010-08-24 64304]
S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-08-24 164808]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe [2009-03-30 81920]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-03-10 271480]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2010-08-24 188136]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2010-08-24 141792]
S2 SftService;SoftThinks Agent Service;c:\program files\Dell DataSafe Local Backup\sftservice.EXE [2009-04-17 636144]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-08-24 55840]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2008-12-31 144128]
S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [2010-03-08 62496]
S3 k57nd60x;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2008-08-25 203264]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-08-24 312904]
S3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\DRIVERS\OA001Ufd.sys [2009-03-06 133632]
S3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\DRIVERS\OA001Vid.sys [2009-03-08 280096]

— Other Services/Drivers In Memory —

*Deregistered* - mfeavfk01

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-10-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-06 22:15]

2010-10-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-06 22:15]

2010-10-24 c:\windows\Tasks\User_Feed_Synchronization-{3665EB40-7FE9-4CC9-A94B-EAE9FD7003FC}.job
- c:\windows\system32\msfeedssync.exe [2010-10-14 04:25]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\Windows Live\Companion\companioncore.dll
TCP: {F965D7B6-EFF4-4CD4-8472-5F7A994A99A5} = 205.188.146.145
FF - ProfilePath - c:\users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\iWonEI\Installr\1.bin\NPjfEISb.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\programdata\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\users\patricia\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Vidalia - c:\program files\Vidalia Bundle\Vidalia\vidalia.exe
AddRemove-Dogpile Toolbar - c:\program files\Dogpile Toolbar\Uninst.exe
AddRemove-ToggleEN Toolbar - c:\progra~1\ToggleEN\UNWISE.EXE

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-24 16:29
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCD5SRVC{3F6A8B78-EC003E00-05040104}]
"ImagePath"="\??\c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'Explorer.exe'(5828)
c:\program files\Logitech\SetPoint\lgscroll.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\STacSV.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Common Files\McAfee\SystemCore\mcshield.exe
c:\program files\Common Files\McAfee\SystemCore\mfefire.exe
c:\windows\system32\DllHost.exe
c:\program files\DellTPad\ApMsgFwd.exe
c:\program files\DellTPad\HidFind.exe
c:\windows\ehome\ehmsas.exe
c:\program files\DellTPad\Apntex.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Dell Support Center\gs_agent\dsc.exe
.
**************************************************************************
.
Completion time: 2010-10-24 16:36:31 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-24 20:36
ComboFix2.txt 2010-10-24 01:53
ComboFix3.txt 2009-09-10 22:01
ComboFix4.txt 2009-09-10 19:26

Pre-Run: 119,289,376,768 bytes free
Post-Run: 119,154,556,928 bytes free

- - End Of File - - 71746CF44386A1FB76285744FC29D589

Conspire

Post #9October 25, 2010, 8:33 AM UTC

Hi,

The message you were getting is normal and happens on certain systems, a reboot will fix everything and things will be back to normal.

Please get a new OTL scan log. Please set OTL up this way for the scan.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
UNCheck the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

===================================================

Kaspersky Online Scanner in IE

I recommend you to leave your computer on for the whole night as the scanning will take longer than you expected.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Please go to Kaspersky website and click on Kaspersky Online Scanner to perform an online scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
- Archives
- Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.

[external image: Posted Image]
Please post this log in your next reply.

**Note

For clearer guidance, here's the animated tutorial :-

Click here

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan. Once scan is finished remember to re-enable resident antivirus protection along with whatever antispyware app you use.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license is accepted, reset to 100%.

===================================================

On your next reply please post :
Fresh OTL log
Kaspersky report
How is it running?

Good Day!

AnthonySzum

Post #10October 25, 2010, 11:53 PM UTC

Everything seems to be running smoothly. Before I forget, I would like the auto run feature of cd's and usb's enabled again

OTL logfile created on: 10/25/2010 2:10:48 PM - Run 2
OTL by OldTimer - Version 3.2.16.0 Folder = C:\Users\patricia\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 61.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 217.81 Gb Total Space | 110.71 Gb Free Space | 50.83% Space Free | Partition Type: NTFS
Drive D: | 15.00 Gb Total Space | 14.91 Gb Free Space | 99.41% Space Free | Partition Type: NTFS

Computer Name: PATRICIA-PC | User Name: patricia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\patricia\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe ()
PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Dell DataSafe Local Backup\SftService.exe (SoftThinks)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
PRC - C:\Program Files\Common Files\aol\1247175231\ee\aolsoftware.exe (AOL LLC)
PRC - C:\Program Files\Common Files\aol\acs\AOLacsd.exe (AOL LLC)

========== Modules (SafeList) ==========

MOD - C:\Users\patricia\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (mfevtp) – C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (WPFFontCache_v0400) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (MSK80Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (GameConsoleService) – C:\Program Files\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (SftService) – C:\Program Files\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks)
SRV - (STacSV) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (DockLoginService) – C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)

========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (catchme) – C:\ComboFix\catchme.sys File not found
DRV - (fssfltr) – C:\Windows\System32\drivers\fssfltr.sys (Microsoft Corporation)
DRV - (mfehidk) – C:\Windows\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfewfpk) – C:\Windows\System32\drivers\mfewfpk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\Windows\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfenlfk) – C:\Windows\System32\drivers\mfenlfk.sys (McAfee, Inc.)
DRV - (cfwids) – C:\Windows\System32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (Netaapl) – C:\Windows\System32\drivers\netaapl.sys (Apple Inc.)
DRV - (itecir) – C:\Windows\System32\drivers\itecir.sys (ITE Tech. Inc. )
DRV - (mfesmfk) – C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (OA001Vid) – C:\Windows\System32\drivers\OA001Vid.sys (Creative Technology Ltd.)
DRV - (OA001Ufd) – C:\Windows\System32\drivers\OA001Ufd.sys (Creative Technology Ltd.)
DRV - (CtClsFlt) – C:\Windows\System32\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV - (BCM42RLY) – C:\Windows\System32\drivers\bcm42rly.sys (Broadcom Corporation)
DRV - (LMouFilt) – C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (BCM43XX) – C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (PCD5SRVC{3F6A8B78-EC003E00-05040104}) – C:\Program Files\Dell Support Center\HWDiag\bin\pcd5srvc.pkms (PC-Doctor, Inc.)
DRV - (k57nd60x) Broadcom NetLink ™ – C:\Windows\System32\drivers\k57nd60x.sys (Broadcom Corporation)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (MegaSR) – C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\Windows\System32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {038cb5c7-48ea-4af9-94e0-a1646542e62b} - Reg Error: Key error. File not found

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: openinregedit@firefox:0.1.2.4
FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5
FF - prefs.js..extensions.enabledItems: {888d99e7-e8b5-46a3-851e-1ec45da1e644}:4.0.0
FF - prefs.js..network.proxy.no_proxies_on: "*.local"

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/10/20 14:02:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/20 14:02:05 | 000,000,000 | —D | M]

[2010/10/24 17:01:09 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Extensions
[2009/09/13 18:32:03 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/03/21 21:03:44 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\extensions
[2010/03/21 21:03:44 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\extensions\[removed]
[2010/10/24 18:42:04 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions
[2010/05/24 17:59:24 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/24 17:59:24 | 000,000,000 | —D | M] (No name found) – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}-trash
[2010/10/24 18:36:59 | 000,000,000 | —D | M] (ReloadEvery) – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2010/09/23 15:33:06 | 000,000,000 | —D | M] (Torbutton) – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2010/09/02 20:54:38 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions\openinregedit@firefox
[2010/10/19 22:20:29 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/06/08 19:36:17 | 000,000,000 | —D | M] (Skype extension for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/08/24 14:57:38 | 000,024,376 | —- | M] (McAfee, Inc.) – C:\Program Files\Mozilla Firefox\components\Scriptff.dll

O1 HOSTS File: ([2010/10/24 16:29:12 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20100916034804.dll (McAfee, Inc.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe ()
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\aol\1247175231\ee\aolsoftware.exe (AOL LLC)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NBAgent] C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Users\patricia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote Table Of Contents.onetoc2 ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\paltalk.exe (AVM Software Inc.)
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe File not found
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Users\patricia\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\patricia\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~2\SPYWAR~1\sp_rsdel.exe \??\C:\PROGRA~2\SPYWAR~1\sp_rsdel.dat) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

File not found – C:\Users\patricia\Desktop\ComboFix.exe
[2010/10/24 16:36:34 | 000,000,000 | —D | C] – C:\Windows\temp
[2010/10/24 16:29:19 | 000,000,000 | —D | C] – C:\$RECYCLE.BIN
[2010/10/24 16:12:40 | 000,000,000 | —D | C] – C:\ComboFix
[2010/10/24 16:12:06 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010/10/24 16:09:37 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/10/24 16:07:13 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Users\patricia\Desktop\erunt-setup.exe
[2010/10/23 21:41:58 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Local\temp
[2010/10/22 11:04:02 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\patricia\Desktop\OTL.exe
[2010/10/21 19:36:19 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Roaming\Elephant Games
[2010/10/21 19:36:19 | 000,000,000 | —D | C] – C:\ProgramData\Elephant Games
[2010/10/21 19:35:01 | 000,000,000 | —D | C] – C:\Program Files\Mystery Trackers - The Void Collector's Edition
[2010/10/21 12:09:16 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\patricia\Desktop\HijackThis.exe
[2010/10/21 12:00:16 | 000,000,000 | —D | C] – C:\Windows\en
[2010/10/21 11:59:35 | 000,039,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\fssfltr.sys
[2010/10/21 11:54:41 | 000,000,000 | —D | C] – C:\Program Files\MSN Toolbar
[2010/10/21 11:54:22 | 000,000,000 | —D | C] – C:\Program Files\Bing Bar Installer
[2010/10/21 11:54:17 | 000,515,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_5.dll
[2010/10/21 11:54:17 | 000,453,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_42.dll
[2010/10/21 11:54:17 | 000,069,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAPOFX1_3.dll
[2010/10/21 11:35:56 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Local\Windows Live
[2010/10/21 11:34:54 | 000,754,688 | —- | C] (Microsoft Corporation) – C:\Windows\System32\webservices.dll
[2010/10/19 11:00:51 | 000,000,000 | —D | C] – C:\Windows\System32\WindowsPowerShell
[2010/10/19 10:58:17 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrsmgr.dll
[2010/10/19 10:58:03 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrs.exe
[2010/10/19 10:58:03 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrshost.exe
[2010/10/19 10:58:03 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsmprovhost.exe
[2010/10/19 10:58:00 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsmplpxy.dll
[2010/10/19 10:58:00 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrssrv.dll
[2010/10/19 10:57:59 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wevtfwd.dll
[2010/10/19 10:57:59 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wecutil.exe
[2010/10/19 10:57:59 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wecapi.dll
[2010/10/19 10:57:59 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmRes.dll
[2010/10/19 10:57:58 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pwrshplugin.dll
[2010/10/19 10:57:53 | 000,252,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSManMigrationPlugin.dll
[2010/10/19 10:57:53 | 000,246,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSManHTTPConfig.exe
[2010/10/19 10:57:53 | 000,241,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrscmd.dll
[2010/10/19 10:57:53 | 000,214,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmWmiPl.dll
[2010/10/19 10:57:53 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmAuto.dll
[2010/10/18 22:01:29 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Dirty Dancing 1987 20th Anniversary Edition DvDrip[Eng]-greenbud1969
[2010/10/14 17:10:53 | 000,000,000 | —D | C] – C:\Program Files\Paltalk Messenger
[2010/10/14 16:52:11 | 008,147,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2010/10/14 16:51:20 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netevent.dll
[2010/10/14 16:50:36 | 000,157,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\t2embed.dll
[2010/10/14 16:50:29 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2010/10/14 16:50:29 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2010/10/14 16:50:29 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2010/10/14 16:50:28 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2010/10/14 16:50:28 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/10/14 16:50:28 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/10/14 16:50:28 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/10/14 16:50:27 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/10/14 16:50:27 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2010/10/14 16:50:27 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2010/10/14 16:50:27 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2010/10/14 16:50:27 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2010/10/14 16:50:27 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2010/10/14 16:50:27 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2010/10/14 16:50:27 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/10/14 16:50:27 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/10/14 16:50:27 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2010/10/14 16:50:22 | 000,954,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40.dll
[2010/10/14 16:50:22 | 000,954,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40u.dll
[2010/10/14 16:50:19 | 002,038,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2010/10/14 16:50:16 | 000,231,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msshsq.dll
[2010/10/14 16:50:14 | 000,867,328 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpmde.dll
[2010/10/10 19:04:25 | 000,000,000 | —D | C] – C:\Program Files\Redemption Cemetery - Curse of the Raven
[2010/10/10 13:53:00 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Jersey Shore - Season 01
[2010/10/08 13:01:14 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2010/10/05 03:11:05 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Roaming\Paltalk
[2010/10/03 17:33:11 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Sons of Anarchy Season 1 & 2
[2010/10/03 17:14:25 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Linkin_Park-A_Thousand_Suns-2010-pLAN9
[2010/09/30 16:29:06 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\images
[2010/09/28 19:04:04 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Human Weapon
[2010/09/28 18:23:49 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/09/28 16:20:00 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Roaming\Notepad++
[2010/09/28 16:20:00 | 000,000,000 | —D | C] – C:\Program Files\Notepad++
[2010/09/02 20:22:56 | 000,047,360 | —- | C] (VSO Software) – C:\Users\patricia\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2010/10/25 14:09:12 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/10/25 14:04:14 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/25 14:04:14 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/25 14:02:48 | 000,000,424 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{3665EB40-7FE9-4CC9-A94B-EAE9FD7003FC}.job
[2010/10/25 14:02:44 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/10/25 14:02:29 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/10/25 05:14:14 | 000,000,436 | —- | M] () – C:\Windows\System32\drivers\etc\hosts.ics
[2010/10/25 05:13:48 | 3215,872,000 | -HS- | M] () – C:\hiberfil.sys
[2010/10/24 16:29:12 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/10/24 16:09:37 | 000,000,695 | —- | M] () – C:\Users\patricia\Desktop\NTREGOPT.lnk
[2010/10/24 16:09:37 | 000,000,676 | —- | M] () – C:\Users\patricia\Desktop\ERUNT.lnk
[2010/10/24 16:07:14 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Users\patricia\Desktop\erunt-setup.exe
[2010/10/23 11:17:26 | 001,068,544 | —- | M] () – C:\Users\patricia\Documents\The_daffodil_principle.pps
[2010/10/22 11:05:16 | 000,294,912 | —- | M] () – C:\Users\patricia\Desktop\lerkblms.exe
[2010/10/22 11:04:09 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\patricia\Desktop\OTL.exe
[2010/10/22 10:11:39 | 000,381,248 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/10/21 22:10:15 | 000,050,176 | —- | M] () – C:\Users\patricia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/21 22:07:43 | 000,000,000 | -H– | M] () – C:\Users\patricia\Documents\Default.rdp
[2010/10/21 19:35:48 | 000,002,007 | —- | M] () – C:\Users\Public\Desktop\Play Mystery Trackers - The Void Collector's Edition.lnk
[2010/10/21 19:35:48 | 000,001,260 | —- | M] () – C:\Users\Public\Desktop\More Great Games.lnk
[2010/10/21 12:09:22 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\patricia\Desktop\HijackThis.exe
[2010/10/19 15:50:52 | 000,000,258 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2010/10/17 19:08:52 | 006,600,795 | —- | M] () – C:\Users\patricia\Documents\Monkey_with_a_deathwish.wmv
[2010/10/10 19:06:17 | 000,001,952 | —- | M] () – C:\Users\Public\Desktop\Play Redemption Cemetery - Curse of the Raven.lnk
[2010/10/03 18:35:24 | 000,134,733 | —- | M] () – C:\Users\patricia\Documents\IMG00377-20100925-1846.jpg

========== Files Created - No Company Name ==========

[2010/10/24 16:09:37 | 000,000,695 | —- | C] () – C:\Users\patricia\Desktop\NTREGOPT.lnk
[2010/10/24 16:09:37 | 000,000,676 | —- | C] () – C:\Users\patricia\Desktop\ERUNT.lnk
[2010/10/23 21:30:53 | 000,077,312 | —- | C] () – C:\Windows\MBR.exe
[2010/10/23 11:17:24 | 001,068,544 | —- | C] () – C:\Users\patricia\Documents\The_daffodil_principle.pps
[2010/10/22 11:05:15 | 000,294,912 | —- | C] () – C:\Users\patricia\Desktop\lerkblms.exe
[2010/10/21 22:07:43 | 000,000,000 | -H– | C] () – C:\Users\patricia\Documents\Default.rdp
[2010/10/21 19:35:48 | 000,002,007 | —- | C] () – C:\Users\Public\Desktop\Play Mystery Trackers - The Void Collector's Edition.lnk
[2010/10/21 19:35:48 | 000,001,260 | —- | C] () – C:\Users\Public\Desktop\More Great Games.lnk
[2010/10/19 10:57:54 | 000,201,184 | —- | C] () – C:\Windows\System32\winrm.vbs
[2010/10/19 10:57:54 | 000,004,675 | —- | C] () – C:\Windows\System32\wsmanconfig_schema.xml
[2010/10/19 10:57:54 | 000,002,426 | —- | C] () – C:\Windows\System32\WsmTxt.xsl
[2010/10/17 19:08:41 | 006,600,795 | —- | C] () – C:\Users\patricia\Documents\Monkey_with_a_deathwish.wmv
[2010/10/10 19:06:17 | 000,001,952 | —- | C] () – C:\Users\Public\Desktop\Play Redemption Cemetery - Curse of the Raven.lnk
[2010/10/03 18:35:23 | 000,134,733 | —- | C] () – C:\Users\patricia\Documents\IMG00377-20100925-1846.jpg
[2010/09/02 20:22:56 | 000,007,887 | —- | C] () – C:\Users\patricia\AppData\Roaming\pcouffin.cat
[2010/09/02 20:22:56 | 000,001,144 | —- | C] () – C:\Users\patricia\AppData\Roaming\pcouffin.inf
[2010/09/02 20:22:56 | 000,000,055 | —- | C] () – C:\Users\patricia\AppData\Roaming\pcouffin.log
[2010/08/31 22:00:15 | 000,000,146 | —- | C] () – C:\Windows\WININIT.INI
[2010/06/08 19:39:39 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/01/01 11:22:12 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2009/09/16 19:17:19 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/08/14 09:39:45 | 000,050,176 | —- | C] () – C:\Users\patricia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/26 18:38:24 | 000,007,728 | —- | C] () – C:\Users\patricia\AppData\Local\d3d9caps.dat
[2009/06/30 14:21:40 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2009/06/30 11:48:49 | 000,006,656 | —- | C] () – C:\Windows\System32\bcmwlrc.dll
[2009/06/30 11:48:48 | 000,054,784 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2006/11/02 08:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 03:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini

========== Alternate Data Streams ==========

@Alternate Data Stream - 957 bytes -> C:\Users\patricia\Documents\Fw_Fwd_Fwd_Fw_FW_howtocallthepolicewhenyou'reold.eml:OECustomProperty
@Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:BD13A410
@Alternate Data Stream - 2421 bytes -> C:\Users\patricia\Documents\32709-Mizfour;[eDED]download;30018960.eml:OECustomProperty
@Alternate Data Stream - 237 bytes -> C:\ProgramData\TEMP:3D6B89CE
@Alternate Data Stream - 230 bytes -> C:\ProgramData\TEMP:B54E4B5A
@Alternate Data Stream - 227 bytes -> C:\ProgramData\TEMP:3086B95F
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:D3A89E47
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:68B61847
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:206470A5
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:FAB64002
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:5EF1AD34
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:A02025CE
@Alternate Data Stream - 198 bytes -> C:\ProgramData\TEMP:D31BE97C
@Alternate Data Stream - 197 bytes -> C:\ProgramData\TEMP:EEB25EAE
@Alternate Data Stream - 197 bytes -> C:\ProgramData\TEMP:5197985B
@Alternate Data Stream - 192 bytes -> C:\ProgramData\TEMP:3D36932D
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:517DBC32
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:A819A132
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:0EC7A545
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:B4F0E275
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:9E9A3410
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:526B3022
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:627153F1
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:1AC933DC
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:C7F08EA3
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:895A78C5
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:7FCB9D0D
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:C5CE2DF6
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:89C28CF6
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:737160C1
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:ED51D3ED
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:E6C6EB3B
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:5D432CE3
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:C9CDDE5E
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:71004506
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:98982C88
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:ED2998F5
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:FED25C29
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:E80802C7
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:A58B27C9
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:EC855C73
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:60EA2068
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:E91ADC66
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:7B2BB690
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:40D8F125
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:A4ACFB14

< End of report >

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, October 25, 2010
Operating system: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 2 (build 6002)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, October 25, 2010 16:51:39
Records in database: 4173979
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Objects scanned: 258701
Threats found: 5
Infected objects found: 6
Suspicious objects found: 0
Scan duration: 03:45:06

File name / Threat / Threats count
C:\Program Files\iWonEI\Installr\1.bin\jfEZSETP.dll Infected: not-a-virus:AdWare.Win32.FunWeb.fa 1
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1
C:\Users\patricia\Anthony\mirc635.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1
C:\Users\patricia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\9b47178-6eb677a3 Infected: Exploit.Java.Agent.f 1
C:\Users\patricia\Desktop\ESET Smart Security 4.2.58.3 + TNod 1.4.0 Auto-Licenser\TNod-1.4.0-Final-Portable.rar Infected: not-a-virus:AdWare.Win32.AdMedia.ja 1
C:\Users\patricia\Documents\LimeWire\Incomplete\T-5120800-06 i believe by frankie lyman.au Infected: Trojan-Downloader.WMA.GetCodec.s 1

Selected area has been scanned.

Conspire

Post #11October 26, 2010, 12:22 PM UTC

Hi,

I would like the auto run feature of cd's and usb's enabled again

Please run this Autoplay Repair Wizard

A couple of things to note.

C:\Program Files\iWonEI\Installr\1.bin\jfEZSETP.dll
C:\Program Files\mIRC\mirc.exe

Are you using iWonEI and mIRC? It could be used by malware if you did not download it. But if you did download yourself and use it, then please use it with caution (never give out personal info, click the ad links, etc). Otherwise, please uninstall it via Add/Remove Programs.

===================================================

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
IE - HKLM\..\URLSearchHook: {038cb5c7-48ea-4af9-94e0-a1646542e62b} - Reg Error: Key error. File not found
[2010/03/21 21:03:44 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\extensions\[removed]
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

:Files
C:\Users\patricia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\9b47178-6eb677a3
C:\Users\patricia\Desktop\ESET Smart Security 4.2.58.3 + TNod 1.4.0 Auto-Licenser
C:\Users\patricia\Documents\LimeWire\Incomplete\T-5120800-06 i believe by frankie lyman.au

:Commands
[emptyflash]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

===================================================

On your next reply please post :
Fresh OTL log
OTL fix log

Good Day!

AnthonySzum

Post #12October 26, 2010, 5:05 PM UTC

The first time I ran the fix, I received a windows alert at the very end saying "OLT has stopped responding"
I was forced to manual restart as the computer screen went blank. I ran the same process again after the restart and this was the log when it finished and restarted itself "

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{038cb5c7-48ea-4af9-94e0-a1646542e62b} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{038cb5c7-48ea-4af9-94e0-a1646542e62b}\ not found.
Folder C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\extensions\[removed]\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
========== FILES ==========
File\Folder C:\Program Files\iWonEI\Installr\1.bin\jfEZSETP.dll not found.
File\Folder C:\Users\patricia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\9b47178-6eb677a3 not found.
File\Folder C:\Users\patricia\Desktop\ESET Smart Security 4.2.58.3 + TNod 1.4.0 Auto-Licenser not found.
File\Folder C:\Users\patricia\Documents\LimeWire\Incomplete\T-5120800-06 i believe by frankie lyman.au not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: patricia
->Flash cache emptied: 33 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: patricia
->Temp folder emptied: 193263 bytes
->Temporary Internet Files folder emptied: 60099 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 44290074 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 104135 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 43.00 mb

OTL by OldTimer - Version 3.2.16.0 log created on 10262010_125430

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…

OTL logfile created on: 10/26/2010 1:00:27 PM - Run 3
OTL by OldTimer - Version 3.2.16.0 Folder = C:\Users\patricia\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 69.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 217.81 Gb Total Space | 110.40 Gb Free Space | 50.69% Space Free | Partition Type: NTFS
Drive D: | 15.00 Gb Total Space | 14.91 Gb Free Space | 99.41% Space Free | Partition Type: NTFS

Computer Name: PATRICIA-PC | User Name: patricia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\patricia\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe ()
PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Dell DataSafe Local Backup\SftService.exe (SoftThinks)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
PRC - C:\Program Files\AOL 9.1\shellmon.exe (AOL, LLC.)
PRC - C:\Program Files\AOL 9.1\waol.exe (AOL, LLC.)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
PRC - C:\Program Files\Common Files\aol\1247175231\ee\aolsoftware.exe (AOL LLC)
PRC - C:\Program Files\Common Files\aol\acs\AOLacsd.exe (AOL LLC)

========== Modules (SafeList) ==========

MOD - C:\Users\patricia\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (mfevtp) – C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (WPFFontCache_v0400) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (MSK80Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (GameConsoleService) – C:\Program Files\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (SftService) – C:\Program Files\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks)
SRV - (STacSV) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (DockLoginService) – C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)

========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (catchme) – C:\ComboFix\catchme.sys File not found
DRV - (fssfltr) – C:\Windows\System32\drivers\fssfltr.sys (Microsoft Corporation)
DRV - (mfehidk) – C:\Windows\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfewfpk) – C:\Windows\System32\drivers\mfewfpk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\Windows\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfenlfk) – C:\Windows\System32\drivers\mfenlfk.sys (McAfee, Inc.)
DRV - (cfwids) – C:\Windows\System32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (Netaapl) – C:\Windows\System32\drivers\netaapl.sys (Apple Inc.)
DRV - (itecir) – C:\Windows\System32\drivers\itecir.sys (ITE Tech. Inc. )
DRV - (mfesmfk) – C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (OA001Vid) – C:\Windows\System32\drivers\OA001Vid.sys (Creative Technology Ltd.)
DRV - (OA001Ufd) – C:\Windows\System32\drivers\OA001Ufd.sys (Creative Technology Ltd.)
DRV - (CtClsFlt) – C:\Windows\System32\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV - (BCM42RLY) – C:\Windows\System32\drivers\bcm42rly.sys (Broadcom Corporation)
DRV - (LMouFilt) – C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (BCM43XX) – C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (PCD5SRVC{3F6A8B78-EC003E00-05040104}) – C:\Program Files\Dell Support Center\HWDiag\bin\pcd5srvc.pkms (PC-Doctor, Inc.)
DRV - (k57nd60x) Broadcom NetLink ™ – C:\Windows\System32\drivers\k57nd60x.sys (Broadcom Corporation)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (MegaSR) – C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\Windows\System32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: openinregedit@firefox:0.1.2.4
FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5
FF - prefs.js..extensions.enabledItems: {888d99e7-e8b5-46a3-851e-1ec45da1e644}:4.0.0
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/10/20 14:02:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/20 14:02:05 | 000,000,000 | —D | M]

[2010/10/24 17:01:09 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Extensions
[2009/09/13 18:32:03 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/10/26 12:46:20 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\extensions
[2010/10/25 16:13:19 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions
[2010/05/24 17:59:24 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/24 17:59:24 | 000,000,000 | —D | M] (No name found) – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}-trash
[2010/10/24 18:36:59 | 000,000,000 | —D | M] (ReloadEvery) – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2010/09/23 15:33:06 | 000,000,000 | —D | M] (Torbutton) – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2010/09/02 20:54:38 | 000,000,000 | —D | M] – C:\Users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\extensions\openinregedit@firefox
[2010/10/19 22:20:29 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/06/08 19:36:17 | 000,000,000 | —D | M] (Skype extension for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/08/24 14:57:38 | 000,024,376 | —- | M] (McAfee, Inc.) – C:\Program Files\Mozilla Firefox\components\Scriptff.dll

O1 HOSTS File: ([2010/10/24 16:29:12 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20100916034804.dll (McAfee, Inc.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe ()
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\aol\1247175231\ee\aolsoftware.exe (AOL LLC)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NBAgent] C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKCU..\Run: [AOL Fast Start] C:\Program Files\AOL 9.1\AOL.EXE (AOL, LLC.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Users\patricia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote Table Of Contents.onetoc2 ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\paltalk.exe (AVM Software Inc.)
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe File not found
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Users\patricia\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\patricia\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~2\SPYWAR~1\sp_rsdel.exe \??\C:\PROGRA~2\SPYWAR~1\sp_rsdel.dat) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/10/26 12:46:17 | 000,000,000 | —D | C] – C:\_OTL
[2010/10/24 16:36:34 | 000,000,000 | —D | C] – C:\Windows\temp
[2010/10/24 16:29:19 | 000,000,000 | —D | C] – C:\$RECYCLE.BIN
[2010/10/24 16:12:40 | 000,000,000 | —D | C] – C:\ComboFix
[2010/10/24 16:12:06 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010/10/24 16:09:37 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/10/24 16:07:13 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Users\patricia\Desktop\erunt-setup.exe
[2010/10/23 21:41:58 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Local\temp
[2010/10/22 11:04:02 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\patricia\Desktop\OTL.exe
[2010/10/21 19:36:19 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Roaming\Elephant Games
[2010/10/21 19:36:19 | 000,000,000 | —D | C] – C:\ProgramData\Elephant Games
[2010/10/21 19:35:01 | 000,000,000 | —D | C] – C:\Program Files\Mystery Trackers - The Void Collector's Edition
[2010/10/21 12:09:16 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\patricia\Desktop\HijackThis.exe
[2010/10/21 12:00:16 | 000,000,000 | —D | C] – C:\Windows\en
[2010/10/21 11:59:35 | 000,039,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\fssfltr.sys
[2010/10/21 11:54:41 | 000,000,000 | —D | C] – C:\Program Files\MSN Toolbar
[2010/10/21 11:54:22 | 000,000,000 | —D | C] – C:\Program Files\Bing Bar Installer
[2010/10/21 11:54:17 | 000,515,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_5.dll
[2010/10/21 11:54:17 | 000,453,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_42.dll
[2010/10/21 11:54:17 | 000,069,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAPOFX1_3.dll
[2010/10/21 11:35:56 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Local\Windows Live
[2010/10/21 11:34:54 | 000,754,688 | —- | C] (Microsoft Corporation) – C:\Windows\System32\webservices.dll
[2010/10/19 11:00:51 | 000,000,000 | —D | C] – C:\Windows\System32\WindowsPowerShell
[2010/10/19 10:58:17 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrsmgr.dll
[2010/10/19 10:58:03 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrs.exe
[2010/10/19 10:58:03 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrshost.exe
[2010/10/19 10:58:03 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsmprovhost.exe
[2010/10/19 10:58:00 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsmplpxy.dll
[2010/10/19 10:58:00 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrssrv.dll
[2010/10/19 10:57:59 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wevtfwd.dll
[2010/10/19 10:57:59 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wecutil.exe
[2010/10/19 10:57:59 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wecapi.dll
[2010/10/19 10:57:59 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmRes.dll
[2010/10/19 10:57:58 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pwrshplugin.dll
[2010/10/19 10:57:53 | 000,252,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSManMigrationPlugin.dll
[2010/10/19 10:57:53 | 000,246,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSManHTTPConfig.exe
[2010/10/19 10:57:53 | 000,241,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrscmd.dll
[2010/10/19 10:57:53 | 000,214,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmWmiPl.dll
[2010/10/19 10:57:53 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmAuto.dll
[2010/10/18 22:01:29 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Dirty Dancing 1987 20th Anniversary Edition DvDrip[Eng]-greenbud1969
[2010/10/14 17:10:53 | 000,000,000 | —D | C] – C:\Program Files\Paltalk Messenger
[2010/10/14 16:52:11 | 008,147,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2010/10/14 16:51:20 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netevent.dll
[2010/10/14 16:50:36 | 000,157,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\t2embed.dll
[2010/10/14 16:50:29 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2010/10/14 16:50:29 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2010/10/14 16:50:29 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2010/10/14 16:50:28 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2010/10/14 16:50:28 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/10/14 16:50:28 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/10/14 16:50:28 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/10/14 16:50:27 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/10/14 16:50:27 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2010/10/14 16:50:27 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2010/10/14 16:50:27 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2010/10/14 16:50:27 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2010/10/14 16:50:27 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2010/10/14 16:50:27 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2010/10/14 16:50:27 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/10/14 16:50:27 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/10/14 16:50:27 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2010/10/14 16:50:22 | 000,954,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40.dll
[2010/10/14 16:50:22 | 000,954,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40u.dll
[2010/10/14 16:50:19 | 002,038,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2010/10/14 16:50:16 | 000,231,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msshsq.dll
[2010/10/14 16:50:14 | 000,867,328 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpmde.dll
[2010/10/10 19:04:25 | 000,000,000 | —D | C] – C:\Program Files\Redemption Cemetery - Curse of the Raven
[2010/10/10 13:53:00 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Jersey Shore - Season 01
[2010/10/08 13:01:14 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2010/10/05 03:11:05 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Roaming\Paltalk
[2010/10/03 17:33:11 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Sons of Anarchy Season 1 & 2
[2010/10/03 17:14:25 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Linkin_Park-A_Thousand_Suns-2010-pLAN9
[2010/09/30 16:29:06 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\images
[2010/09/28 19:04:04 | 000,000,000 | —D | C] – C:\Users\patricia\Desktop\Human Weapon
[2010/09/28 18:23:49 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/09/28 16:20:00 | 000,000,000 | —D | C] – C:\Users\patricia\AppData\Roaming\Notepad++
[2010/09/28 16:20:00 | 000,000,000 | —D | C] – C:\Program Files\Notepad++
[2010/09/02 20:22:56 | 000,047,360 | —- | C] (VSO Software) – C:\Users\patricia\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2010/10/26 12:55:58 | 000,000,436 | —- | M] () – C:\Windows\System32\drivers\etc\hosts.ics
[2010/10/26 12:55:45 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/10/26 12:55:42 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/26 12:55:41 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/26 12:55:36 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/10/26 12:55:32 | 3215,872,000 | -HS- | M] () – C:\hiberfil.sys
[2010/10/26 12:21:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/10/26 10:05:15 | 000,000,424 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{3665EB40-7FE9-4CC9-A94B-EAE9FD7003FC}.job
[2010/10/26 00:59:23 | 000,050,176 | —- | M] () – C:\Users\patricia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/24 16:29:12 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/10/24 16:09:37 | 000,000,695 | —- | M] () – C:\Users\patricia\Desktop\NTREGOPT.lnk
[2010/10/24 16:09:37 | 000,000,676 | —- | M] () – C:\Users\patricia\Desktop\ERUNT.lnk
[2010/10/24 16:07:14 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Users\patricia\Desktop\erunt-setup.exe
[2010/10/23 11:17:26 | 001,068,544 | —- | M] () – C:\Users\patricia\Documents\The_daffodil_principle.pps
[2010/10/22 11:05:16 | 000,294,912 | —- | M] () – C:\Users\patricia\Desktop\lerkblms.exe
[2010/10/22 11:04:09 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\patricia\Desktop\OTL.exe
[2010/10/22 10:11:39 | 000,381,248 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/10/21 22:07:43 | 000,000,000 | -H– | M] () – C:\Users\patricia\Documents\Default.rdp
[2010/10/21 19:35:48 | 000,002,007 | —- | M] () – C:\Users\Public\Desktop\Play Mystery Trackers - The Void Collector's Edition.lnk
[2010/10/21 19:35:48 | 000,001,260 | —- | M] () – C:\Users\Public\Desktop\More Great Games.lnk
[2010/10/21 12:09:22 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\patricia\Desktop\HijackThis.exe
[2010/10/19 15:50:52 | 000,000,258 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2010/10/17 19:08:52 | 006,600,795 | —- | M] () – C:\Users\patricia\Documents\Monkey_with_a_deathwish.wmv
[2010/10/10 19:06:17 | 000,001,952 | —- | M] () – C:\Users\Public\Desktop\Play Redemption Cemetery - Curse of the Raven.lnk
[2010/10/03 18:35:24 | 000,134,733 | —- | M] () – C:\Users\patricia\Documents\IMG00377-20100925-1846.jpg

========== Files Created - No Company Name ==========

[2010/10/24 16:09:37 | 000,000,695 | —- | C] () – C:\Users\patricia\Desktop\NTREGOPT.lnk
[2010/10/24 16:09:37 | 000,000,676 | —- | C] () – C:\Users\patricia\Desktop\ERUNT.lnk
[2010/10/23 21:30:53 | 000,077,312 | —- | C] () – C:\Windows\MBR.exe
[2010/10/23 11:17:24 | 001,068,544 | —- | C] () – C:\Users\patricia\Documents\The_daffodil_principle.pps
[2010/10/22 11:05:15 | 000,294,912 | —- | C] () – C:\Users\patricia\Desktop\lerkblms.exe
[2010/10/21 22:07:43 | 000,000,000 | -H– | C] () – C:\Users\patricia\Documents\Default.rdp
[2010/10/21 19:35:48 | 000,002,007 | —- | C] () – C:\Users\Public\Desktop\Play Mystery Trackers - The Void Collector's Edition.lnk
[2010/10/21 19:35:48 | 000,001,260 | —- | C] () – C:\Users\Public\Desktop\More Great Games.lnk
[2010/10/19 10:57:54 | 000,201,184 | —- | C] () – C:\Windows\System32\winrm.vbs
[2010/10/19 10:57:54 | 000,004,675 | —- | C] () – C:\Windows\System32\wsmanconfig_schema.xml
[2010/10/19 10:57:54 | 000,002,426 | —- | C] () – C:\Windows\System32\WsmTxt.xsl
[2010/10/17 19:08:41 | 006,600,795 | —- | C] () – C:\Users\patricia\Documents\Monkey_with_a_deathwish.wmv
[2010/10/10 19:06:17 | 000,001,952 | —- | C] () – C:\Users\Public\Desktop\Play Redemption Cemetery - Curse of the Raven.lnk
[2010/10/03 18:35:23 | 000,134,733 | —- | C] () – C:\Users\patricia\Documents\IMG00377-20100925-1846.jpg
[2010/09/02 20:22:56 | 000,007,887 | —- | C] () – C:\Users\patricia\AppData\Roaming\pcouffin.cat
[2010/09/02 20:22:56 | 000,001,144 | —- | C] () – C:\Users\patricia\AppData\Roaming\pcouffin.inf
[2010/09/02 20:22:56 | 000,000,055 | —- | C] () – C:\Users\patricia\AppData\Roaming\pcouffin.log
[2010/08/31 22:00:15 | 000,000,146 | —- | C] () – C:\Windows\WININIT.INI
[2010/06/08 19:39:39 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/01/01 11:22:12 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2009/09/16 19:17:19 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/08/14 09:39:45 | 000,050,176 | —- | C] () – C:\Users\patricia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/26 18:38:24 | 000,007,728 | —- | C] () – C:\Users\patricia\AppData\Local\d3d9caps.dat
[2009/06/30 14:21:40 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2009/06/30 11:48:49 | 000,006,656 | —- | C] () – C:\Windows\System32\bcmwlrc.dll
[2009/06/30 11:48:48 | 000,054,784 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2006/11/02 08:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 03:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini

========== Alternate Data Streams ==========

@Alternate Data Stream - 957 bytes -> C:\Users\patricia\Documents\Fw_Fwd_Fwd_Fw_FW_howtocallthepolicewhenyou'reold.eml:OECustomProperty
@Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:BD13A410
@Alternate Data Stream - 2421 bytes -> C:\Users\patricia\Documents\32709-Mizfour;[eDED]download;30018960.eml:OECustomProperty
@Alternate Data Stream - 237 bytes -> C:\ProgramData\TEMP:3D6B89CE
@Alternate Data Stream - 230 bytes -> C:\ProgramData\TEMP:B54E4B5A
@Alternate Data Stream - 227 bytes -> C:\ProgramData\TEMP:3086B95F
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:D3A89E47
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:68B61847
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:206470A5
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:FAB64002
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:5EF1AD34
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:A02025CE
@Alternate Data Stream - 198 bytes -> C:\ProgramData\TEMP:D31BE97C
@Alternate Data Stream - 197 bytes -> C:\ProgramData\TEMP:EEB25EAE
@Alternate Data Stream - 197 bytes -> C:\ProgramData\TEMP:5197985B
@Alternate Data Stream - 192 bytes -> C:\ProgramData\TEMP:3D36932D
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:517DBC32
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:A819A132
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:0EC7A545
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:B4F0E275
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:9E9A3410
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:526B3022
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:627153F1
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:1AC933DC
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:C7F08EA3
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:895A78C5
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:7FCB9D0D
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:C5CE2DF6
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:89C28CF6
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:737160C1
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:ED51D3ED
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:E6C6EB3B
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:5D432CE3
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:C9CDDE5E
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:71004506
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:98982C88
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:ED2998F5
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:FED25C29
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:E80802C7
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:A58B27C9
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:EC855C73
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:60EA2068
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:E91ADC66
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:7B2BB690
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:40D8F125
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:A4ACFB14

< End of report >

Conspire

Post #13October 27, 2010, 8:53 AM UTC

Hi,

If everything is normal then you should be good to go.

I'm pleased to let you know that your log is clean!

Thank you for your patience, and performing all of the procedures requested. I would also like to take this opportunity to apologize for any delay that may have occurred.

————————————————————————————————————–

Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

1. Create a new Restore Point

Click on the Start button to open your Start Menu.
Click on the Control Panel menu option.
Click on the System and Maintenance menu option.
Click on the System menu option.
Click on System Protection in the left-hand task list.
Create the manual restore point you should click on the Create button. When you press this button a prompt will appear asking you to provide a title for this manual restore point.
Type in a title for the manual restore point and press the Create button.
Close the System window after you have been advised that the procedure has been successfully completed.

.
2. Clear your existing system restore points except for the new clean restore point you just created:

Go to Start > Run and type in cleanmgr
Select the More options tab
Next to System Restore click Clean up
This will remove all restore points except the new one you just created.

Here are some tips to reduce the potential for spyware infection in the future:

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

Also, support is ending for some versions of Windows > http://windows.microsoft.com/en-us/w…ce-packs?os=xp

Passwords
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.

Make Internet Explorer more secure
Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

How Did I Get Infected In The First Place? by TonyKlein
How to Prevent Malware by miekiemoes
PC Safety and Security–What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop

WOT has an add-on available for both Firefox and IE.

SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here

MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
Download Host.zip and Save it to your Desktop.
Right-click hosts.zip and select 'Extract all files' or 'Extract files…'.
Follow the prompts and click 'Finish'.
This will open the newly created hosts folder on your Desktop.
Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
Once updated you should see another prompt that the task was completed.

Follow this list and keep your antivirus program and antispyware programs updated and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically.

Hopefully this should take care of your problems! Good luck.

Do you have any questions or problems to ask? Please do not hesitate to do so.

**Please respond this one more time to ensure it is resolved.

Conspire

Post #14October 27, 2010, 8:55 AM UTC

My apologies, please perform the following procedure for removing the tools.

Follow these steps to uninstall Combofix

Click START then RUN
Now copy/paste the code into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

Combofix /Uninstall

[external image: Posted Image]

===================================================

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

AnthonySzum

Post #15October 27, 2010, 7:14 PM UTC

Everything is running smoothly. Thank you so much for all your help. You guys rock! -Anthony

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Broswer re-directs- Hijack this log

✨ Ask AI

Ask AI