window live mail not closing after infection

hi all.
we accidently downloaded "security shield" to our desktop. It stopped access to services, hijack this, online scans etc. Using rootkill I got the pop-up fake scan to stop interjecting itself every few minutes. Dit a scan on bit defender, then deleted the exe. when finally able to get hijack to open.

Computer seemed clear however Windows live mail has ot closed right since, taking a long time to close ghosting away rather than turning off has it had before the "security shield".

shrt of it, I think the hosts file may be corrupted and maybe more, I am posting latest hijack thiis file log, There are things in there not all that famillar with or comfortable enough to deal with like all the "file missing" things, safe to delete those? here's the log;

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:58:37 PM, on 12/18/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe
C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe
C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10l_ActiveX.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Lexmark Printable Web - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [ShwiconXP9106] C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
O4 - HKLM\..\Run: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m
O4 - HKLM\..\Run: [THX Audio Control Panel] "C:\Program Files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe" /r
O4 - HKLM\..\Run: [UpdReg] C:\Windows\UpdReg.EXE
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [Lexmark S300-S400 Series] "C:\Program Files (x86)\Lexmark S300-S400 Series\fm3032.exe" /s
O4 - HKLM\..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe
O4 - HKLM\..\RunOnce: [DSUpdateLauncher] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe" /NOCONSOLE /D="C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate" /RUNAS "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe"
O4 - HKLM\..\RunOnce: [STToasterLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} (BitDefender QuickScan Control) - http://quickscan.bitdefender.com/qsax/qsax.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/…can8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/pub/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - c:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Active File Monitor V8 (AdobeActiveFileMonitor8.0) - Adobe Systems Incorporated - c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD Fusion Utility Service (AMDFusionSVC) - Advanced Micro Devices - c:\Program Files (x86)\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe
O23 - Service: AMD RAIDXpert (AMD_RAIDXpert) - AMD - C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: lxeaCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\x64\3\\lxeaserv.exe
O23 - Service: lxea_device - - C:\Windows\system32\lxeacoms.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: RoxMediaDB10 - Sonic Solutions - c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks SAS - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 11761 bytes


Thanks in advance for any and all help

here otl scan log only got one log not sure about the other ;

OTL logfile created on: 12/19/2010 6:18:20 PM - Run 1
OTL by OldTimer - Version 3.2.17.4 Folder = C:\Users\Ray\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

8.00 Gb Total Physical Memory | 7.00 Gb Available Physical Memory | 88.00% Memory free
16.00 Gb Paging File | 14.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 918.44 Gb Total Space | 875.26 Gb Free Space | 95.30% Space Free | Partition Type: NTFS

Computer Name: RAY-PC | User Name: Ray | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Ray\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10l_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe (SoftThinks - Dell)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe ()
PRC - C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe (Alcor Micro Corp.)
PRC - C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe ()
PRC - C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe ()
PRC - C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe ()
PRC - c:\Program Files (x86)\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe (Advanced Micro Devices)
PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
PRC - C:\Windows\SysWOW64\WinMsgBalloonServer.exe ()
PRC - C:\Windows\SysWOW64\WinMsgBalloonClient.exe ()
PRC - C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe (AMD)
PRC - C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe ()


========== Modules (SafeList) ==========

MOD - C:\Users\Ray\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wpdshext.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\fontext.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\fms.dll (Windows ® Codename Longhorn DDK provider)
MOD - C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\GdiPlus.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV:64bit: - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV:64bit: - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (lxeaCATSCustConnectService) – C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxeaserv.exe ()
SRV:64bit: - (lxea_device) – C:\Windows\SysNative\lxeacoms.exe ( )
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (DockLoginService) – C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (GoToAssist) – C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (SftService) – C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (lxea_device) – C:\Windows\SysWow64\lxeacoms.exe ( )
SRV - (AdobeActiveFileMonitor8.0) – c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (AMDFusionSVC) – c:\Program Files (x86)\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe (Advanced Micro Devices)
SRV - (RoxMediaDB10) – c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe (Sonic Solutions)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (AMD_RAIDXpert) – C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe (AMD)


========== Driver Services (SafeList) ==========

DRV:64bit: - (RxFilter) – C:\Windows\SysNative\DRIVERS\RxFilter.sys File not found
DRV:64bit: - (PCDSRVC{1E208CE0-FB7451FF-06020101}_0) – c:\Program Files\Dell Support Center\pcdsrvc_x64.pkms (PC-Doctor, Inc.)
DRV:64bit: - (aswMonFlt) – C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (AtiHdmiService) – C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (k57nd60a) Broadcom NetLink ™ – C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (ahcix64s) – C:\Windows\SysNative\drivers\ahcix64s.sys (Advanced Micro Devices, Inc)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (AmdLLD64) – C:\Windows\SysNative\drivers\AmdLLD64.sys (Advanced Micro Devices)
DRV:64bit: - (WimFltr) – C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (RxFilter) – C:\Windows\SysWOW64\drivers\RxFilter.sys (Sonic Solutions)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


[2010/12/02 19:47:22 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\Mozilla\Extensions
[2010/12/02 19:47:22 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\Mozilla\Extensions\[removed]

O1 HOSTS File: ([2009/06/10 13:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Lexmark Printable Web) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll ()
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe ()
O4:64bit: - HKLM..\Run: [lxeamon.exe] C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RunDLLEntry_EptMon] C:\Windows\system32\EptMon64.DLL File not found
O4:64bit: - HKLM..\Run: [RunDLLEntry_THXCfg] C:\Windows\system32\THXCfg64.DLL File not found
O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe ()
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe File not found
O4 - HKLM..\Run: [Lexmark S300-S400 Series] C:\Program Files (x86)\Lexmark S300-S400 Series\fm3032.exe ()
O4 - HKLM..\Run: [ShwiconXP9106] C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe (Alcor Micro Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [THX Audio Control Panel] C:\Program Files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\RunOnce: [DSUpdateLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe (Dell)
O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe (Softthinks)
O4 - HKLM..\RunOnce: [STToasterLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\ToasterLauncher.exe ()
O4 - HKLM..\RunOnceEx: [ContentMerger] c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\ContentMerger10.exe (Sonic Solutions)
O4 - Startup: C:\Users\Ray\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files (x86)\Dell\DellDock\DellDock.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} http://quickscan.bitdefender.com/qsax/qsax.cab (BitDefender QuickScan Control)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/…can8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/pub/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\cozi {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18 - Protocol\Handler\cozi {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - c:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll (Cozi Group, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - Reg Error: Key error. - C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/12/19 17:09:14 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Ray\Desktop\OTL.exe
[2010/12/16 09:41:00 | 001,169,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskschd.dll
[2010/12/16 09:41:00 | 000,524,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmicmiplugin.dll
[2010/12/16 09:41:00 | 000,496,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\taskschd.dll
[2010/12/16 09:41:00 | 000,473,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskcomp.dll
[2010/12/16 09:41:00 | 000,464,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskeng.exe
[2010/12/16 09:41:00 | 000,305,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\taskcomp.dll
[2010/12/16 09:41:00 | 000,285,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\schtasks.exe
[2010/12/16 09:41:00 | 000,179,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\schtasks.exe
[2010/12/16 09:40:58 | 000,367,104 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2010/12/16 09:40:58 | 000,294,400 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2010/12/16 09:40:58 | 000,046,080 | —- | C] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2010/12/16 09:40:58 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2010/12/16 09:40:57 | 000,395,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\webio.dll
[2010/12/16 09:40:57 | 000,314,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\webio.dll
[2010/12/16 09:40:55 | 000,112,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\consent.exe
[2010/12/16 09:40:50 | 000,703,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2010/12/16 09:40:50 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeeds.dll
[2010/12/16 09:40:50 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2010/12/16 09:40:49 | 000,482,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2010/12/16 09:40:49 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2010/12/16 09:40:49 | 000,256,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2010/12/16 09:40:49 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2010/12/16 09:40:49 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2010/12/16 09:40:49 | 000,097,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2010/12/16 09:40:49 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2010/12/16 09:40:49 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2010/12/16 09:40:49 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2010/12/16 09:40:49 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2010/12/16 09:40:49 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2010/12/15 07:46:33 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\Malwarebytes
[2010/12/15 07:46:28 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/12/15 07:46:28 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/12/15 07:46:25 | 000,024,152 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/12/15 07:46:25 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/12/15 07:45:47 | 007,622,112 | —- | C] (Malwarebytes Corporation ) – C:\Users\Ray\Desktop\mbam-setup-1.50.0.0.exe
[2010/12/15 05:48:08 | 000,000,000 | —D | C] – C:\Windows\BDOSCAN8
[2010/12/14 16:05:29 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\QuickScan
[2010/12/12 19:05:46 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\S300-S400 Series
[2010/12/07 22:36:28 | 000,000,000 | —D | C] – C:\ProgramData\Ezprint
[2010/12/07 21:53:21 | 000,000,000 | —D | C] – C:\ProgramData\Lx_cats
[2010/12/07 21:09:16 | 001,462,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lxk_g.dll
[2010/12/07 21:09:04 | 000,983,121 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lxk_gf.dll
[2010/12/07 21:08:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\Abbyy FineReader 6.0 Sprint
[2010/12/07 21:07:48 | 000,000,000 | —D | C] – C:\ProgramData\S300-S400 Series
[2010/12/07 21:07:42 | 000,000,000 | —D | C] – C:\Program Files\Lexmark Toolbar
[2010/12/07 21:07:40 | 000,510,464 | —- | C] (Lexmark International, Inc.) – C:\Windows\SysNative\LXEAwupd.dll
[2010/12/07 21:07:40 | 000,295,592 | —- | C] (Lexmark International, Inc.) – C:\Windows\SysNative\LXEAwupd.exe
[2010/12/07 21:07:21 | 000,000,000 | —D | C] – C:\Program Files\Lexmark
[2010/12/07 21:07:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\Lexmark Toolbar
[2010/12/07 21:06:57 | 000,000,000 | —D | C] – C:\Program Files\Lexmark Printable Web
[2010/12/07 21:06:50 | 000,364,544 | —- | C] ( ) – C:\Windows\SysWow64\lxeainpa.dll
[2010/12/07 21:06:50 | 000,344,064 | —- | C] ( ) – C:\Windows\SysWow64\lxeaiesc.dll
[2010/12/07 21:06:50 | 000,126,976 | —- | C] (Lexmark International Inc.) – C:\Windows\SysWow64\lxealnks.dll
[2010/12/07 21:06:49 | 000,847,872 | —- | C] ( ) – C:\Windows\SysWow64\lxeausb1.dll
[2010/12/07 21:06:49 | 000,643,072 | —- | C] ( ) – C:\Windows\SysWow64\lxeapmui.dll
[2010/12/07 21:06:48 | 001,048,576 | —- | C] ( ) – C:\Windows\SysWow64\lxeaserv.dll
[2010/12/07 21:06:48 | 000,577,536 | —- | C] ( ) – C:\Windows\SysWow64\lxealmpm.dll
[2010/12/07 21:06:48 | 000,324,264 | —- | C] ( ) – C:\Windows\SysWow64\lxeaih.exe
[2010/12/07 21:06:47 | 000,802,816 | —- | C] ( ) – C:\Windows\SysWow64\lxeacomc.dll
[2010/12/07 21:06:47 | 000,688,128 | —- | C] ( ) – C:\Windows\SysWow64\lxeahbn3.dll
[2010/12/07 21:06:47 | 000,598,696 | —- | C] ( ) – C:\Windows\SysWow64\lxeacoms.exe
[2010/12/07 21:06:47 | 000,373,416 | —- | C] ( ) – C:\Windows\SysWow64\lxeacfg.exe
[2010/12/07 21:06:47 | 000,372,736 | —- | C] ( ) – C:\Windows\SysWow64\lxeacomm.dll
[2010/12/07 21:06:46 | 000,086,186 | —- | C] (Lexmark International) – C:\Windows\SysWow64\LXEAcfg.dll
[2010/12/07 21:06:33 | 001,331,712 | —- | C] ( ) – C:\Windows\SysNative\lxeausb1.dll
[2010/12/07 21:06:33 | 000,557,568 | —- | C] ( ) – C:\Windows\SysNative\lxeainpa.dll
[2010/12/07 21:06:33 | 000,547,840 | —- | C] ( ) – C:\Windows\SysNative\LXEAhcp.dll
[2010/12/07 21:06:33 | 000,515,584 | —- | C] ( ) – C:\Windows\SysNative\lxeaiesc.dll
[2010/12/07 21:06:32 | 001,631,744 | —- | C] ( ) – C:\Windows\SysNative\lxeaserv.dll
[2010/12/07 21:06:32 | 000,979,968 | —- | C] ( ) – C:\Windows\SysNative\lxeapmui.dll
[2010/12/07 21:06:32 | 000,892,416 | —- | C] ( ) – C:\Windows\SysNative\lxealmpm.dll
[2010/12/07 21:06:31 | 001,104,384 | —- | C] ( ) – C:\Windows\SysNative\lxeahbn3.dll
[2010/12/07 21:06:31 | 000,520,872 | —- | C] ( ) – C:\Windows\SysNative\lxeaih.exe
[2010/12/07 21:06:30 | 001,052,328 | —- | C] ( ) – C:\Windows\SysNative\lxeacoms.exe
[2010/12/07 21:06:29 | 001,371,648 | —- | C] ( ) – C:\Windows\SysNative\lxeacomc.dll
[2010/12/07 21:06:29 | 000,612,008 | —- | C] ( ) – C:\Windows\SysNative\lxeacfg.exe
[2010/12/07 21:06:29 | 000,579,584 | —- | C] ( ) – C:\Windows\SysNative\lxeacomm.dll
[2010/12/07 21:06:29 | 000,075,264 | —- | C] (Lexmark International) – C:\Windows\SysNative\LXEAcfg.dll
[2010/12/07 21:06:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Lexmark S300-S400 Series
[2010/12/07 21:05:31 | 000,000,000 | —D | C] – C:\Program Files\Lexmark S300-S400 Series
[2010/12/03 15:43:02 | 000,000,000 | —D | C] – C:\ProgramData\ATI
[2010/12/03 15:41:35 | 000,000,000 | —D | C] – C:\Program Files\Common Files\ATI Technologies
[2010/12/03 15:41:35 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\ATI Technologies
[2010/12/02 19:49:59 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\Vivox
[2010/11/21 08:20:45 | 000,000,000 | —D | C] – C:\Program Files\Dell Support Center
[2010/11/21 08:18:54 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\PCDr
[2010/11/20 01:08:38 | 000,000,000 | —D | C] – C:\Program Files (x86)\SecondLifeViewer2

========== Files - Modified Within 30 Days ==========

[2010/12/19 18:16:42 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/12/19 17:09:16 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Ray\Desktop\OTL.exe
[2010/12/19 12:01:13 | 000,000,422 | —- | M] () – C:\Windows\tasks\SystemToolsDailyTest.job
[2010/12/18 19:31:07 | 000,014,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/12/18 19:31:07 | 000,014,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/12/18 19:29:50 | 000,726,316 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/12/18 19:29:50 | 000,623,940 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/12/18 19:29:50 | 000,106,316 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/12/18 19:23:44 | 2146,930,687 | -HS- | M] () – C:\hiberfil.sys
[2010/12/18 17:58:37 | 000,011,763 | —- | M] () – C:\Users\Ray\Desktop\hijackthisnew
[2010/12/18 17:49:29 | 000,011,653 | —- | M] () – C:\Users\Ray\Desktop\hijackthis dec eighteenth
[2010/12/18 17:09:50 | 000,023,715 | —- | M] () – C:\Users\Ray\.recently-used.xbel
[2010/12/18 16:56:28 | 011,535,714 | —- | M] () – C:\Users\Ray\Desktop\Phelps Family.tga
[2010/12/18 16:34:25 | 000,600,312 | —- | M] () – C:\Users\Ray\Desktop\Cadence flower yellow_001.png
[2010/12/18 16:25:44 | 005,723,521 | —- | M] () – C:\Users\Ray\Desktop\yellow-flower-.tga
[2010/12/18 15:42:06 | 001,169,537 | —- | M] () – C:\Users\Ray\Desktop\bells.png
[2010/12/18 15:38:15 | 000,202,709 | —- | M] () – C:\Users\Ray\Desktop\poinsettia6.jpg
[2010/12/18 15:35:50 | 000,057,522 | —- | M] () – C:\Users\Ray\Desktop\Poinsettia_Wallpaper_18mr.jpg
[2010/12/17 16:28:05 | 006,781,470 | —- | M] () – C:\Users\Ray\Desktop\Pig Meat.PDF
[2010/12/17 15:47:28 | 000,122,653 | —- | M] () – C:\Users\Ray\Desktop\ice tower 2.jpg
[2010/12/17 15:47:27 | 000,129,095 | —- | M] () – C:\Users\Ray\Desktop\ice tower.jpg
[2010/12/17 03:18:47 | 000,324,976 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2010/12/15 07:46:28 | 000,001,111 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/15 07:45:55 | 007,622,112 | —- | M] (Malwarebytes Corporation ) – C:\Users\Ray\Desktop\mbam-setup-1.50.0.0.exe
[2010/12/15 06:59:01 | 000,660,752 | —- | M] () – C:\Users\Ray\Desktop\rkill.com
[2010/12/14 20:41:28 | 000,147,337 | —- | M] () – C:\Users\Ray\Desktop\star-of-bethlehem-wallpaper-source_bff.jpg
[2010/12/14 20:33:19 | 000,241,958 | —- | M] () – C:\Users\Ray\Desktop\gerbera-flower-wallpaper-wide-full-hd%20127.jpg
[2010/12/13 16:25:57 | 002,920,803 | —- | M] () – C:\Users\Ray\Desktop\Pharaoh, Chief and Cadence…X-mas 2010_001.png
[2010/12/12 13:14:21 | 001,126,360 | —- | M] () – C:\Users\Ray\Desktop\sugar babe 2.PDF
[2010/12/12 13:11:47 | 002,308,724 | —- | M] () – C:\Users\Ray\Desktop\sugar babe.PDF
[2010/12/12 01:26:46 | 000,084,837 | —- | M] () – C:\Users\Ray\Desktop\christhelioszodiac.jpg
[2010/12/09 10:14:39 | 000,001,524 | —- | M] () – C:\Users\Ray\Desktop\Cadence vinette - Shortcut.lnk
[2010/12/07 21:10:02 | 000,230,191 | —- | M] () – C:\Windows\SysNative\LexFiles.ulf
[2010/12/01 20:48:53 | 000,000,564 | —- | M] () – C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2010/12/01 15:02:26 | 000,058,232 | —- | M] () – C:\Users\Ray\Desktop\Energy-Tapping-Points-Female-440x800.gif
[2010/11/29 17:42:18 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/11/29 17:42:06 | 000,024,152 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/11/20 01:08:53 | 000,001,134 | —- | M] () – C:\Users\Public\Desktop\Second Life Viewer 2.lnk

========== Files Created - No Company Name ==========

[2010/12/18 17:58:37 | 000,011,763 | —- | C] () – C:\Users\Ray\Desktop\hijackthisnew
[2010/12/18 17:49:29 | 000,011,653 | —- | C] () – C:\Users\Ray\Desktop\hijackthis dec eighteenth
[2010/12/18 17:09:50 | 000,023,715 | —- | C] () – C:\Users\Ray\.recently-used.xbel
[2010/12/18 16:56:28 | 011,535,714 | —- | C] () – C:\Users\Ray\Desktop\Phelps Family.tga
[2010/12/18 16:34:25 | 000,600,312 | —- | C] () – C:\Users\Ray\Desktop\Cadence flower yellow_001.png
[2010/12/18 15:42:24 | 001,169,537 | —- | C] () – C:\Users\Ray\Desktop\bells.png
[2010/12/18 15:39:02 | 000,202,709 | —- | C] () – C:\Users\Ray\Desktop\poinsettia6.jpg
[2010/12/18 15:36:00 | 000,057,522 | —- | C] () – C:\Users\Ray\Desktop\Poinsettia_Wallpaper_18mr.jpg
[2010/12/18 04:41:35 | 005,723,521 | —- | C] () – C:\Users\Ray\Desktop\yellow-flower-.tga
[2010/12/17 16:27:58 | 006,781,470 | —- | C] () – C:\Users\Ray\Desktop\Pig Meat.PDF
[2010/12/17 15:49:13 | 000,122,653 | —- | C] () – C:\Users\Ray\Desktop\ice tower 2.jpg
[2010/12/17 15:48:49 | 000,129,095 | —- | C] () – C:\Users\Ray\Desktop\ice tower.jpg
[2010/12/15 07:46:28 | 000,001,111 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/15 06:58:45 | 000,660,752 | —- | C] () – C:\Users\Ray\Desktop\rkill.com
[2010/12/14 20:41:42 | 000,147,337 | —- | C] () – C:\Users\Ray\Desktop\star-of-bethlehem-wallpaper-source_bff.jpg
[2010/12/14 20:33:26 | 000,241,958 | —- | C] () – C:\Users\Ray\Desktop\gerbera-flower-wallpaper-wide-full-hd%20127.jpg
[2010/12/13 16:25:52 | 002,920,803 | —- | C] () – C:\Users\Ray\Desktop\Pharaoh, Chief and Cadence…X-mas 2010_001.png
[2010/12/12 13:14:13 | 001,126,360 | —- | C] () – C:\Users\Ray\Desktop\sugar babe 2.PDF
[2010/12/12 13:11:31 | 002,308,724 | —- | C] () – C:\Users\Ray\Desktop\sugar babe.PDF
[2010/12/12 01:45:23 | 000,084,837 | —- | C] () – C:\Users\Ray\Desktop\christhelioszodiac.jpg
[2010/12/09 10:14:39 | 000,001,524 | —- | C] () – C:\Users\Ray\Desktop\Cadence vinette - Shortcut.lnk
[2010/12/07 22:36:27 | 000,000,252 | —- | C] () – C:\ProgramData\FastPics.log
[2010/12/07 22:36:20 | 000,002,780 | —- | C] () – C:\ProgramData\lxeaJSW.log
[2010/12/07 21:09:19 | 000,109,056 | —- | C] () – C:\Windows\SysNative\lxeavs.dll
[2010/12/07 21:09:05 | 000,065,106 | —- | C] () – C:\Windows\SysNative\lxeaprpr.chm
[2010/12/07 21:09:04 | 000,065,536 | —- | C] () – C:\Windows\SysNative\lxeagcfg.dll
[2010/12/07 21:09:02 | 000,399,360 | —- | C] () – C:\Windows\SysNative\lxeacui.dll
[2010/12/07 21:09:02 | 000,148,480 | —- | C] () – C:\Windows\SysNative\lxeacuir.dll
[2010/12/07 21:09:02 | 000,008,694 | —- | C] () – C:\Windows\SysNative\lxeacommuilogo_rtl.bmp
[2010/12/07 21:09:02 | 000,008,694 | —- | C] () – C:\Windows\SysNative\lxeacommuilogo.bmp
[2010/12/07 21:09:00 | 000,008,191 | —- | C] () – C:\ProgramData\lxeascan.log
[2010/12/07 21:07:51 | 004,485,120 | —- | C] () – C:\Windows\SysNative\LXEAoem.dll
[2010/12/07 21:07:51 | 000,053,760 | —- | C] () – C:\Windows\SysNative\LXEAPMON.DLL
[2010/12/07 21:07:51 | 000,021,504 | —- | C] () – C:\Windows\SysNative\LXEAFXPU.DLL
[2010/12/07 21:07:51 | 000,003,584 | —- | C] () – C:\Windows\SysNative\LXEAPMRC.DLL
[2010/12/07 21:06:52 | 000,000,044 | -H– | C] () – C:\Windows\SysNative\lxearwrd.ini
[2010/12/07 21:06:50 | 000,344,064 | —- | C] () – C:\Windows\SysWow64\lxeacomx.dll
[2010/12/07 21:06:50 | 000,331,776 | —- | C] () – C:\Windows\SysWow64\LXEAinst.dll
[2010/12/07 21:06:49 | 000,323,584 | —- | C] () – C:\Windows\SysWow64\lxeains.dll
[2010/12/07 21:06:49 | 000,262,144 | —- | C] () – C:\Windows\SysWow64\lxeainsb.dll
[2010/12/07 21:06:49 | 000,253,952 | —- | C] () – C:\Windows\SysWow64\lxeacu.dll
[2010/12/07 21:06:49 | 000,106,496 | —- | C] () – C:\Windows\SysWow64\lxeainsr.dll
[2010/12/07 21:06:49 | 000,090,112 | —- | C] () – C:\Windows\SysWow64\lxeacub.dll
[2010/12/07 21:06:49 | 000,057,344 | —- | C] () – C:\Windows\SysWow64\lxeajswr.dll
[2010/12/07 21:06:49 | 000,036,864 | —- | C] () – C:\Windows\SysWow64\lxeacur.dll
[2010/12/07 21:06:46 | 000,002,106 | —- | C] () – C:\Windows\SysWow64\lxea.loc
[2010/12/07 21:06:34 | 000,495,616 | —- | C] () – C:\Windows\SysNative\LXEAinst.dll
[2010/12/07 21:06:34 | 000,230,191 | —- | C] () – C:\Windows\SysNative\LexFiles.ulf
[2010/12/07 21:06:31 | 000,450,048 | —- | C] () – C:\Windows\SysNative\lxeains.dll
[2010/12/07 21:06:31 | 000,245,248 | —- | C] () – C:\Windows\SysNative\lxeainsb.dll
[2010/12/07 21:06:31 | 000,090,624 | —- | C] () – C:\Windows\SysNative\lxeainsr.dll
[2010/12/07 21:06:31 | 000,040,448 | —- | C] () – C:\Windows\SysNative\lxeajswr.dll
[2010/12/07 21:06:30 | 000,378,368 | —- | C] () – C:\Windows\SysNative\lxeacu.dll
[2010/12/07 21:06:30 | 000,298,496 | —- | C] () – C:\Windows\SysNative\lxeagrd.dll
[2010/12/07 21:06:30 | 000,073,216 | —- | C] () – C:\Windows\SysNative\lxeacub.dll
[2010/12/07 21:06:30 | 000,022,016 | —- | C] () – C:\Windows\SysNative\lxeacur.dll
[2010/12/07 21:06:29 | 000,002,106 | —- | C] () – C:\Windows\SysNative\lxea.loc
[2010/12/07 21:06:01 | 000,000,000 | —- | C] () – C:\ProgramData\UpdaterLog.txt
[2010/12/07 21:05:31 | 000,299,008 | —- | C] () – C:\Windows\SysWow64\LXEAsm.dll
[2010/12/07 21:05:31 | 000,023,552 | —- | C] () – C:\Windows\SysWow64\LXEAsmr.dll
[2010/12/07 21:05:31 | 000,023,552 | —- | C] () – C:\Windows\SysNative\lxeasmr.dll
[2010/12/07 21:05:30 | 000,381,440 | —- | C] () – C:\Windows\SysNative\lxeasm.dll
[2010/12/01 15:06:16 | 000,058,232 | —- | C] () – C:\Users\Ray\Desktop\Energy-Tapping-Points-Female-440x800.gif
[2010/11/21 08:21:04 | 000,000,564 | —- | C] () – C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2010/11/21 08:21:02 | 000,000,422 | —- | C] () – C:\Windows\tasks\SystemToolsDailyTest.job
[2010/11/20 01:08:53 | 000,001,134 | —- | C] () – C:\Users\Public\Desktop\Second Life Viewer 2.lnk
[2010/11/07 13:28:57 | 000,000,036 | —- | C] () – C:\Users\Ray\AppData\Local\housecall.guid.cache
[2010/10/30 13:11:49 | 000,007,626 | —- | C] () – C:\Users\Ray\AppData\Local\resmon.resmoncfg
[2010/09/23 21:13:58 | 000,177,664 | —- | C] () – C:\Windows\SysWow64\APOMngr.DLL
[2010/09/23 21:13:58 | 000,073,728 | —- | C] () – C:\Windows\SysWow64\CmdRtr.DLL
[2010/09/23 21:13:58 | 000,001,264 | —- | C] () – C:\Windows\THXCfg_SP_APOIM.ini
[2010/09/23 21:13:58 | 000,001,247 | —- | C] () – C:\Windows\THXCfg_HP_APOIM.ini
[2010/09/23 21:13:58 | 000,001,247 | —- | C] () – C:\Windows\THXCfg_APOIM.ini
[2009/07/13 15:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 13:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/01/05 15:44:10 | 000,000,453 | —- | C] () – C:\Windows\bdoscandellang.ini

========== LOP Check ==========

[2010/12/18 16:56:28 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\gtk-2.0
[2010/11/21 08:18:54 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\PCDr
[2010/12/09 10:20:51 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\PloppSL
[2010/12/14 16:05:37 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\QuickScan
[2010/12/12 19:05:46 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\S300-S400 Series
[2010/12/13 15:38:48 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\SecondLife
[2010/12/02 19:49:59 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\Vivox
[2010/12/12 13:15:39 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\Windows Live Writer
[2010/12/01 20:48:53 | 000,000,564 | —- | M] () – C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2009/07/13 21:08:49 | 000,008,166 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/12/19 12:01:13 | 000,000,422 | —- | M] () – C:\Windows\Tasks\SystemToolsDailyTest.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/09/23 23:36:40 | 000,004,586 | RH– | M] () – C:\dell.sdr
[2010/12/18 19:23:44 | 2146,930,687 | -HS- | M] () – C:\hiberfil.sys
[2010/12/18 19:23:46 | 4294,230,015 | -HS- | M] () – C:\pagefile.sys
[2010/12/15 06:59:38 | 000,000,361 | —- | M] () – C:\rkill.log

< %systemroot%\Fonts\*.com >
[2009/07/13 21:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 21:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 21:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 21:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 12:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/07 07:12:17 | 000,038,848 | —- | M] (AVAST Software) – C:\Windows\avastSS.scr
[2010/09/22 21:32:56 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 20:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/10/18 12:02:51 | 000,000,221 | -HS- | M] () – C:\Users\Ray\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/12/15 07:45:55 | 007,622,112 | —- | M] (Malwarebytes Corporation ) – C:\Users\Ray\Desktop\mbam-setup-1.50.0.0.exe
[2010/12/19 17:09:16 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Ray\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< >

< End of report >
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV:64bit: - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV:64bit: - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (lxeaCATSCustConnectService) – C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxeaserv.exe ()
SRV:64bit: - (lxea_device) – C:\Windows\SysNative\lxeacoms.exe ( )
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (DockLoginService) – C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (GoToAssist) – C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (SftService) – C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (lxea_device) – C:\Windows\SysWow64\lxeacoms.exe ( )
SRV - (AdobeActiveFileMonitor8.0) – c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (AMDFusionSVC) – c:\Program Files (x86)\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe (Advanced Micro Devices)
SRV - (RoxMediaDB10) – c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe (Sonic Solutions)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (AMD_RAIDXpert) – C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe (AMD)


========== Driver Services (SafeList) ==========

DRV:64bit: - (RxFilter) – C:\Windows\SysNative\DRIVERS\RxFilter.sys File not found
DRV:64bit: - (PCDSRVC{1E208CE0-FB7451FF-06020101}_0) – c:\Program Files\Dell Support Center\pcdsrvc_x64.pkms (PC-Doctor, Inc.)
DRV:64bit: - (aswMonFlt) – C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (AtiHdmiService) – C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (k57nd60a) Broadcom NetLink ™ – C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (ahcix64s) – C:\Windows\SysNative\drivers\ahcix64s.sys (Advanced Micro Devices, Inc)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (AmdLLD64) – C:\Windows\SysNative\drivers\AmdLLD64.sys (Advanced Micro Devices)
DRV:64bit: - (WimFltr) – C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (RxFilter) – C:\Windows\SysWOW64\drivers\RxFilter.sys (Sonic Solutions)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


[2010/12/02 19:47:22 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\Mozilla\Extensions
[2010/12/02 19:47:22 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\Mozilla\Extensions\[removed]

O1 HOSTS File: ([2009/06/10 13:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Lexmark Printable Web) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll ()
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe ()
O4:64bit: - HKLM..\Run: [lxeamon.exe] C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RunDLLEntry_EptMon] C:\Windows\system32\EptMon64.DLL File not found
O4:64bit: - HKLM..\Run: [RunDLLEntry_THXCfg] C:\Windows\system32\THXCfg64.DLL File not found
O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe ()
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe File not found
O4 - HKLM..\Run: [Lexmark S300-S400 Series] C:\Program Files (x86)\Lexmark S300-S400 Series\fm3032.exe ()
O4 - HKLM..\Run: [ShwiconXP9106] C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe (Alcor Micro Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [THX Audio Control Panel] C:\Program Files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\RunOnce: [DSUpdateLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe (Dell)
O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe (Softthinks)
O4 - HKLM..\RunOnce: [STToasterLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\ToasterLauncher.exe ()
O4 - HKLM..\RunOnceEx: [ContentMerger] c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\ContentMerger10.exe (Sonic Solutions)
O4 - Startup: C:\Users\Ray\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files (x86)\Dell\DellDock\DellDock.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} http://quickscan.bitdefender.com/qsax/qsax.cab (BitDefender QuickScan Control)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/…can8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/pub/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\cozi {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18 - Protocol\Handler\cozi {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - c:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll (Cozi Group, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - Reg Error: Key error. - C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/12/19 17:09:14 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Ray\Desktop\OTL.exe
[2010/12/16 09:41:00 | 001,169,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskschd.dll
[2010/12/16 09:41:00 | 000,524,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmicmiplugin.dll
[2010/12/16 09:41:00 | 000,496,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\taskschd.dll
[2010/12/16 09:41:00 | 000,473,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskcomp.dll
[2010/12/16 09:41:00 | 000,464,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskeng.exe
[2010/12/16 09:41:00 | 000,305,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\taskcomp.dll
[2010/12/16 09:41:00 | 000,285,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\schtasks.exe
[2010/12/16 09:41:00 | 000,179,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\schtasks.exe
[2010/12/16 09:40:58 | 000,367,104 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2010/12/16 09:40:58 | 000,294,400 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2010/12/16 09:40:58 | 000,046,080 | —- | C] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2010/12/16 09:40:58 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2010/12/16 09:40:57 | 000,395,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\webio.dll
[2010/12/16 09:40:57 | 000,314,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\webio.dll
[2010/12/16 09:40:55 | 000,112,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\consent.exe
[2010/12/16 09:40:50 | 000,703,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2010/12/16 09:40:50 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeeds.dll
[2010/12/16 09:40:50 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2010/12/16 09:40:49 | 000,482,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2010/12/16 09:40:49 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2010/12/16 09:40:49 | 000,256,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2010/12/16 09:40:49 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2010/12/16 09:40:49 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2010/12/16 09:40:49 | 000,097,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2010/12/16 09:40:49 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2010/12/16 09:40:49 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2010/12/16 09:40:49 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2010/12/16 09:40:49 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2010/12/16 09:40:49 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2010/12/15 07:46:33 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\Malwarebytes
[2010/12/15 07:46:28 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/12/15 07:46:28 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/12/15 07:46:25 | 000,024,152 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/12/15 07:46:25 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/12/15 07:45:47 | 007,622,112 | —- | C] (Malwarebytes Corporation ) – C:\Users\Ray\Desktop\mbam-setup-1.50.0.0.exe
[2010/12/15 05:48:08 | 000,000,000 | —D | C] – C:\Windows\BDOSCAN8
[2010/12/14 16:05:29 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\QuickScan
[2010/12/12 19:05:46 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\S300-S400 Series
[2010/12/07 22:36:28 | 000,000,000 | —D | C] – C:\ProgramData\Ezprint
[2010/12/07 21:53:21 | 000,000,000 | —D | C] – C:\ProgramData\Lx_cats
[2010/12/07 21:09:16 | 001,462,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lxk_g.dll
[2010/12/07 21:09:04 | 000,983,121 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lxk_gf.dll
[2010/12/07 21:08:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\Abbyy FineReader 6.0 Sprint
[2010/12/07 21:07:48 | 000,000,000 | —D | C] – C:\ProgramData\S300-S400 Series
[2010/12/07 21:07:42 | 000,000,000 | —D | C] – C:\Program Files\Lexmark Toolbar
[2010/12/07 21:07:40 | 000,510,464 | —- | C] (Lexmark International, Inc.) – C:\Windows\SysNative\LXEAwupd.dll
[2010/12/07 21:07:40 | 000,295,592 | —- | C] (Lexmark International, Inc.) – C:\Windows\SysNative\LXEAwupd.exe
[2010/12/07 21:07:21 | 000,000,000 | —D | C] – C:\Program Files\Lexmark
[2010/12/07 21:07:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\Lexmark Toolbar
[2010/12/07 21:06:57 | 000,000,000 | —D | C] – C:\Program Files\Lexmark Printable Web
[2010/12/07 21:06:50 | 000,364,544 | —- | C] ( ) – C:\Windows\SysWow64\lxeainpa.dll
[2010/12/07 21:06:50 | 000,344,064 | —- | C] ( ) – C:\Windows\SysWow64\lxeaiesc.dll
[2010/12/07 21:06:50 | 000,126,976 | —- | C] (Lexmark International Inc.) – C:\Windows\SysWow64\lxealnks.dll
[2010/12/07 21:06:49 | 000,847,872 | —- | C] ( ) – C:\Windows\SysWow64\lxeausb1.dll
[2010/12/07 21:06:49 | 000,643,072 | —- | C] ( ) – C:\Windows\SysWow64\lxeapmui.dll
[2010/12/07 21:06:48 | 001,048,576 | —- | C] ( ) – C:\Windows\SysWow64\lxeaserv.dll
[2010/12/07 21:06:48 | 000,577,536 | —- | C] ( ) – C:\Windows\SysWow64\lxealmpm.dll
[2010/12/07 21:06:48 | 000,324,264 | —- | C] ( ) – C:\Windows\SysWow64\lxeaih.exe
[2010/12/07 21:06:47 | 000,802,816 | —- | C] ( ) – C:\Windows\SysWow64\lxeacomc.dll
[2010/12/07 21:06:47 | 000,688,128 | —- | C] ( ) – C:\Windows\SysWow64\lxeahbn3.dll
[2010/12/07 21:06:47 | 000,598,696 | —- | C] ( ) – C:\Windows\SysWow64\lxeacoms.exe
[2010/12/07 21:06:47 | 000,373,416 | —- | C] ( ) – C:\Windows\SysWow64\lxeacfg.exe
[2010/12/07 21:06:47 | 000,372,736 | —- | C] ( ) – C:\Windows\SysWow64\lxeacomm.dll
[2010/12/07 21:06:46 | 000,086,186 | —- | C] (Lexmark International) – C:\Windows\SysWow64\LXEAcfg.dll
[2010/12/07 21:06:33 | 001,331,712 | —- | C] ( ) – C:\Windows\SysNative\lxeausb1.dll
[2010/12/07 21:06:33 | 000,557,568 | —- | C] ( ) – C:\Windows\SysNative\lxeainpa.dll
[2010/12/07 21:06:33 | 000,547,840 | —- | C] ( ) – C:\Windows\SysNative\LXEAhcp.dll
[2010/12/07 21:06:33 | 000,515,584 | —- | C] ( ) – C:\Windows\SysNative\lxeaiesc.dll
[2010/12/07 21:06:32 | 001,631,744 | —- | C] ( ) – C:\Windows\SysNative\lxeaserv.dll
[2010/12/07 21:06:32 | 000,979,968 | —- | C] ( ) – C:\Windows\SysNative\lxeapmui.dll
[2010/12/07 21:06:32 | 000,892,416 | —- | C] ( ) – C:\Windows\SysNative\lxealmpm.dll
[2010/12/07 21:06:31 | 001,104,384 | —- | C] ( ) – C:\Windows\SysNative\lxeahbn3.dll
[2010/12/07 21:06:31 | 000,520,872 | —- | C] ( ) – C:\Windows\SysNative\lxeaih.exe
[2010/12/07 21:06:30 | 001,052,328 | —- | C] ( ) – C:\Windows\SysNative\lxeacoms.exe
[2010/12/07 21:06:29 | 001,371,648 | —- | C] ( ) – C:\Windows\SysNative\lxeacomc.dll
[2010/12/07 21:06:29 | 000,612,008 | —- | C] ( ) – C:\Windows\SysNative\lxeacfg.exe
[2010/12/07 21:06:29 | 000,579,584 | —- | C] ( ) – C:\Windows\SysNative\lxeacomm.dll
[2010/12/07 21:06:29 | 000,075,264 | —- | C] (Lexmark International) – C:\Windows\SysNative\LXEAcfg.dll
[2010/12/07 21:06:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Lexmark S300-S400 Series
[2010/12/07 21:05:31 | 000,000,000 | —D | C] – C:\Program Files\Lexmark S300-S400 Series
[2010/12/03 15:43:02 | 000,000,000 | —D | C] – C:\ProgramData\ATI
[2010/12/03 15:41:35 | 000,000,000 | —D | C] – C:\Program Files\Common Files\ATI Technologies
[2010/12/03 15:41:35 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\ATI Technologies
[2010/12/02 19:49:59 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\Vivox
[2010/11/21 08:20:45 | 000,000,000 | —D | C] – C:\Program Files\Dell Support Center
[2010/11/21 08:18:54 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\PCDr
[2010/11/20 01:08:38 | 000,000,000 | —D | C] – C:\Program Files (x86)\SecondLifeViewer2

========== Files - Modified Within 30 Days ==========

[2010/12/19 18:16:42 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/12/19 17:09:16 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Ray\Desktop\OTL.exe
[2010/12/19 12:01:13 | 000,000,422 | —- | M] () – C:\Windows\tasks\SystemToolsDailyTest.job
[2010/12/18 19:31:07 | 000,014,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/12/18 19:31:07 | 000,014,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/12/18 19:29:50 | 000,726,316 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/12/18 19:29:50 | 000,623,940 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/12/18 19:29:50 | 000,106,316 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/12/18 19:23:44 | 2146,930,687 | -HS- | M] () – C:\hiberfil.sys
[2010/12/18 17:58:37 | 000,011,763 | —- | M] () – C:\Users\Ray\Desktop\hijackthisnew
[2010/12/18 17:49:29 | 000,011,653 | —- | M] () – C:\Users\Ray\Desktop\hijackthis dec eighteenth
[2010/12/18 17:09:50 | 000,023,715 | —- | M] () – C:\Users\Ray\.recently-used.xbel
[2010/12/18 16:56:28 | 011,535,714 | —- | M] () – C:\Users\Ray\Desktop\Phelps Family.tga
[2010/12/18 16:34:25 | 000,600,312 | —- | M] () – C:\Users\Ray\Desktop\Cadence flower yellow_001.png
[2010/12/18 16:25:44 | 005,723,521 | —- | M] () – C:\Users\Ray\Desktop\yellow-flower-.tga
[2010/12/18 15:42:06 | 001,169,537 | —- | M] () – C:\Users\Ray\Desktop\bells.png
[2010/12/18 15:38:15 | 000,202,709 | —- | M] () – C:\Users\Ray\Desktop\poinsettia6.jpg
[2010/12/18 15:35:50 | 000,057,522 | —- | M] () – C:\Users\Ray\Desktop\Poinsettia_Wallpaper_18mr.jpg
[2010/12/17 16:28:05 | 006,781,470 | —- | M] () – C:\Users\Ray\Desktop\Pig Meat.PDF
[2010/12/17 15:47:28 | 000,122,653 | —- | M] () – C:\Users\Ray\Desktop\ice tower 2.jpg
[2010/12/17 15:47:27 | 000,129,095 | —- | M] () – C:\Users\Ray\Desktop\ice tower.jpg
[2010/12/17 03:18:47 | 000,324,976 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2010/12/15 07:46:28 | 000,001,111 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/15 07:45:55 | 007,622,112 | —- | M] (Malwarebytes Corporation ) – C:\Users\Ray\Desktop\mbam-setup-1.50.0.0.exe
[2010/12/15 06:59:01 | 000,660,752 | —- | M] () – C:\Users\Ray\Desktop\rkill.com
[2010/12/14 20:41:28 | 000,147,337 | —- | M] () – C:\Users\Ray\Desktop\star-of-bethlehem-wallpaper-source_bff.jpg
[2010/12/14 20:33:19 | 000,241,958 | —- | M] () – C:\Users\Ray\Desktop\gerbera-flower-wallpaper-wide-full-hd%20127.jpg
[2010/12/13 16:25:57 | 002,920,803 | —- | M] () – C:\Users\Ray\Desktop\Pharaoh, Chief and Cadence…X-mas 2010_001.png
[2010/12/12 13:14:21 | 001,126,360 | —- | M] () – C:\Users\Ray\Desktop\sugar babe 2.PDF
[2010/12/12 13:11:47 | 002,308,724 | —- | M] () – C:\Users\Ray\Desktop\sugar babe.PDF
[2010/12/12 01:26:46 | 000,084,837 | —- | M] () – C:\Users\Ray\Desktop\christhelioszodiac.jpg
[2010/12/09 10:14:39 | 000,001,524 | —- | M] () – C:\Users\Ray\Desktop\Cadence vinette - Shortcut.lnk
[2010/12/07 21:10:02 | 000,230,191 | —- | M] () – C:\Windows\SysNative\LexFiles.ulf
[2010/12/01 20:48:53 | 000,000,564 | —- | M] () – C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2010/12/01 15:02:26 | 000,058,232 | —- | M] () – C:\Users\Ray\Desktop\Energy-Tapping-Points-Female-440x800.gif
[2010/11/29 17:42:18 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/11/29 17:42:06 | 000,024,152 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/11/20 01:08:53 | 000,001,134 | —- | M] () – C:\Users\Public\Desktop\Second Life Viewer 2.lnk

========== Files Created - No Company Name ==========

[2010/12/18 17:58:37 | 000,011,763 | —- | C] () – C:\Users\Ray\Desktop\hijackthisnew
[2010/12/18 17:49:29 | 000,011,653 | —- | C] () – C:\Users\Ray\Desktop\hijackthis dec eighteenth
[2010/12/18 17:09:50 | 000,023,715 | —- | C] () – C:\Users\Ray\.recently-used.xbel
[2010/12/18 16:56:28 | 011,535,714 | —- | C] () – C:\Users\Ray\Desktop\Phelps Family.tga
[2010/12/18 16:34:25 | 000,600,312 | —- | C] () – C:\Users\Ray\Desktop\Cadence flower yellow_001.png
[2010/12/18 15:42:24 | 001,169,537 | —- | C] () – C:\Users\Ray\Desktop\bells.png
[2010/12/18 15:39:02 | 000,202,709 | —- | C] () – C:\Users\Ray\Desktop\poinsettia6.jpg
[2010/12/18 15:36:00 | 000,057,522 | —- | C] () – C:\Users\Ray\Desktop\Poinsettia_Wallpaper_18mr.jpg
[2010/12/18 04:41:35 | 005,723,521 | —- | C] () – C:\Users\Ray\Desktop\yellow-flower-.tga
[2010/12/17 16:27:58 | 006,781,470 | —- | C] () – C:\Users\Ray\Desktop\Pig Meat.PDF
[2010/12/17 15:49:13 | 000,122,653 | —- | C] () – C:\Users\Ray\Desktop\ice tower 2.jpg
[2010/12/17 15:48:49 | 000,129,095 | —- | C] () – C:\Users\Ray\Desktop\ice tower.jpg
[2010/12/15 07:46:28 | 000,001,111 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/15 06:58:45 | 000,660,752 | —- | C] () – C:\Users\Ray\Desktop\rkill.com
[2010/12/14 20:41:42 | 000,147,337 | —- | C] () – C:\Users\Ray\Desktop\star-of-bethlehem-wallpaper-source_bff.jpg
[2010/12/14 20:33:26 | 000,241,958 | —- | C] () – C:\Users\Ray\Desktop\gerbera-flower-wallpaper-wide-full-hd%20127.jpg
[2010/12/13 16:25:52 | 002,920,803 | —- | C] () – C:\Users\Ray\Desktop\Pharaoh, Chief and Cadence…X-mas 2010_001.png
[2010/12/12 13:14:13 | 001,126,360 | —- | C] () – C:\Users\Ray\Desktop\sugar babe 2.PDF
[2010/12/12 13:11:31 | 002,308,724 | —- | C] () – C:\Users\Ray\Desktop\sugar babe.PDF
[2010/12/12 01:45:23 | 000,084,837 | —- | C] () – C:\Users\Ray\Desktop\christhelioszodiac.jpg
[2010/12/09 10:14:39 | 000,001,524 | —- | C] () – C:\Users\Ray\Desktop\Cadence vinette - Shortcut.lnk
[2010/12/07 22:36:27 | 000,000,252 | —- | C] () – C:\ProgramData\FastPics.log
[2010/12/07 22:36:20 | 000,002,780 | —- | C] () – C:\ProgramData\lxeaJSW.log
[2010/12/07 21:09:19 | 000,109,056 | —- | C] () – C:\Windows\SysNative\lxeavs.dll
[2010/12/07 21:09:05 | 000,065,106 | —- | C] () – C:\Windows\SysNative\lxeaprpr.chm
[2010/12/07 21:09:04 | 000,065,536 | —- | C] () – C:\Windows\SysNative\lxeagcfg.dll
[2010/12/07 21:09:02 | 000,399,360 | —- | C] () – C:\Windows\SysNative\lxeacui.dll
[2010/12/07 21:09:02 | 000,148,480 | —- | C] () – C:\Windows\SysNative\lxeacuir.dll
[2010/12/07 21:09:02 | 000,008,694 | —- | C] () – C:\Windows\SysNative\lxeacommuilogo_rtl.bmp
[2010/12/07 21:09:02 | 000,008,694 | —- | C] () – C:\Windows\SysNative\lxeacommuilogo.bmp
[2010/12/07 21:09:00 | 000,008,191 | —- | C] () – C:\ProgramData\lxeascan.log
[2010/12/07 21:07:51 | 004,485,120 | —- | C] () – C:\Windows\SysNative\LXEAoem.dll
[2010/12/07 21:07:51 | 000,053,760 | —- | C] () – C:\Windows\SysNative\LXEAPMON.DLL
[2010/12/07 21:07:51 | 000,021,504 | —- | C] () – C:\Windows\SysNative\LXEAFXPU.DLL
[2010/12/07 21:07:51 | 000,003,584 | —- | C] () – C:\Windows\SysNative\LXEAPMRC.DLL
[2010/12/07 21:06:52 | 000,000,044 | -H– | C] () – C:\Windows\SysNative\lxearwrd.ini
[2010/12/07 21:06:50 | 000,344,064 | —- | C] () – C:\Windows\SysWow64\lxeacomx.dll
[2010/12/07 21:06:50 | 000,331,776 | —- | C] () – C:\Windows\SysWow64\LXEAinst.dll
[2010/12/07 21:06:49 | 000,323,584 | —- | C] () – C:\Windows\SysWow64\lxeains.dll
[2010/12/07 21:06:49 | 000,262,144 | —- | C] () – C:\Windows\SysWow64\lxeainsb.dll
[2010/12/07 21:06:49 | 000,253,952 | —- | C] () – C:\Windows\SysWow64\lxeacu.dll
[2010/12/07 21:06:49 | 000,106,496 | —- | C] () – C:\Windows\SysWow64\lxeainsr.dll
[2010/12/07 21:06:49 | 000,090,112 | —- | C] () – C:\Windows\SysWow64\lxeacub.dll
[2010/12/07 21:06:49 | 000,057,344 | —- | C] () – C:\Windows\SysWow64\lxeajswr.dll
[2010/12/07 21:06:49 | 000,036,864 | —- | C] () – C:\Windows\SysWow64\lxeacur.dll
[2010/12/07 21:06:46 | 000,002,106 | —- | C] () – C:\Windows\SysWow64\lxea.loc
[2010/12/07 21:06:34 | 000,495,616 | —- | C] () – C:\Windows\SysNative\LXEAinst.dll
[2010/12/07 21:06:34 | 000,230,191 | —- | C] () – C:\Windows\SysNative\LexFiles.ulf
[2010/12/07 21:06:31 | 000,450,048 | —- | C] () – C:\Windows\SysNative\lxeains.dll
[2010/12/07 21:06:31 | 000,245,248 | —- | C] () – C:\Windows\SysNative\lxeainsb.dll
[2010/12/07 21:06:31 | 000,090,624 | —- | C] () – C:\Windows\SysNative\lxeainsr.dll
[2010/12/07 21:06:31 | 000,040,448 | —- | C] () – C:\Windows\SysNative\lxeajswr.dll
[2010/12/07 21:06:30 | 000,378,368 | —- | C] () – C:\Windows\SysNative\lxeacu.dll
[2010/12/07 21:06:30 | 000,298,496 | —- | C] () – C:\Windows\SysNative\lxeagrd.dll
[2010/12/07 21:06:30 | 000,073,216 | —- | C] () – C:\Windows\SysNative\lxeacub.dll
[2010/12/07 21:06:30 | 000,022,016 | —- | C] () – C:\Windows\SysNative\lxeacur.dll
[2010/12/07 21:06:29 | 000,002,106 | —- | C] () – C:\Windows\SysNative\lxea.loc
[2010/12/07 21:06:01 | 000,000,000 | —- | C] () – C:\ProgramData\UpdaterLog.txt
[2010/12/07 21:05:31 | 000,299,008 | —- | C] () – C:\Windows\SysWow64\LXEAsm.dll
[2010/12/07 21:05:31 | 000,023,552 | —- | C] () – C:\Windows\SysWow64\LXEAsmr.dll
[2010/12/07 21:05:31 | 000,023,552 | —- | C] () – C:\Windows\SysNative\lxeasmr.dll
[2010/12/07 21:05:30 | 000,381,440 | —- | C] () – C:\Windows\SysNative\lxeasm.dll
[2010/12/01 15:06:16 | 000,058,232 | —- | C] () – C:\Users\Ray\Desktop\Energy-Tapping-Points-Female-440x800.gif
[2010/11/21 08:21:04 | 000,000,564 | —- | C] () – C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2010/11/21 08:21:02 | 000,000,422 | —- | C] () – C:\Windows\tasks\SystemToolsDailyTest.job
[2010/11/20 01:08:53 | 000,001,134 | —- | C] () – C:\Users\Public\Desktop\Second Life Viewer 2.lnk
[2010/11/07 13:28:57 | 000,000,036 | —- | C] () – C:\Users\Ray\AppData\Local\housecall.guid.cache
[2010/10/30 13:11:49 | 000,007,626 | —- | C] () – C:\Users\Ray\AppData\Local\resmon.resmoncfg
[2010/09/23 21:13:58 | 000,177,664 | —- | C] () – C:\Windows\SysWow64\APOMngr.DLL
[2010/09/23 21:13:58 | 000,073,728 | —- | C] () – C:\Windows\SysWow64\CmdRtr.DLL
[2010/09/23 21:13:58 | 000,001,264 | —- | C] () – C:\Windows\THXCfg_SP_APOIM.ini
[2010/09/23 21:13:58 | 000,001,247 | —- | C] () – C:\Windows\THXCfg_HP_APOIM.ini
[2010/09/23 21:13:58 | 000,001,247 | —- | C] () – C:\Windows\THXCfg_APOIM.ini
[2009/07/13 15:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 13:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/01/05 15:44:10 | 000,000,453 | —- | C] () – C:\Windows\bdoscandellang.ini

========== LOP Check ==========

[2010/12/18 16:56:28 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\gtk-2.0
[2010/11/21 08:18:54 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\PCDr
[2010/12/09 10:20:51 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\PloppSL
[2010/12/14 16:05:37 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\QuickScan
[2010/12/12 19:05:46 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\S300-S400 Series
[2010/12/13 15:38:48 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\SecondLife
[2010/12/02 19:49:59 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\Vivox
[2010/12/12 13:15:39 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\Windows Live Writer
[2010/12/01 20:48:53 | 000,000,564 | —- | M] () – C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2009/07/13 21:08:49 | 000,008,166 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/12/19 12:01:13 | 000,000,422 | —- | M] () – C:\Windows\Tasks\SystemToolsDailyTest.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/09/23 23:36:40 | 000,004,586 | RH– | M] () – C:\dell.sdr
[2010/12/18 19:23:44 | 2146,930,687 | -HS- | M] () – C:\hiberfil.sys
[2010/12/18 19:23:46 | 4294,230,015 | -HS- | M] () – C:\pagefile.sys
[2010/12/15 06:59:38 | 000,000,361 | —- | M] () – C:\rkill.log

< %systemroot%\Fonts\*.com >
[2009/07/13 21:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 21:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 21:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 21:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 12:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/07 07:12:17 | 000,038,848 | —- | M] (AVAST Software) – C:\Windows\avastSS.scr
[2010/09/22 21:32:56 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 20:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/10/18 12:02:51 | 000,000,221 | -HS- | M] () – C:\Users\Ray\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/12/15 07:45:55 | 007,622,112 | —- | M] (Malwarebytes Corporation ) – C:\Users\Ray\Desktop\mbam-setup-1.50.0.0.exe
[2010/12/19 17:09:16 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Ray\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< >

< End of report >

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Next:


Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

• Ensure all Firefox windows are closed.
• To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
• When prompted to run the scan, click Yes.
• It doesn't take long to run, once it is finished move onto the next step

Next:

Note: if the Cure option is not there, please select 'Skip'.

Please read carefully and follow these steps.

• Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan
    
    • Only if Malicious objects are found then ensure Cure is selected
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    
    • A copy of the log will be saved automatically to the root directory, root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
  please post the contents of that log TDSSKiller and GooredFix log.

the cobo fix log before pasting I tried the email program just prior to coming here online and it closed imediately , other than that its a fairly new puter for me so hard to tell much more about it till Ive been on a bit anyway, here the log and tyvm for all your help; ComboFix 10-12-21.01 - Ray 12/21/2010 16:58:44.1.6 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.8191.6743 [GMT -8:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308} SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\programdata\PCDr\5744\Downloads\5a6257cc-a15e-41eb-b891-52f7e087b40f.dll c:\programdata\PCDr\5744\Downloads\829c9bac-1bf5-403a-b818-5c5be7f0fff6.dll c:\programdata\PCDr\5744\Downloads\c229b02b-4e01-43e4-9587-37961f6873bc.dll c:\programdata\PCDr\5744\Downloads\d242df42-c817-4c92-8e27-a770772ec980.dll c:\programdata\PCDr\5744\Downloads\ef253e79-80d5-4656-b429-008ec2e1d22e.dll c:\programdata\PCDr\5744\Downloads\fbaabbe1-30af-47f6-a8e1-dfd8bbc2f468.dll c:\users\Ray\AppData\Local\Temp\80E1.tmp c:\users\Ray\GoToAssistDownloadHelper.exe . ((((((((((((((((((((((((( Files Created from 2010-11-22 to 2010-12-22 ))))))))))))))))))))))))))))))) . 2010-12-22 01:01 . 2010-12-22 01:01 ——– d—–w- c:\users\Default\AppData\Local\temp 2010-12-21 15:30 . 2010-11-10 05:35 8199504 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{80F5257A-BBA4-4F07-9DC2-B11F1CDE5E97}\mpengine.dll 2010-12-21 04:59 . 2010-12-21 04:59 ——– d—–w- c:\programdata\Lexmark S300-S400 Series 2010-12-20 20:08 . 2010-11-13 02:53 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll 2010-12-16 17:41 . 2010-10-27 05:06 2048 —-a-w- c:\windows\system32\tzres.dll 2010-12-16 17:41 . 2010-10-27 04:32 2048 —-a-w- c:\windows\SysWow64\tzres.dll 2010-12-16 17:41 . 2010-11-02 05:18 524288 —-a-w- c:\windows\system32\wmicmiplugin.dll 2010-12-16 17:41 . 2010-11-02 05:17 473600 —-a-w- c:\windows\system32\taskcomp.dll 2010-12-16 17:41 . 2010-11-02 05:17 1169408 —-a-w- c:\windows\system32\taskschd.dll 2010-12-16 17:41 . 2010-11-02 05:16 1114624 —-a-w- c:\windows\system32\schedsvc.dll 2010-12-16 17:41 . 2010-11-02 05:10 464384 —-a-w- c:\windows\system32\taskeng.exe 2010-12-16 17:41 . 2010-11-02 05:10 285696 —-a-w- c:\windows\system32\schtasks.exe 2010-12-16 17:41 . 2010-11-02 04:40 496128 —-a-w- c:\windows\SysWow64\taskschd.dll 2010-12-16 17:41 . 2010-11-02 04:40 305152 —-a-w- c:\windows\SysWow64\taskcomp.dll 2010-12-16 17:41 . 2010-11-02 04:34 192000 —-a-w- c:\windows\SysWow64\taskeng.exe 2010-12-16 17:41 . 2010-11-02 04:34 179712 —-a-w- c:\windows\SysWow64\schtasks.exe 2010-12-15 15:46 . 2010-12-15 15:46 ——– d—–w- c:\users\Ray\AppData\Roaming\Malwarebytes 2010-12-15 15:46 . 2010-12-15 15:46 ——– d—–w- c:\programdata\Malwarebytes 2010-12-15 15:46 . 2010-11-30 01:42 38224 —-a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2010-12-15 15:46 . 2010-12-15 15:46 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2010-12-15 15:46 . 2010-11-30 01:42 24152 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-12-15 13:48 . 2010-12-15 15:43 ——– d—–w- c:\windows\BDOSCAN8 2010-12-15 00:05 . 2010-12-15 00:05 ——– d—–w- c:\users\Ray\AppData\Roaming\QuickScan 2010-12-13 03:05 . 2010-12-13 03:05 ——– d—–w- c:\users\Ray\AppData\Roaming\S300-S400 Series 2010-12-08 06:36 . 2010-12-08 06:36 ——– d—–w- c:\programdata\Ezprint 2010-12-08 05:53 . 2010-12-21 04:16 ——– d—–w- c:\programdata\Lx_cats 2010-12-08 05:09 . 2009-11-04 21:18 189440 —-a-w- c:\windows\system32\Spool\prtprocs\x64\lxeadrpp.dll 2010-12-08 05:09 . 2008-03-05 02:55 109056 —-a-w- c:\windows\system32\lxeavs.dll 2010-12-08 05:09 . 2008-04-30 06:32 1462272 —-a-w- c:\windows\system32\lxk_g.dll 2010-12-08 05:09 . 2009-11-09 08:06 65536 —-a-w- c:\windows\system32\lxeagcfg.dll 2010-12-08 05:09 . 2008-04-30 06:32 983121 —-a-w- c:\windows\system32\lxk_gf.dll 2010-12-08 05:09 . 2009-10-21 10:06 148480 —-a-w- c:\windows\system32\lxeacuir.dll 2010-12-08 05:09 . 2009-10-21 10:06 399360 —-a-w- c:\windows\system32\lxeacui.dll 2010-12-08 05:08 . 2010-12-08 05:08 ——– d—–w- c:\program files (x86)\Abbyy FineReader 6.0 Sprint 2010-12-08 05:07 . 2009-12-31 06:17 3584 —-a-w- c:\windows\system32\LXEAPMRC.DLL 2010-12-08 05:07 . 2009-12-31 06:17 53760 —-a-w- c:\windows\system32\LXEAPMON.DLL 2010-12-08 05:07 . 2009-12-31 06:17 21504 —-a-w- c:\windows\system32\LXEAFXPU.DLL 2010-12-08 05:07 . 2009-01-13 13:15 4485120 —-a-w- c:\windows\system32\LXEAoem.dll 2010-12-08 05:07 . 2010-12-08 05:07 ——– d—–w- c:\programdata\S300-S400 Series 2010-12-08 05:07 . 2010-12-08 05:07 ——– d—–w- c:\program files\Lexmark Toolbar 2010-12-08 05:07 . 2010-01-07 21:08 295592 —-a-w- c:\windows\system32\LXEAwupd.exe 2010-12-08 05:07 . 2009-04-23 13:36 510464 —-a-w- c:\windows\system32\LXEAwupd.dll 2010-12-08 05:07 . 2010-12-08 05:08 ——– d—–w- c:\program files\Lexmark 2010-12-08 05:07 . 2010-12-08 05:07 ——– d—–w- c:\program files (x86)\Lexmark Toolbar 2010-12-08 05:05 . 2010-12-08 05:09 ——– d—–w- c:\program files\Lexmark S300-S400 Series 2010-12-08 05:05 . 2009-02-20 08:48 23552 —-a-w- c:\windows\SysWow64\LXEAsmr.dll 2010-12-08 05:05 . 2009-02-20 08:48 23552 —-a-w- c:\windows\system32\lxeasmr.dll 2010-12-08 05:05 . 2009-02-20 08:48 299008 —-a-w- c:\windows\SysWow64\LXEAsm.dll 2010-12-08 05:05 . 2009-02-20 08:48 381440 —-a-w- c:\windows\system32\lxeasm.dll 2010-12-03 23:43 . 2010-12-03 23:43 ——– d—–w- c:\programdata\ATI 2010-12-03 23:41 . 2010-12-03 23:41 ——– d—–w- c:\program files\Common Files\ATI Technologies 2010-12-03 23:41 . 2010-12-03 23:41 ——– d—–w- c:\program files (x86)\Common Files\ATI Technologies 2010-12-03 03:49 . 2010-12-03 03:49 ——– d—–w- c:\users\Ray\AppData\Roaming\Vivox 2010-11-24 16:03 . 2010-10-19 08:47 7680 —-a-w- c:\program files\Internet Explorer\iecompat.dll 2010-11-24 16:03 . 2010-10-19 08:10 7680 —-a-w- c:\program files (x86)\Internet Explorer\iecompat.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-10-19 18:41 . 2010-10-18 20:46 270720 ——w- c:\windows\system32\MpSigStub.exe 2010-10-19 14:28 . 2010-10-19 14:28 388096 —-a-r- c:\users\Ray\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2010-09-24 07:34 . 2010-09-24 07:34 51712 —-a-w- c:\windows\system32\drivers\usbehci.sys 2010-09-24 07:34 . 2010-09-24 07:34 343040 —-a-w- c:\windows\system32\drivers\usbhub.sys 2010-09-24 07:34 . 2010-09-24 07:34 243712 —-a-w- c:\windows\system32\drivers\ks.sys 2010-09-24 07:34 . 2010-09-24 07:34 286720 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys 2010-09-24 07:34 . 2010-09-24 07:34 157696 —-a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-09-24 07:34 . 2010-09-24 07:34 125952 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys 2010-09-24 07:34 . 2010-09-24 07:34 70656 —-a-w- c:\windows\SysWow64\fontsub.dll 2010-09-24 07:34 . 2010-09-24 07:34 46592 —-a-w- c:\windows\system32\msasn1.dll 2010-09-24 07:34 . 2010-09-24 07:34 34816 —-a-w- c:\windows\SysWow64\msasn1.dll 2010-09-24 07:34 . 2010-09-24 07:34 100864 —-a-w- c:\windows\system32\fontsub.dll 2010-09-24 07:34 . 2010-09-24 07:34 91648 —-a-w- c:\windows\SysWow64\avifil32.dll 2010-09-24 07:34 . 2010-09-24 07:34 84480 —-a-w- c:\windows\SysWow64\mciavi32.dll 2010-09-24 07:34 . 2010-09-24 07:34 7680 —-a-w- c:\windows\SysWow64\instnm.exe 2010-09-24 07:34 . 2010-09-24 07:34 54272 —-a-w- c:\windows\system32\iyuv_32.dll 2010-09-24 07:34 . 2010-09-24 07:34 5120 —-a-w- c:\windows\SysWow64\wow32.dll 2010-09-24 07:34 . 2010-09-24 07:34 50176 —-a-w- c:\windows\SysWow64\iyuv_32.dll 2010-09-24 07:34 . 2010-09-24 07:34 44032 —-a-w- c:\windows\apppatch\acwow64.dll 2010-09-24 07:34 . 2010-09-24 07:34 38912 —-a-w- c:\windows\system32\msvidc32.dll 2010-09-24 07:34 . 2010-09-24 07:34 31744 —-a-w- c:\windows\SysWow64\msvidc32.dll 2010-09-24 07:34 . 2010-09-24 07:34 311808 —-a-w- c:\windows\system32\msv1_0.dll 2010-09-24 07:34 . 2010-09-24 07:34 257024 —-a-w- c:\windows\SysWow64\msv1_0.dll 2010-09-24 07:34 . 2010-09-24 07:34 25600 —-a-w- c:\windows\SysWow64\setup16.exe 2010-09-24 07:34 . 2010-09-24 07:34 25088 —-a-w- c:\windows\system32\msyuv.dll 2010-09-24 07:34 . 2010-09-24 07:34 243200 —-a-w- c:\windows\system32\wow64.dll 2010-09-24 07:34 . 2010-09-24 07:34 22016 —-a-w- c:\windows\SysWow64\msyuv.dll 2010-09-24 07:34 . 2010-09-24 07:34 2048 —-a-w- c:\windows\SysWow64\user.exe 2010-09-24 07:34 . 2010-09-24 07:34 16384 —-a-w- c:\windows\system32\msrle32.dll 2010-09-24 07:34 . 2010-09-24 07:34 1572352 —-a-w- c:\windows\system32\quartz.dll 2010-09-24 07:34 . 2010-09-24 07:34 14848 —-a-w- c:\windows\system32\tsbyuv.dll 2010-09-24 07:34 . 2010-09-24 07:34 14336 —-a-w- c:\windows\SysWow64\ntvdm64.dll 2010-09-24 07:34 . 2010-09-24 07:34 13312 —-a-w- c:\windows\SysWow64\msrle32.dll 2010-09-24 07:34 . 2010-09-24 07:34 1328640 —-a-w- c:\windows\SysWow64\quartz.dll 2010-09-24 07:34 . 2010-09-24 07:34 12288 —-a-w- c:\windows\SysWow64\tsbyuv.dll 2010-09-24 07:34 . 2010-09-24 07:34 389632 —-a-w- c:\windows\system32\winlogon.exe 2010-09-24 07:34 . 2010-09-24 07:34 2870272 —-a-w- c:\windows\explorer.exe 2010-09-24 07:34 . 2010-09-24 07:34 2614272 —-a-w- c:\windows\SysWow64\explorer.exe 2010-09-24 07:34 . 2010-09-24 07:34 96768 —-a-w- c:\windows\SysWow64\sspicli.dll 2010-09-24 07:34 . 2010-09-24 07:34 22016 —-a-w- c:\windows\SysWow64\secur32.dll 2010-09-24 07:34 . 2010-09-24 07:34 153160 —-a-w- c:\windows\system32\drivers\ksecpkg.sys 2010-09-24 07:34 . 2010-09-24 07:34 1446912 —-a-w- c:\windows\system32\lsasrv.dll 2010-09-24 07:34 . 2010-09-24 07:34 982600 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys 2010-09-24 07:34 . 2010-09-24 07:34 612352 —-a-w- c:\windows\system32\vbscript.dll 2010-09-24 07:34 . 2010-09-24 07:34 427520 —-a-w- c:\windows\SysWow64\vbscript.dll 2010-09-24 07:34 . 2010-09-24 07:34 228864 —-a-w- c:\windows\system32\drivers\1394ohci.sys 2010-09-24 07:34 . 2010-09-24 07:34 144384 —-a-w- c:\windows\system32\cdd.dll 2010-09-24 07:34 . 2010-09-24 07:34 976896 —-a-w- c:\windows\system32\inetcomm.dll 2010-09-24 07:34 . 2010-09-24 07:34 85504 —-a-w- c:\windows\SysWow64\secproc_ssp_isv.dll 2010-09-24 07:34 . 2010-09-24 07:34 85504 —-a-w- c:\windows\SysWow64\secproc_ssp.dll 2010-09-24 07:34 . 2010-09-24 07:34 740864 —-a-w- c:\windows\SysWow64\inetcomm.dll 2010-09-24 07:34 . 2010-09-24 07:34 613888 —-a-w- c:\windows\system32\psisdecd.dll 2010-09-24 07:34 . 2010-09-24 07:34 465408 —-a-w- c:\windows\SysWow64\psisdecd.dll 2010-09-24 07:34 . 2010-09-24 07:34 424960 —-a-w- c:\windows\system32\secproc.dll 2010-09-24 07:34 . 2010-09-24 07:34 422912 —-a-w- c:\windows\system32\secproc_isv.dll 2010-09-24 07:34 . 2010-09-24 07:34 369152 —-a-w- c:\windows\SysWow64\secproc.dll 2010-09-24 07:34 . 2010-09-24 07:34 365568 —-a-w- c:\windows\SysWow64\secproc_isv.dll 2010-09-24 07:34 . 2010-09-24 07:34 357888 —-a-w- c:\windows\system32\RMActivate_isv.exe 2010-09-24 07:34 . 2010-09-24 07:34 356352 —-a-w- c:\windows\system32\RMActivate.exe 2010-09-24 07:34 . 2010-09-24 07:34 324608 —-a-w- c:\windows\SysWow64\RMActivate_isv.exe 2010-09-24 07:34 . 2010-09-24 07:34 320512 —-a-w- c:\windows\SysWow64\RMActivate.exe 2010-09-24 07:34 . 2010-09-24 07:34 306688 —-a-w- c:\windows\system32\RMActivate_ssp.exe 2010-09-24 07:34 . 2010-09-24 07:34 305152 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe 2010-09-24 07:34 . 2010-09-24 07:34 280064 —-a-w- c:\windows\SysWow64\RMActivate_ssp.exe 2010-09-24 07:34 . 2010-09-24 07:34 277504 —-a-w- c:\windows\SysWow64\RMActivate_ssp_isv.exe 2010-09-24 07:34 . 2010-09-24 07:34 1736608 —-a-w- c:\windows\system32\ntdll.dll 2010-09-24 07:34 . 2010-09-24 07:34 1289528 —-a-w- c:\windows\SysWow64\ntdll.dll 2010-09-24 07:34 . 2010-09-24 07:34 121856 —-a-w- c:\windows\system32\secproc_ssp_isv.dll 2010-09-24 07:34 . 2010-09-24 07:34 121856 —-a-w- c:\windows\system32\secproc_ssp.dll 2010-09-24 07:34 . 2010-09-24 07:34 84992 —-a-w- c:\windows\system32\asycfilt.dll 2010-09-24 07:34 . 2010-09-24 07:34 67584 —-a-w- c:\windows\SysWow64\asycfilt.dll 2010-09-24 07:34 . 2010-09-24 07:34 220672 —-a-w- c:\windows\system32\wintrust.dll 2010-09-24 07:34 . 2010-09-24 07:34 1975296 —-a-w- c:\windows\system32\CertEnroll.dll 2010-09-24 07:34 . 2010-09-24 07:34 172032 —-a-w- c:\windows\SysWow64\wintrust.dll 2010-09-24 07:34 . 2010-09-24 07:34 14336 —-a-w- c:\windows\system32\drivers\sffp_sd.sys 2010-09-24 07:34 . 2010-09-24 07:34 139264 —-a-w- c:\windows\system32\cabview.dll 2010-09-24 07:34 . 2010-09-24 07:34 132608 —-a-w- c:\windows\SysWow64\cabview.dll 2010-09-24 07:34 . 2010-09-24 07:34 1320960 —-a-w- c:\windows\SysWow64\CertEnroll.dll 2010-09-24 07:34 . 2010-09-24 07:34 91648 —-a-w- c:\windows\system32\isoburn.exe 2010-09-24 07:34 . 2010-09-24 07:34 86528 —-a-w- c:\windows\SysWow64\isoburn.exe 2010-09-24 07:34 . 2010-09-24 07:34 78848 —-a-w- c:\windows\system32\WUDFSvc.dll 2010-09-24 07:34 . 2010-09-24 07:34 687616 —-a-w- c:\windows\system32\WUDFx.dll 2010-09-24 07:34 . 2010-09-24 07:34 630272 —-a-w- c:\windows\system32\evr.dll 2010-09-24 07:34 . 2010-09-24 07:34 488448 —-a-w- c:\windows\SysWow64\evr.dll 2010-09-24 07:34 . 2010-09-24 07:34 44544 —-a-w- c:\windows\system32\WUDFCoinstaller.dll 2010-09-24 07:34 . 2010-09-24 07:34 228864 —-a-w- c:\windows\system32\WUDFHost.exe 2010-09-24 07:34 . 2010-09-24 07:34 183808 —-a-w- c:\windows\system32\WUDFPlatform.dll 2010-09-24 07:34 . 2010-09-24 07:34 172544 —-a-w- c:\windows\system32\drivers\WUDFRd.sys 2010-09-24 07:34 . 2010-09-24 07:34 112640 —-a-w- c:\windows\system32\drivers\WUDFPf.sys 2010-09-24 07:34 . 2010-09-24 07:34 514560 —-a-w- c:\windows\SysWow64\qdvd.dll 2010-09-24 07:34 . 2010-09-24 07:34 376832 —-a-w- c:\windows\system32\mfds.dll 2010-09-24 07:34 . 2010-09-24 07:34 366592 —-a-w- c:\windows\system32\qdvd.dll 2010-09-24 07:34 . 2010-09-24 07:34 327680 —-a-w- c:\windows\system32\drivers\udfs.sys 2010-09-24 07:34 . 2010-09-24 07:34 30296 —-a-w- c:\windows\system32\drivers\msahci.sys 2010-09-24 07:34 . 2010-09-24 07:34 292864 —-a-w- c:\windows\SysWow64\mfds.dll 2010-09-24 04:51 . 2010-09-24 04:51 455680 —-a-w- c:\windows\system32\deployJava1.dll 2010-09-23 05:47 . 2010-09-23 05:47 49016 —-a-w- c:\windows\SysWow64\sirenacm.dll 2010-09-23 05:32 . 2010-09-23 05:32 301936 —-a-w- c:\windows\WLXPGSS.SCR . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-09-23 4240760] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "ShwiconXP9106"="c:\program files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe" [2010-03-10 237568] "Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2010-02-09 1807680] "THX Audio Control Panel"="c:\program files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe" [2009-12-01 963584] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-10-27 98304] "ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-05 311296] "Lexmark S300-S400 Series"="c:\program files (x86)\Lexmark S300-S400 Series\fm3032.exe" [2010-01-18 316072] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe" [2010-07-21 165184] c:\users\Ray\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384] c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 lxeaCATSCustConnectService;lxeaCATSCustConnectService;c:\windows\system32\spool\DRIVERS\x64\3\\lxeaserv.exe [2010-04-15 45736] R2 SessionLauncher;SessionLauncher; [x] R3 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-09-18 169312] R3 ahcix64s;ahcix64s;c:\windows\system32\DRIVERS\ahcix64s.sys [2009-07-14 226616] R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2010-11-18 25072] R3 RoxMediaDB10;RoxMediaDB10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-06-26 1124848] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-20 1255736] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280] S1 aswSP;aswSP; [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-05-18 203264] S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [2009-03-16 122880] S2 AMDFusionSVC;AMD Fusion Utility Service;c:\program files (x86)\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe [2009-09-08 383544] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 61008] S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648] S2 lxea_device;lxea_device;c:\windows\system32\lxeacoms.exe [2010-01-07 1052328] S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-08-20 689472] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-05-18 6853632] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-05-18 263680] S3 AmdLLD64;AMD Low Level Device Driver;c:\windows\system32\DRIVERS\AmdLLD64.sys [2009-04-22 47672] S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-10-16 321064] . Contents of the 'Scheduled Tasks' folder 2010-12-02 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\Dell Support Center\uaclauncher.exe [2010-11-18 15:13] 2010-12-21 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\Dell Support Center\pcdrcui.exe [2010-11-18 15:13] . ——— x86-64 ———– [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-11-18 9608224] "RunDLLEntry_THXCfg"="c:\windows\system32\RunDLL32.exe" [2009-07-14 45568] "RunDLLEntry_EptMon"="c:\windows\system32\RunDLL32.exe" [2009-07-14 45568] "lxeamon.exe"="c:\program files (x86)\Lexmark S300-S400 Series\lxeamon.exe" [2010-01-18 770728] "EzPrint"="c:\program files (x86)\Lexmark S300-S400 Series\ezprint.exe" [2010-01-18 139944] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.yahoo.com/ . - - - - ORPHANS REMOVED - - - - Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-DellSupportCenter - c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe Toolbar-Locked - (no file) [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0] "ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms" . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_USERS\S-1-5-21-3471940710-2779715183-310609537-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" [HKEY_USERS\S-1-5-21-3471940710-2779715183-310609537-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files\Alwil Software\Avast5\AvastSvc.exe c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe . ************************************************************************** . Completion time: 2010-12-21 17:04:56 - machine was rebooted ComboFix-quarantined-files.txt 2010-12-22 01:04 Pre-Run: 939,973,783,552 bytes free Post-Run: 939,840,888,832 bytes free - - End Of File - - 30ACD713F1C700F91D790DD3AE290D08