What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Computer will not start

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi martindz9,

The OTL fix log can be found at C:\_OTL\MovedFiles It will have a file name consisting of numbers that reflect the date and time stamp the fix was ran. It will be something similar to 01152011_133158_111009.log . Please copy and paste the contents into your next reply.

The dialup connection box usually pops up when that option is checked in Internet Options

Click your start button > Control Panel
  • Open Internet Options
  • Click the Connections tab
  • Click the circle beside never dial a connection
  • click apply, click ok

A couple of those files though they tested clean don't seem right to me. We'll rename them for now and see if any problems arise. Was this computer infected in the past?

Next, create this batch file.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad.
Do Not copy the word CODE

copy "C:\WINDOWS\explorer.exe" "C:\WINDOWS\system32\dllcache"
ren "C:\WINDOWS\System32\bisldaqo.dll" "bisldaqo.old"
ren "C:\WINDOWS\System32\hfqogxro.dll" "hfqogxro.old"

In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "myfix.bat"
  • Click save

You will have a new file on your desktop called myfix.bat with an icon that looks like this 📎bat.PNG

Double click myfix.bat to run it.


Next

Download and save to your desktop Malwarebytes Anti-Malware

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Please post back with
  • OTL fix log
  • MBAM log
  • New OTL scan log taken after all other steps are completed.
Let me know if you are experiencing any problems.

Thanks
Post #19
Okay,

Here is the previous log

========== SERVICES/DRIVERS ==========
========== FILES ==========
C:\WINDOWS\system32\winlogon.old moved successfully.
C:\WINDOWS\explorer.old moved successfully.
C:\WINDOWS\system32\dll moved successfully.
========== COMMANDS ==========

OTL by OldTimer - Version 3.2.20.1 log created on 01152011_130118


Here is the Mbam log

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5554

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/19/2011 11:29:05 AM
mbam-log-2011-01-19 (11-29-05).txt

Scan type: Quick scan
Objects scanned: 188962
Time elapsed: 6 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 4
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\{26A98AA8-07FE-46E6-B6DF-26704F3B895F} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{DECEAAA2-370A-49BB-9362-68C3A58DDC62} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\BHO_CPV.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MalwareRemovalBot (Rogue.MalwareRemovalBot) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
c:\documents and settings\Josh\application data\malwareremovalbot (Rogue.MalwareRemovalBot) -> Quarantined and deleted successfully.
c:\documents and settings\Josh\application data\malwareremovalbot\Log (Rogue.MalwareRemovalBot) -> Quarantined and deleted successfully.
c:\documents and settings\Josh\application data\malwareremovalbot\Settings (Rogue.MalwareRemovalBot) -> Quarantined and deleted successfully.
c:\documents and settings\Josh\application data\Twain (Trojan.Matcash) -> Quarantined and deleted successfully.

Files Infected:
c:\documents and settings\Josh\application data\microsoft\stor.cfg (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\Josh\application data\malwareremovalbot\rs.dat (Rogue.MalwareRemovalBot) -> Quarantined and deleted successfully.
c:\documents and settings\Josh\application data\malwareremovalbot\Log\2009 may 26 - 03_00_00 am_203.log (Rogue.MalwareRemovalBot) -> Quarantined and deleted successfully.
c:\documents and settings\Josh\application data\malwareremovalbot\Log\2009 may 26 - 03_00_00 am_593.log (Rogue.MalwareRemovalBot) -> Quarantined and deleted successfully.
c:\documents and settings\Josh\application data\malwareremovalbot\Log\2009 may 26 - 08_54_17 am_750.log (Rogue.MalwareRemovalBot) -> Quarantined and deleted successfully.
c:\documents and settings\Josh\application data\malwareremovalbot\Log\2009 may 26 - 09_50_46 am_531.log (Rogue.MalwareRemovalBot) -> Quarantined and deleted successfully.
c:\documents and settings\Josh\application data\malwareremovalbot\Log\2009 may 26 - 10_00_40 am_937.log (Rogue.MalwareRemovalBot) -> Quarantined and deleted successfully.
c:\documents and settings\Josh\application data\malwareremovalbot\Log\2009 may 26 - 10_30_46 am_062.log (Rogue.MalwareRemovalBot) -> Quarantined and deleted successfully.
c:\documents and settings\Josh\application data\malwareremovalbot\Log\2009 may 26 - 12_44_15 am_734.log (Rogue.MalwareRemovalBot) -> Quarantined and deleted successfully.
c:\documents and settings\Josh\application data\malwareremovalbot\Settings\scanresults.pie (Rogue.MalwareRemovalBot) -> Quarantined and deleted successfully.


And here is a new OTL done after MBAM

OTL logfile created on: 1/19/2011 11:47:31 AM - Run 2
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\Josh\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 60.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 93.16 Gb Total Space | 11.42 Gb Free Space | 12.26% Space Free | Partition Type: NTFS

Computer Name: DESIGN_CENTRAL | User Name: Josh | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/01/10 11:49:45 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Josh\Desktop\OTL.exe
PRC - [2010/12/05 16:26:40 | 000,654,176 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2010/12/05 16:26:12 | 000,650,592 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2010/12/01 04:14:46 | 001,084,256 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2010/12/01 04:14:14 | 001,052,512 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgemcx.exe
PRC - [2010/11/23 13:34:16 | 000,724,048 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2010/11/23 13:34:14 | 006,128,208 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2010/10/22 04:58:18 | 000,265,400 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2010/10/22 04:57:54 | 002,745,696 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgtray.exe
PRC - [2010/10/22 04:56:58 | 000,845,664 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgcsrvx.exe
PRC - [2010/10/20 04:31:32 | 000,134,808 | —- | M] (Google Inc.) – C:\Program Files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
PRC - [2010/10/17 04:55:17 | 000,134,808 | —- | M] (Google Inc.) – C:\Documents and Settings\Josh\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe
PRC - [2010/09/22 17:11:26 | 000,640,440 | —- | M] (Adobe Systems Inc.) – C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
PRC - [2010/07/25 23:00:55 | 000,202,256 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2010/06/30 12:13:02 | 001,352,832 | —- | M] (Lavasoft) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2010/06/16 12:13:55 | 000,864,112 | —- | M] (Lavasoft) – C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2010/05/04 22:09:10 | 000,044,376 | —- | M] (WeFi) – C:\Program Files\WeFi\WefiStartup.exe
PRC - [2009/09/25 23:32:18 | 000,189,736 | —- | M] (Seagate Technology LLC) – C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
PRC - [2009/09/25 23:31:32 | 000,185,640 | —- | M] (Seagate LLC) – C:\Program Files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe
PRC - [2009/09/17 03:30:12 | 001,933,381 | —- | M] (Informer Technologies, Inc.) – C:\Program Files\Software Informer\softinfo.exe
PRC - [2008/04/13 16:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2008/03/18 16:31:20 | 004,742,184 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
PRC - [2008/03/10 00:04:52 | 000,065,536 | —- | M] () – C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
PRC - [2008/02/12 20:22:57 | 000,079,360 | —- | M] (Autodesk) – C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
PRC - [2007/08/08 23:27:52 | 000,073,728 | —- | M] (HP) – C:\WINDOWS\system32\HPZipm12.exe
PRC - [2007/06/13 15:25:04 | 000,068,856 | —- | M] (Google Inc.) – C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2007/01/04 13:38:08 | 000,024,652 | —- | M] (Viewpoint Corporation) – C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2005/02/02 04:12:22 | 000,102,492 | —- | M] (Synaptics, Inc.) – C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2004/12/03 12:24:20 | 000,290,816 | —- | M] (Hewlett-Packard ) – C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe
PRC - [2004/06/02 17:48:22 | 000,565,309 | —- | M] (WIDCOMM, Inc.) – C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2004/06/02 17:46:52 | 001,249,364 | —- | M] (WIDCOMM, Inc.) – c:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
PRC - [2003/09/15 21:00:00 | 000,270,336 | —- | M] (ATI Technologies Inc.) – C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe


========== Modules (SafeList) ==========

MOD - [2011/01/10 11:49:45 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Josh\Desktop\OTL.exe
MOD - [2010/08/23 08:12:02 | 001,054,208 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2010/07/25 23:02:35 | 000,040,960 | —- | M] () – C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
MOD - [2005/02/02 04:12:14 | 000,069,724 | —- | M] (Synaptics, Inc.) – C:\WINDOWS\system32\SynTPFcs.dll
MOD - [2003/09/15 21:00:00 | 000,180,224 | —- | M] (ATI Technologies Inc.) – C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDMH.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] – C:\WINDOWS\System32\appmgmts.dll – (AppMgmt)
SRV - [2011/01/12 13:40:03 | 003,129,432 | —- | M] () [Auto | Running] – c:\Program Files\Common Files\Akamai\netsession_win_dbc0250.dll – (Akamai)
SRV - [2010/11/23 13:34:14 | 006,128,208 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe – (AVGIDSAgent)
SRV - [2010/10/22 04:58:18 | 000,265,400 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG10\avgwdsvc.exe – (avgwd)
SRV - [2010/06/30 12:13:02 | 001,352,832 | —- | M] (Lavasoft) [Auto | Running] – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe – (Lavasoft Ad-Aware Service)
SRV - [2010/06/02 17:12:44 | 000,288,112 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe – (Adobe Version Cue CS4)
SRV - [2010/05/04 22:09:00 | 000,137,560 | —- | M] (WeFi) [On_Demand | Stopped] – C:\Program Files\WeFi\WefiEngSvc.exe – (WefiEngSvc)
SRV - [2009/09/25 23:32:18 | 000,189,736 | —- | M] (Seagate Technology LLC) [Auto | Running] – C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe – (FreeAgentGoNext Service)
SRV - [2009/06/09 10:15:52 | 000,655,624 | —- | M] (Acresso Software Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2008/06/05 23:41:12 | 001,322,648 | —- | M] (Autodesk, Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe – (Autodesk Network Licensing Service)
SRV - [2008/03/10 00:04:52 | 000,065,536 | —- | M] () [Auto | Running] – C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe – (mi-raysat_3dsMax2009_32)
SRV - [2008/02/12 20:22:57 | 000,079,360 | —- | M] (Autodesk) [Auto | Running] – C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe – (Autodesk Licensing Service)
SRV - [2007/08/08 23:27:52 | 000,073,728 | —- | M] (HP) [Auto | Running] – C:\WINDOWS\system32\HPZipm12.exe – (Pml Driver HPZ12)
SRV - [2007/01/04 13:38:08 | 000,024,652 | —- | M] (Viewpoint Corporation) [Auto | Running] – C:\Program Files\Viewpoint\Common\ViewpointService.exe – (Viewpoint Manager Service)
SRV - [2005/05/10 03:19:24 | 000,024,576 | —- | M] (Oki Data Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\spool\drivers\w32x86\3\OPHCLDCS.EXE – (OKI OPHC DCS Loader)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\DRIVERS\SNTNLUSB.SYS – (Sntnlusb)
DRV - File not found [Kernel | System | Stopped] – C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys – (SASKUTIL)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\Drivers\Pcouffin.sys – (Pcouffin)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\DRIVERS\KMW_USB.sys – (KMW_USB)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\DRIVERS\KMW_KBD.sys – (KMW_KBD)
DRV - File not found [Kernel | Auto | Stopped] – C:\WINDOWS\System32\drivers\DS1410D.SYS – (DS1410D)
DRV - [2011/01/14 16:03:48 | 000,007,168 | —- | M] () [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\uteyotg3.sys – (uteyotg3)
DRV - [2010/12/08 04:12:38 | 000,251,728 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2010/11/12 13:19:38 | 000,299,984 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2010/09/13 15:27:24 | 000,025,680 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys – (AVGIDSEH)
DRV - [2010/09/07 02:48:56 | 000,034,384 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\WINDOWS\system32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2010/09/07 02:48:50 | 000,026,064 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys – (Avgrkx86)
DRV - [2010/08/19 20:42:38 | 000,030,288 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys – (AVGIDSFilter)
DRV - [2010/08/19 20:42:36 | 000,123,472 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys – (AVGIDSDriver)
DRV - [2010/08/19 20:42:34 | 000,026,192 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSShim.sys – (AVGIDSShim)
DRV - [2010/06/05 12:14:12 | 000,064,288 | —- | M] (Lavasoft AB) [File_System | Boot | Running] – C:\WINDOWS\system32\DRIVERS\Lbd.sys – (Lbd)
DRV - [2010/06/02 17:02:31 | 000,073,312 | —- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] – C:\WINDOWS\System32\drivers\adfs.sys – (adfs)
DRV - [2009/03/13 17:53:21 | 000,027,136 | —- | M] (NCH Swift Sound) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nchssvad.sys – (NCHSSVAD)
DRV - [2008/09/26 18:06:24 | 000,129,824 | —- | M] (Paragon) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\Uim_IM.sys – (Uim_IM)
DRV - [2008/09/26 18:06:24 | 000,040,496 | —- | M] (Paragon Software Group) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\hotcore3.sys – (hotcore3)
DRV - [2008/09/26 18:06:24 | 000,032,048 | —- | M] (Windows ® 2000 DDK provider) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\UimBus.sys – (UimBus)
DRV - [2008/05/31 23:13:10 | 000,034,064 | —- | M] (CACE Technologies) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\npf.sys – (npf)
DRV - [2008/04/13 10:56:06 | 000,088,320 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnkipx.sys – (NwlnkIpx)
DRV - [2007/10/20 01:03:30 | 000,050,448 | —- | M] (InterVideo) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\iviVD.sys – (iviVD)
DRV - [2007/01/23 15:02:40 | 000,047,616 | —- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\Haspnt.sys – (Haspnt)
DRV - [2006/07/25 21:51:58 | 001,681,408 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2005/09/28 15:00:22 | 000,376,320 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\BCMWL5.SYS – (BCM43XX)
DRV - [2005/07/28 08:18:40 | 000,685,056 | —- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hardlock.sys – (Hardlock)
DRV - [2005/07/20 18:08:28 | 000,100,096 | —- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\aksusb.sys – (aksusb)
DRV - [2005/07/20 18:08:26 | 000,327,808 | —- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\akshasp.sys – (akshasp)
DRV - [2005/03/16 04:43:06 | 000,159,488 | —- | M] (Texas Instruments) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tifm21.sys – (tifm21)
DRV - [2005/03/04 03:10:26 | 000,074,496 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Rtlnicxp.sys – (RTL8023xp)
DRV - [2005/02/02 03:58:58 | 000,191,456 | —- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SynTP.sys – (SynTP)
DRV - [2004/12/15 07:18:34 | 000,207,232 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSFHWICH.sys – (HSFHWICH)
DRV - [2004/12/15 07:18:28 | 000,703,232 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2004/12/15 07:18:26 | 001,038,208 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_DP.sys – (HSF_DP)
DRV - [2004/11/17 02:17:58 | 000,280,192 | —- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\camchal.sys – (CAMCHALA)
DRV - [2004/11/17 02:17:14 | 000,293,120 | —- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\camcaud.sys – (CAMCAUD)
DRV - [2004/09/10 07:00:00 | 000,084,064 | —- | M] (Rainbow Technologies, Inc.) [Kernel | Auto | Running] – C:\WINDOWS\System32\Drivers\SENTINEL.SYS – (Sentinel)
DRV - [2004/08/04 00:00:00 | 000,063,232 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnknb.sys – (NwlnkNb)
DRV - [2004/08/04 00:00:00 | 000,055,936 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnkspx.sys – (NwlnkSpx)
DRV - [2004/06/02 17:13:32 | 000,016,896 | —- | M] (WIDCOMM, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\btaudio.sys – (btaudio)
DRV - [2004/06/02 17:07:28 | 001,240,938 | —- | M] (WIDCOMM, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\btkrnl.sys – (BTKRNL)
DRV - [2004/06/02 17:00:10 | 000,147,864 | —- | M] (WIDCOMM, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\btwdndis.sys – (BTWDNDIS)
DRV - [2004/06/02 16:59:58 | 000,030,235 | —- | M] (WIDCOMM, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\btport.sys – (BTDriver)
DRV - [2004/06/02 16:50:16 | 000,053,816 | —- | M] (WIDCOMM, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\btwusb.sys – (BTWUSB)
DRV - [2004/04/14 06:36:50 | 000,007,432 | —- | M] (Hewlett-Packard Company) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\eabfiltr.sys – (eabfiltr)
DRV - [2003/06/06 10:46:16 | 000,005,220 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\EabUsb.sys – (eabusb)
DRV - [2002/07/17 07:53:02 | 000,016,877 | —- | M] (Adaptec) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\ASPI32.SYS – (Aspi32)
DRV - [2001/08/17 11:10:28 | 000,035,913 | —- | M] (SMC) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\smcirda.sys – (SMCIRDA)
DRV - [2001/08/17 07:51:56 | 000,005,248 | —- | M] (Acer Laboratories Inc.) [Kernel | Boot | Stopped] – C:\WINDOWS\system32\DRIVERS\aliide.sys – (AliIde)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
IE - HKCU\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuz1.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost;*.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AIM Search"
FF - prefs.js..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType;=&query;="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.myspace.com/"
FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..extensions.enabledItems: {ba14329e-9550-4989-b3f2-9732e92d17cc}:2.7.1.3
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.5
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:10.0.0.1167
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type;=yahoo_avg_hs2-tb-web_us&p;="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: ""
FF - prefs.js..network.proxy.type: ""


FF - HKLM\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Program Files\Google\Google Gears\Firefox\ [2010/03/04 17:22:02 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/07/25 23:02:36 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\ [2010/12/27 09:05:40 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/10/23 20:03:38 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/10 10:47:33 | 000,000,000 | —D | M]

[2009/09/01 16:13:57 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Josh\Application Data\Mozilla\Extensions
[2010/12/26 20:42:10 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\1993sszr.default\extensions
[2009/09/03 01:32:33 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\1993sszr.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/11 22:04:59 | 000,000,000 | —D | M] (Vuze Remote Toolbar) – C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\1993sszr.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2009/09/01 16:14:26 | 000,000,000 | —D | M] ("AIM Toolbar") – C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\1993sszr.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}
[2009/05/26 13:12:05 | 000,000,000 | —D | M] ("Ask Toolbar for Firefox") – C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\1993sszr.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2010/06/27 19:51:43 | 000,000,000 | —D | M] (20-20 3D Viewer) – C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\1993sszr.default\extensions\[removed]
[2009/09/01 16:14:53 | 000,004,201 | —- | M] () – C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\1993sszr.default\searchplugins\aim-search.xml
[2010/12/26 20:42:10 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/07/25 23:02:36 | 000,000,000 | —D | M] (RealPlayer Browser Record Plugin) – C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2010/02/28 18:15:34 | 000,000,000 | —D | M] (Move Media Player) – C:\DOCUMENTS AND SETTINGS\JOSH\APPLICATION DATA\MOVE NETWORKS
[2010/12/27 09:05:40 | 000,000,000 | —D | M] (AVG Safe Search) – C:\PROGRAM FILES\AVG\AVG10\FIREFOX
[2010/03/04 17:22:02 | 000,000,000 | —D | M] (Google Gears) – C:\PROGRAM FILES\GOOGLE\GOOGLE GEARS\FIREFOX
[2009/03/17 12:31:39 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/07/23 22:04:15 | 000,393,216 | —- | M] (Invenda Corporation) – C:\Program Files\Mozilla Firefox\plugins\NPcol400.dll
[2009/11/19 14:16:28 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2009/11/19 14:16:29 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
[2007/04/16 09:07:12 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
[2007/03/09 15:16:44 | 000,189,496 | —- | M] (Yahoo! Inc.) – C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll

O1 HOSTS File: ([2009/05/27 10:43:17 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuz1.dll (Conduit Ltd.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuz1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (AIM Toolbar) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKCU\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files\Vuze_Remote\tbVuz1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe_ID0ENQBO] C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CarboniteSetupLite] C:\Program Files\Carbonite\CarbonitePreinstaller.exe (Carbonite, Inc.)
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe (Hewlett-Packard )
O4 - HKLM..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe (Macrovision Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [MaxMenuMgr] C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe (Seagate LLC)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [YCentral] c:\Program Files\Yahoo!\YCentral\YahooCentral.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [fsm] File not found
O4 - HKCU..\Run: [Software Informer] C:\Program Files\Software Informer\softinfo.exe (Informer Technologies, Inc.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (WIDCOMM, Inc.)
O4 - Startup: C:\Documents and Settings\Josh\Start Menu\Programs\Startup\Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe (Yahoo! Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: &AIM; Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Send To &Bluetooth; - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra 'Tools' menuitem : &Gears; Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O9 - Extra Button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/pub/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=48835 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab (HpProductDetection Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1243924503171 (MUWebControl Class)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} http://preciseportal.precisionimages.com/ImageUploader4.cab (Image Uploader Control)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {804F9BC5-0EAB-4150-8065-0DF485420670} http://www.knoll.com/FSL/KnFSLInstall/setup.exe (InstallShield Setup Player V11.5)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} http://offers.e-centives.com/cif/download/bin/actxcab.cab (CBSTIEPrint Class)
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx (Get_ActiveX Control)
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CBD8B1CB-2F5F-415F-93E8-A297B33DCBB2} http://entriq.vo.llnwd.net/o1/NBCUniversal…eck_1_0_0_5.cab (CentrinoCheck Control)
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} http://entriq.vo.llnwd.net/o1/NBCUniversal…0_15_Silent.cab (MediaControl Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://l.yimg.com/jh/games/web_games/popca…aploader_v6.cab (PopCapLoader Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.1.6.cab (DownloadManager Control)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\widimg {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\BTXPPanel.dll (WIDCOMM, Inc.)
O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O22 - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Program Files\Stardock\Fences\FencesMenu.dll (Stardock)
O24 - Desktop WallPaper: C:\Documents and Settings\Josh\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Josh\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/12/26 15:19:42 | 000,000,000 | —D | M] - C:\autodesk – [ NTFS ]
O32 - AutoRun File - [2009/05/27 09:27:45 | 000,000,000 | RHSD | M] - C:\autorun.inf – [ NTFS ]
O33 - MountPoints2\{279d7b91-e597-11dd-8a2b-0016410157cc}\Shell\AutoRun\command - "" = G:\WDSetup.exe – File not found
O33 - MountPoints2\{c026d8ad-e1a9-11de-89a5-0016410157cc}\Shell\AutoRun\command - "" = F:\setupSNK.exe – File not found
O33 - MountPoints2\{efa46602-7d80-11df-88bc-0016410157cc}\Shell - "" = AutoRun
O33 - MountPoints2\{efa46602-7d80-11df-88bc-0016410157cc}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{efa46602-7d80-11df-88bc-0016410157cc}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\{efa46605-7d80-11df-88bc-0016410157cc}\Shell - "" = AutoRun
O33 - MountPoints2\{efa46605-7d80-11df-88bc-0016410157cc}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{efa46605-7d80-11df-88bc-0016410157cc}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/01/19 11:15:20 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/01/19 11:15:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/01/19 11:15:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/01/19 11:15:16 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/01/19 11:13:49 | 007,734,240 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Josh\Desktop\mbam-setup.exe
[2011/01/19 11:11:15 | 001,033,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\explorer.exe
[2011/01/14 10:07:56 | 088,534,768 | —- | C] ( ) – C:\Documents and Settings\Josh\Desktop\setup_9.0.0.722_14.01.2011_20-39.exe
[2011/01/12 13:31:58 | 000,000,000 | —D | C] – C:\_OTL
[2011/01/10 11:49:48 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Josh\Desktop\OTL.exe
[2011/01/10 09:50:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Josh\Desktop\Passwords
[2011/01/05 23:03:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Josh\Desktop\PDFs
[2011/01/05 23:00:34 | 000,000,000 | —D | C] – C:\Documents and Settings\Josh\Desktop\Shortcuts
[2010/12/22 01:04:05 | 000,000,000 | —D | C] – C:\Documents and Settings\Josh\Desktop\CD Set 12-22-2010
[2009/06/24 16:52:32 | 002,068,480 | —- | C] (Adobe Systems Incorporated) – C:\Documents and Settings\All Users\Application Data\Package and Preflight.apln
[2009/06/24 16:52:32 | 002,068,480 | —- | C] (Adobe Systems Incorporated) – C:\Documents and Settings\All Users\Application Data\adobetmp000215883

========== Files - Modified Within 30 Days ==========

[2011/01/19 11:50:53 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{33225BFF-48E1-43EB-AFC6-84B1DDAA2F63}.job
[2011/01/19 11:36:54 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/01/19 11:36:18 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/01/19 11:33:20 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/01/19 11:33:06 | 000,000,276 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3016158968-4015646977-231257814-1006.job
[2011/01/19 11:31:41 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/01/19 11:31:37 | 000,000,304 | —- | M] () – C:\WINDOWS\tasks\WefiStartup.job
[2011/01/19 11:31:26 | 008,405,015 | —- | M] () – C:\WINDOWS\TempFile
[2011/01/19 11:31:07 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/01/19 11:15:20 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/01/19 11:14:28 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3016158968-4015646977-231257814-1006.job
[2011/01/19 11:14:22 | 007,734,240 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Josh\Desktop\mbam-setup.exe
[2011/01/19 11:10:58 | 000,000,171 | —- | M] () – C:\Documents and Settings\Josh\Desktop\myfix.bat
[2011/01/19 11:05:00 | 104,559,851 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/01/19 11:00:00 | 000,000,974 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3016158968-4015646977-231257814-1006UA.job
[2011/01/15 13:00:12 | 000,010,307 | —- | M] () – C:\Documents and Settings\Josh\Desktop\Virus Total.rtf
[2011/01/14 16:06:53 | 000,019,542 | —- | M] () – C:\Documents and Settings\Josh\Desktop\avptool_sysinfo.zip
[2011/01/14 16:03:48 | 000,007,168 | —- | M] () – C:\WINDOWS\System32\drivers\uteyotg3.sys
[2011/01/14 10:13:24 | 088,534,768 | —- | M] ( ) – C:\Documents and Settings\Josh\Desktop\setup_9.0.0.722_14.01.2011_20-39.exe
[2011/01/14 10:07:14 | 000,002,255 | —- | M] () – C:\Documents and Settings\Josh\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/01/14 10:07:12 | 000,002,277 | —- | M] () – C:\Documents and Settings\Josh\Desktop\Google Chrome.lnk
[2011/01/10 11:49:45 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Josh\Desktop\OTL.exe
[2011/01/10 11:45:06 | 000,006,292 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/01/05 13:24:58 | 000,082,432 | —- | M] () – C:\Documents and Settings\Josh\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/31 06:00:01 | 000,000,922 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3016158968-4015646977-231257814-1006Core.job
[2010/12/29 16:14:03 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/12/27 09:06:38 | 000,000,690 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2010/12/20 18:09:00 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/12/20 14:03:48 | 000,970,194 | —- | M] () – C:\Documents and Settings\Josh\Desktop\Caramels 1.JPG
[2010/12/20 13:03:40 | 000,443,292 | —- | M] () – C:\Documents and Settings\Josh\Desktop\Image12202010130335.jpg
[2010/12/20 13:03:08 | 000,459,804 | —- | M] () – C:\Documents and Settings\Josh\Desktop\Image12202010130304.jpg
[2010/12/20 13:02:48 | 000,486,203 | —- | M] () – C:\Documents and Settings\Josh\Desktop\Image12202010130244.jpg

========== Files Created - No Company Name ==========

[2011/01/19 11:15:20 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/01/19 11:10:58 | 000,000,171 | —- | C] () – C:\Documents and Settings\Josh\Desktop\myfix.bat
[2011/01/15 12:52:32 | 000,010,307 | —- | C] () – C:\Documents and Settings\Josh\Desktop\Virus Total.rtf
[2011/01/14 16:17:29 | 000,019,542 | —- | C] () – C:\Documents and Settings\Josh\Desktop\avptool_sysinfo.zip
[2011/01/14 16:03:46 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\drivers\uteyotg3.sys
[2011/01/12 13:43:41 | 000,000,276 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3016158968-4015646977-231257814-1006.job
[2010/12/20 14:03:48 | 000,970,194 | —- | C] () – C:\Documents and Settings\Josh\Desktop\Caramels 1.JPG
[2010/12/20 14:01:34 | 000,443,292 | —- | C] () – C:\Documents and Settings\Josh\Desktop\Image12202010130335.jpg
[2010/12/20 14:01:33 | 000,459,804 | —- | C] () – C:\Documents and Settings\Josh\Desktop\Image12202010130304.jpg
[2010/12/20 14:01:32 | 000,486,203 | —- | C] () – C:\Documents and Settings\Josh\Desktop\Image12202010130244.jpg
[2010/06/25 15:09:21 | 000,535,712 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/12/22 11:15:51 | 000,000,040 | —- | C] () – C:\Documents and Settings\Josh\Application Data\cdr.ini
[2009/06/24 16:52:32 | 000,059,112 | —- | C] () – C:\Documents and Settings\All Users\Application Data\2359.rtp
[2009/06/24 16:52:16 | 000,078,933 | —- | C] () – C:\Documents and Settings\All Users\Application Data\adobetmp000115831
[2009/02/28 22:47:59 | 000,000,118 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2009/02/07 21:54:21 | 000,000,155 | —- | C] () – C:\WINDOWS\wininit.ini
[2009/01/21 19:44:29 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/10/16 12:29:14 | 000,000,531 | —- | C] () – C:\WINDOWS\MaxwellRender.ini
[2008/10/06 19:09:38 | 002,463,976 | —- | C] () – C:\WINDOWS\System32\NPSWF32.dll
[2008/06/03 18:31:33 | 000,004,593 | —- | C] () – C:\WINDOWS\xnview.ini
[2008/05/31 23:13:10 | 000,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2008/03/24 22:51:01 | 001,210,935 | —- | C] () – C:\Program Files\.png
[2008/02/02 19:47:44 | 000,000,000 | —- | C] () – C:\Documents and Settings\Josh\Application Data\CopyToGo.dat
[2007/12/28 15:14:07 | 000,000,761 | —- | C] () – C:\WINDOWS\m3jp2k.ini
[2007/12/28 15:14:07 | 000,000,702 | —- | C] () – C:\WINDOWS\mmtvmj.ini
[2007/12/28 15:14:06 | 000,000,714 | —- | C] () – C:\WINDOWS\m3jpeg.ini
[2007/12/28 15:13:59 | 000,761,856 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2007/11/30 21:19:12 | 000,000,024 | —- | C] () – C:\Documents and Settings\Josh\Local Settings\Application Data\37562-11537-09847-00QV1-78241
[2007/11/16 13:56:33 | 000,000,069 | —- | C] () – C:\WINDOWS\ccolwiz.ini
[2007/09/15 23:20:05 | 000,000,221 | —- | C] () – C:\WINDOWS\HPPREC~1.INI
[2007/04/25 17:20:16 | 000,000,048 | —- | C] () – C:\WINDOWS\wpd99.drv
[2007/04/25 17:16:21 | 000,118,834 | —- | C] () – C:\WINDOWS\System32\pdfmona.dll
[2007/04/25 17:16:21 | 000,046,700 | —- | C] () – C:\WINDOWS\System32\pdfmon.dll
[2007/04/04 21:11:48 | 000,000,032 | —- | C] () – C:\WINDOWS\CD_Start.INI
[2007/03/01 19:14:18 | 000,000,095 | —- | C] () – C:\WINDOWS\OPHC.ini
[2007/01/23 15:02:40 | 000,000,383 | —- | C] () – C:\WINDOWS\System32\haspdos.sys
[2006/07/19 21:35:42 | 000,001,443 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2006/07/18 22:05:20 | 000,074,129 | —- | C] () – C:\Documents and Settings\Josh\Application Data\PatchUpdate_HP_CounterReport_Update_HPSU.log
[2006/07/18 22:05:20 | 000,000,227 | —- | C] () – C:\WINDOWS\HP_CounterReport_Update_HPSU.ini
[2006/07/18 22:04:58 | 000,002,034 | —- | C] () – C:\Documents and Settings\Josh\Application Data\HPSU_48BitScanUpdate.log
[2006/07/18 22:04:58 | 000,000,214 | —- | C] () – C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2006/07/18 21:58:43 | 000,005,561 | —- | C] () – C:\Documents and Settings\Josh\Application Data\GdiplusUpgrade_MSIApproach_Wrapper.log
[2006/07/18 21:58:43 | 000,000,206 | —- | C] () – C:\WINDOWS\HPGdiPlus.ini
[2006/07/18 21:56:49 | 000,063,704 | —- | C] () – C:\Documents and Settings\Josh\Application Data\Update_HP_RedboxHprblog_HPSU.log
[2006/07/18 21:56:49 | 000,000,221 | —- | C] () – C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2006/06/06 09:10:04 | 000,001,755 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/05/29 10:19:20 | 000,000,186 | —- | C] () – C:\WINDOWS\DVDXRestrictionFree.ini
[2006/05/29 10:19:20 | 000,000,014 | —- | C] () – C:\WINDOWS\System32\SysEngine2.SYS
[2006/05/24 11:01:58 | 000,000,014 | —- | C] () – C:\WINDOWS\System32\systeminfo.dll
[2006/04/17 18:41:23 | 000,007,918 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2006/02/21 12:23:25 | 000,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2006/02/10 11:08:05 | 000,000,000 | —- | C] () – C:\WINDOWS\muveeapp.INI
[2006/02/07 15:17:58 | 000,000,000 | —- | C] () – C:\WINDOWS\mtstack16.INI
[2006/02/07 12:22:04 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2006/02/06 00:45:30 | 000,025,754 | —- | C] () – C:\Documents and Settings\Josh\Application Data\wklnhst.dat
[2006/02/04 12:29:42 | 000,164,352 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2006/02/04 12:29:42 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2006/02/04 11:59:57 | 000,000,127 | —- | C] () – C:\Documents and Settings\Josh\Local Settings\Application Data\fusioncache.dat
[2006/02/04 11:12:26 | 000,082,432 | —- | C] () – C:\Documents and Settings\Josh\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/01/25 08:24:04 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\hpzids01.dll
[2005/11/25 16:30:18 | 000,107,008 | —- | C] () – C:\WINDOWS\System32\ff_realaac.dll
[2005/11/25 16:30:18 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\ff_kerneldeint.dll
[2005/11/25 14:45:40 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\TomsMoComp_ff.dll
[2005/11/25 14:45:38 | 001,115,648 | —- | C] () – C:\WINDOWS\System32\libavcodec.dll
[2005/11/25 14:45:38 | 000,164,352 | —- | C] () – C:\WINDOWS\System32\libmplayer.dll
[2005/11/25 14:45:38 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\libmpeg2_ff.dll
[2005/11/25 14:45:36 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\ff_x264.dll
[2005/11/25 14:45:36 | 000,107,008 | —- | C] () – C:\WINDOWS\System32\ff_theora.dll
[2005/11/25 14:45:36 | 000,049,664 | —- | C] () – C:\WINDOWS\System32\ff_tremor.dll
[2005/11/25 14:45:36 | 000,037,888 | —- | C] () – C:\WINDOWS\System32\ff_unrar.dll
[2005/11/25 14:45:36 | 000,023,552 | —- | C] () – C:\WINDOWS\System32\ff_wmv9.dll
[2005/11/25 14:45:34 | 000,186,880 | —- | C] () – C:\WINDOWS\System32\ff_libfaad2.dll
[2005/11/25 14:45:34 | 000,122,880 | —- | C] () – C:\WINDOWS\System32\ff_libdts.dll
[2005/11/25 14:45:34 | 000,115,200 | —- | C] () – C:\WINDOWS\System32\ff_samplerate.dll
[2005/11/25 14:45:34 | 000,086,528 | —- | C] () – C:\WINDOWS\System32\ff_libmad.dll
[2005/11/25 14:45:34 | 000,049,664 | —- | C] () – C:\WINDOWS\System32\ff_liba52.dll
[2005/10/15 15:45:54 | 000,421,888 | —- | C] () – C:\WINDOWS\System32\OpenQuicktimeLib.dll
[2005/10/15 15:45:44 | 000,129,024 | —- | C] () – C:\WINDOWS\System32\ff_mpeg2enc.dll
[2005/05/07 01:34:33 | 000,209,040 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2005/05/07 01:34:33 | 000,204,944 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2005/05/07 01:34:33 | 000,196,752 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2005/05/07 01:34:33 | 000,196,752 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2005/05/07 01:34:33 | 000,192,656 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2005/05/07 01:34:33 | 000,024,720 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2005/05/07 01:22:47 | 000,015,669 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/02/12 00:33:06 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/07 05:16:44 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/08/07 05:10:08 | 000,000,885 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/07 04:57:54 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/06/02 17:28:30 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\btprn2k.dll
[2004/01/13 10:46:34 | 000,172,032 | —- | C] () – C:\WINDOWS\System32\tifmicon.dll
[2003/02/10 01:13:10 | 000,000,416 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\systmsp2pb6
[2002/11/09 02:04:42 | 000,225,280 | —- | C] () – C:\WINDOWS\System32\qtmlClient.dll
[2002/03/16 16:00:00 | 000,007,420 | —- | C] () – C:\WINDOWS\UA000106.DLL
[2001/11/14 13:56:00 | 001,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll
[2001/08/27 01:36:16 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\HPNVRamStrings.dll
[2001/08/15 12:48:11 | 000,000,536 | -H– | C] () – C:\Documents and Settings\Josh\Application Data\winpmltspb6
[2001/07/06 14:30:00 | 000,003,399 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
[1998/06/11 14:08:06 | 000,095,232 | —- | C] () – C:\WINDOWS\System32\Lfkodak.dll
[1998/06/11 14:08:04 | 000,306,688 | —- | C] () – C:\WINDOWS\System32\Lffpx7.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 195 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:639F0420
@Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:16E029F0

< End of report >
Post #20
Hi martindz9,

How's the computer running?

You have some very old vulnerable java installed. Go to Add/Remove programs and uninstall

J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
Java™ 6 Update 2
Java™ 6 Update 5


Do not uninstall Java™ 6 Update 18


Next

Click your start button, open Control panel.
  • Locate the Java icon (it looks like a coffee cup)
  • double click it to open it
  • click the Update tab
  • Click update now

After the java is updated, reboot your computer if not prompted to.



One more scan to check our handiwork.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Go here to run an online scannner from
ESET

(Note: You must use Internet Explorer for this scan.)

  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
  • Click Start
  • Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
  • Click Scan.
  • Wait for the scan to finish.
  • Re-enable your Antivirus software.
  • A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txtWe will need this later.
Please post back with the ESET log.

Thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI