What Do I Need to Fix?

Thanks in advance for your help. I installed Power ISO and whole bunch of other stuff showed up with it. The most insidious of what was installed is searchqu and I can't any clear answer on how to remove it. I hope you can help.

Here is my log from the HijackThis scan:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:29:19 AM, on 4/26/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
C:\WINDOWS\system32\lexmvservice.exe
C:\WINDOWS\system32\lexwebservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\java.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\AVG\AVG10\avgscanx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\WINDOWS\stsystra.exe
C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe
C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe
C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
C:\Program Files\CyberLink\PCM4Everio\EverioService.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
c:\progra~1\common~1\instal~1\update~1\isuspm.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\agent.exe
C:\Documents and Settings\Anney Smith\My Documents\Downloads\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Increase performance and video formats for your HTML5 - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: CmjBrowserHelperObject Object - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [P3000x_S2P] C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
O4 - HKLM\..\Run: [EverioService] "C:\Program Files\CyberLink\PCM4Everio\EverioService.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [U36VRSFLG6] C:\DOCUME~1\ANNEYS~1\LOCALS~1\Temp\Msm.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://www2.snapfish.com/SnapfishOutlookImport.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1200049379125
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} (ContactExtractor Class) - http://www.facebook.com/controls/contactx.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1188457318343
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Broadcom ASF IP Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
O23 - Service: MarkVision Server (MvServer) - Unknown owner - C:\WINDOWS\system32\lexmvservice.exe
O23 - Service: MarkVision Web Server (MvWebServer) - Unknown owner - C:\WINDOWS\system32\lexwebservice.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)

–
End of file - 12289 bytes


Thanks again for being here.

Chonchy

Thanks, Satchfan.

Here is the OTL.txt file:
OTL logfile created on: 4/27/2011 9:51:09 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Anney Smith\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 76.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.77 Gb Total Space | 25.79 Gb Free Space | 11.08% Space Free | Partition Type: NTFS
Drive I: | 298.02 Gb Total Space | 42.39 Gb Free Space | 14.22% Space Free | Partition Type: FAT32

Computer Name: ANNEYFRIDAY | User Name: Anney Smith | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Anney Smith\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\system32\java.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\WINDOWS\system32\drivers\CDAC11BA.EXE (Macrovision)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\CyberLink\PCM4Everio\EverioService.exe (CyberLink Corp.)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe (Broadcom Corporation)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Ahead\ODD Toolkit\dvdtray.exe (Hewlett-Packard Company)
PRC - C:\Program Files\DELL\Dell Laser MFP 1600n\PSU\ScanToPc.exe ()
PRC - C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe (ScanSoft, Inc.)
PRC - C:\WINDOWS\system32\LexWebService.exE ()
PRC - C:\WINDOWS\system32\LexMvService.exE ()


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Anney Smith\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (stllssvr) – File not found
SRV - (HidServ) – File not found
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (C-DillaCdaC11BA) – C:\WINDOWS\system32\drivers\CDAC11BA.EXE (Macrovision)
SRV - (nmservice) – C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
SRV - (LinksysUpdater) – C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe ()
SRV - (ASFIPmon) – C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe (Broadcom Corporation)
SRV - (MvWebServer) – C:\WINDOWS\system32\LexWebService.exE ()
SRV - (MvServer) – C:\WINDOWS\system32\LexMvService.exE ()


========== Driver Services (SafeList) ==========

DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (CdaC15BA) – C:\WINDOWS\system32\drivers\CdaC15BA.SYS (Macrovision Europe Ltd)
DRV - (purendis) – C:\WINDOWS\system32\drivers\purendis.sys (Cisco Systems, Inc.)
DRV - (pnarp) – C:\WINDOWS\system32\drivers\pnarp.sys (Cisco Systems, Inc.)
DRV - (nvata) – C:\WINDOWS\system32\drivers\nvata.sys (NVIDIA Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (Afc) – C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (BASFND) – C:\Program Files\Broadcom\ASFIPMon\BASFND.sys (Broadcom Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.cnn.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=18707"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "Web Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.espn.com"
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.9
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.63
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1319
FF - prefs.js..keyword.URL: "http://www.searchqu.com/web?src=ffb&systemid=406&q="

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/04/26 09:32:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/02/27 22:45:52 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/02/27 22:45:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/04/10 09:32:17 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/23 17:54:39 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/26 09:32:09 | 000,000,000 | —D | M]

[2011/04/23 17:57:27 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Extensions
[2011/04/26 19:17:50 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions
[2010/07/11 22:43:11 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/11 22:43:11 | 000,000,000 | —D | M] (FireFTP) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2010/07/26 20:29:00 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/09/29 21:04:22 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions\[removed]-TRASH
[2011/04/25 11:07:31 | 000,002,571 | —- | M] () – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\searchplugins\askcom.xml
[2011/03/23 05:24:21 | 000,005,529 | —- | M] () – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\searchplugins\SearchquWebSearch.xml
[2011/04/26 19:17:50 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/04/20 21:36:56 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/13 14:31:18 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/05 11:03:14 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/02/16 23:22:42 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/04/10 09:32:17 | 000,000,000 | —D | M] (AVG Safe Search) – C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2011/02/27 22:45:52 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\HTML5VIDEO
[2011/02/27 22:45:53 | 000,000,000 | —D | M] (DivX HiQ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\WPA
[2009/03/11 08:22:48 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2007/08/29 14:47:44 | 000,054,600 | —- | M] (BitTorrent, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
[2011/02/02 22:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2008/09/15 12:52:06 | 000,376,832 | —- | M] ( ) – C:\Program Files\Mozilla Firefox\plugins\npsnapfish.dll
[2011/04/24 00:46:45 | 000,002,226 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
[2011/03/23 05:24:21 | 000,005,529 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\SearchquWebSearch.xml

O1 HOSTS File: ([2004/08/04 03:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (CmjBrowserHelperObject Object) - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll (Mindjet)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\dvdtray.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [EverioService] C:\Program Files\CyberLink\PCM4Everio\EverioService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\IndexSearch.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [P3000x_S2P] C:\Program Files\DELL\Dell Laser MFP 1600n\PSU\ScanToPc.exe ()
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [NBJ] C:\Program Files\Ahead\Nero BackItUp\NBJ.exe (Ahead Software AG)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll (Mindjet)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/7…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://support.microsoft.com/OAS/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} http://www2.snapfish.com/SnapfishOutlookImport.cab (Snapfish Outlook Import ActiveX Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www2.snapfish.com/SnapfishActivia.cab (Snapfish Activia)
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} http://www.linkedin.com/cab/LinkedInContactFinderControl.cab (LinkedIn ContactFinderControl)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1200049379125 (WUWebControl Class)
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} http://www.facebook.com/controls/contactx.dll (ContactExtractor Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1188457318343 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\wallpaper.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 11:04:08 | 000,000,000 | -HS- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3filter - C:\WINDOWS\System32\ac3filter.acm ()
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.ffds - C:\WINDOWS\System32\ffdshow.ax ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2011/04/27 09:30:32 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Desktop\backups
[2011/04/26 14:00:28 | 000,000,000 | —D | C] – C:\Qoobox
[2011/04/26 10:28:23 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Anney Smith\Desktop\OTL.exe
[2011/04/26 10:25:25 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Anney Smith\Desktop\HiJackThis.exe
[2011/04/26 09:33:06 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/04/26 09:33:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/04/26 09:33:00 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/04/26 09:32:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Real
[2011/04/26 09:09:14 | 000,000,000 | —D | C] – C:\Config.Msi
[2011/04/24 15:21:19 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Symantec Shared
[2011/04/24 00:46:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2011/04/23 19:22:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Media Get LLC
[2011/04/23 19:22:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\MediaGet2
[2011/04/23 17:57:10 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Application Data\searchqutoolbar(2)
[2011/04/23 17:44:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Application Data\FreeTorrentPlayer
[2011/04/21 22:26:38 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\Ilivid Player
[2011/04/21 22:25:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\{9907AB3C-A686-4AA4-93A7-B0AF98DFA3B9}
[2011/04/21 22:24:50 | 000,000,000 | —D | C] – C:\Program Files\Windows iLivid Toolbar
[2011/04/21 22:20:22 | 000,000,000 | —D | C] – C:\Program Files\Xvid
[2011/04/21 20:35:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Application Data\Media Player Classic
[2011/04/21 08:15:34 | 000,000,000 | —D | C] – C:\Program Files\iTunes(2)
[2011/04/21 08:12:33 | 000,000,000 | —D | C] – C:\Program Files\Bonjour(2)
[2011/04/19 15:08:08 | 000,000,000 | —D | C] – C:\Program Files\PowerISO(2)
[2011/04/06 16:20:16 | 000,197,920 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\dnssdX.dll
[2011/04/06 16:20:16 | 000,107,808 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\dns-sd.exe
[2011/04/06 16:20:16 | 000,091,424 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\dnssd.dll
[2011/04/06 16:20:16 | 000,075,040 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\jdns_sd.dll
[2011/04/05 17:06:55 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Application Data\DDMSettings
[2011/04/04 11:49:10 | 000,000,000 | -H-D | C] – C:\WINDOWS\PIF
[2004/11/24 12:25:52 | 000,335,872 | —- | C] ( ) – C:\WINDOWS\System32\drvc.dll
[2004/04/05 08:44:22 | 000,053,248 | —- | C] ( ) – C:\WINDOWS\System32\RCCOLLAB.DLL
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/27 09:52:00 | 000,000,300 | -H– | M] () – C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2011/04/27 09:46:00 | 000,000,300 | -H– | M] () – C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2011/04/27 09:45:41 | 000,000,434 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{7E75C16F-E961-4DB6-8F62-37261A90CECE}.job
[2011/04/27 09:40:00 | 000,000,258 | -H– | M] () – C:\WINDOWS\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2011/04/27 09:00:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/27 08:10:21 | 000,000,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/04/27 08:08:50 | 113,493,230 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/04/27 07:50:39 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Anney Smith\Desktop\OTL.exe
[2011/04/26 18:02:11 | 000,112,640 | —- | M] () – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/26 15:00:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/26 14:33:10 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2011/04/26 13:51:23 | 004,330,632 | R— | M] () – C:\Documents and Settings\Anney Smith\Desktop\ComboFix.exe
[2011/04/26 10:25:25 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Anney Smith\Desktop\HiJackThis.exe
[2011/04/26 09:36:38 | 000,013,668 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/04/26 09:36:01 | 000,000,290 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1400810997-1629098539-268569676-1006.job
[2011/04/26 09:36:00 | 000,000,282 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1400810997-1629098539-268569676-1007.job
[2011/04/26 09:35:49 | 000,002,048 | —- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/26 09:35:47 | 3689,336,832 | -HS- | M] () – C:\hiberfil.sys
[2011/04/25 18:39:24 | 000,000,298 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1400810997-1629098539-268569676-1006.job
[2011/04/25 18:27:13 | 000,240,029 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/04/22 10:28:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/04/19 16:35:28 | 002,007,654 | —- | M] () – C:\WINDOWS\System32\Prescan.dib
[2011/04/15 12:19:19 | 000,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/04/14 20:27:00 | 000,000,290 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1400810997-1629098539-268569676-1007.job
[2011/04/14 10:05:48 | 000,447,570 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/04/14 10:05:48 | 000,074,056 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/04/14 10:03:42 | 000,434,168 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/14 03:09:03 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/04/07 13:25:59 | 000,000,074 | —- | M] () – C:\WINDOWS\System32\Mswrkdmk.dll
[2011/04/05 17:05:35 | 000,001,796 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Converter.lnk
[2011/04/05 17:05:34 | 000,001,543 | —- | M] () – C:\Documents and Settings\Anney Smith\Desktop\DivX Movies.lnk
[2011/03/30 17:17:22 | 000,134,480 | —- | M] (AVG Technologies CZ, s.r.o. ) – C:\WINDOWS\System32\drivers\AVGIDSDriver.sys
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/26 13:51:19 | 004,330,632 | R— | C] () – C:\Documents and Settings\Anney Smith\Desktop\ComboFix.exe
[2011/04/21 08:16:19 | 000,001,581 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/04/05 17:05:35 | 000,001,796 | —- | C] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Converter.lnk
[2011/04/05 17:05:34 | 000,001,543 | —- | C] () – C:\Documents and Settings\Anney Smith\Desktop\DivX Movies.lnk
[2010/07/12 06:36:39 | 000,243,768 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/12/02 12:28:19 | 000,093,728 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/10/08 13:41:14 | 000,000,038 | —- | C] () – C:\WINDOWS\AviSplitter.INI
[2009/05/07 16:48:53 | 000,116,224 | —- | C] () – C:\WINDOWS\System32\pdfcmnnt.dll
[2009/03/23 08:15:36 | 000,000,021 | —- | C] () – C:\WINDOWS\SOL.INI
[2009/03/11 14:49:43 | 000,000,015 | —- | C] () – C:\WINDOWS\popcinfo.dat
[2009/03/11 14:36:34 | 000,122,880 | —- | C] () – C:\WINDOWS\UnGins.exe
[2009/01/31 17:37:44 | 000,000,163 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2008/12/19 08:15:58 | 004,338,246 | —- | C] () – C:\WINDOWS\System32\libavcodec.dll
[2008/12/17 10:41:18 | 000,884,237 | —- | C] () – C:\WINDOWS\System32\ff_x264.dll
[2008/12/17 10:22:58 | 000,093,184 | —- | C] () – C:\WINDOWS\System32\ff_wmv9.dll
[2008/12/17 10:22:48 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2008/12/17 10:17:34 | 000,239,247 | —- | C] () – C:\WINDOWS\System32\ff_theora.dll
[2008/12/17 09:59:54 | 000,560,802 | —- | C] () – C:\WINDOWS\System32\libmplayer.dll
[2008/09/26 14:26:07 | 000,000,094 | —- | C] () – C:\WINDOWS\MusicRip.ini
[2008/09/16 17:29:29 | 000,000,036 | -H– | C] () – C:\WINDOWS\System32\f9t.dat
[2008/09/03 21:30:00 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2008/08/26 09:53:47 | 000,023,206 | —- | C] () – C:\Documents and Settings\Anney Smith\Application Data\Comma Separated Values (Windows).ADR
[2008/01/24 10:56:28 | 000,000,597 | —- | C] () – C:\WINDOWS\SYMGAMES.INI
[2008/01/10 12:44:48 | 000,198,144 | —- | C] () – C:\WINDOWS\System32\_psisdecd.dll
[2008/01/03 21:56:41 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/12/27 15:31:41 | 000,000,088 | -HS- | C] () – C:\Documents and Settings\Anney Smith\Application Data\KR56ZG2YE73GVCXB3T2UDEXAMC
[2007/12/19 21:26:12 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2007/11/02 12:56:41 | 000,001,156 | —- | C] () – C:\WINDOWS\mozver.dat
[2007/11/02 12:21:26 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2007/10/30 17:31:11 | 000,025,565 | —- | C] () – C:\Documents and Settings\Anney Smith\Application Data\Microsoft Excel 97-2003.ADR
[2007/10/14 19:33:01 | 000,000,042 | -HS- | C] () – C:\Documents and Settings\Anney Smith\Application Data\J5WZQHDU65ZHW2XGUT4SE69VG7
[2007/09/13 13:24:25 | 000,112,640 | —- | C] () – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/09/04 16:30:22 | 000,000,088 | -HS- | C] () – C:\Documents and Settings\Anney Smith\Application Data\CGFBDNJ3JNV77ZR8UC3R7TKENL
[2007/09/04 16:11:26 | 000,167,936 | R— | C] () – C:\WINDOWS\System32\GBInf.dll
[2007/09/04 15:31:58 | 000,000,042 | -HS- | C] () – C:\Documents and Settings\Anney Smith\Application Data\ZT3WAQ7HBAUC9KGKBAC7YLPFDV
[2007/09/04 12:37:11 | 000,002,528 | —- | C] () – C:\Documents and Settings\Anney Smith\Application Data\$_hpcst$.hpc
[2007/08/31 10:57:03 | 000,006,656 | —- | C] () – C:\WINDOWS\System32\CNMVS56.DLL
[2007/08/31 10:35:09 | 000,027,019 | —- | C] () – C:\WINDOWS\maxlink.ini
[2007/08/31 10:33:12 | 000,024,576 | —- | C] () – C:\WINDOWS\SvcCon.exe
[2007/08/30 11:30:10 | 000,000,089 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2007/08/30 10:59:15 | 000,000,074 | —- | C] () – C:\WINDOWS\System32\Mswrkdmk.dll
[2007/08/30 00:12:18 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\LexWebService.exE
[2007/08/30 00:12:17 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\LexMvService.exE
[2007/08/29 23:55:53 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\hlinkprx.dll
[2007/08/29 23:55:51 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[2007/08/29 22:52:55 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/08/28 22:24:35 | 000,000,134 | —- | C] () – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\fusioncache.dat
[2007/08/06 18:21:29 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2007/08/06 18:18:48 | 000,000,120 | —- | C] () – C:\WINDOWS\wininit.ini
[2007/08/06 17:56:13 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2007/08/06 17:56:13 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2007/08/06 17:56:13 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2007/08/06 17:56:11 | 000,129,112 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2007/08/06 17:56:05 | 000,077,824 | —- | C] () – C:\WINDOWS\setpwr32.exe
[2007/08/06 17:55:19 | 000,001,027 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2007/04/03 09:33:44 | 000,035,328 | R— | C] () – C:\WINDOWS\System32\Inetwh32.dll
[2007/03/05 13:34:28 | 000,676,224 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2006/11/02 09:10:16 | 000,080,912 | —- | C] () – C:\WINDOWS\System32\sherlock2.exe
[2005/03/24 04:58:36 | 000,053,315 | —- | C] () – C:\WINDOWS\System32\Sswiadrv.dll
[2005/02/01 21:39:32 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\WIAEH.dll
[2004/11/17 02:16:16 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\WIAIPH.dll
[2004/10/15 02:09:28 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\WIASTIIO.dll
[2004/10/03 10:50:54 | 000,129,024 | —- | C] () – C:\WINDOWS\System32\ff_mpeg2enc.dll
[2004/08/10 11:12:05 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/10 11:07:31 | 000,002,048 | —- | C] () – C:\WINDOWS\bootstat.dat
[2004/08/10 11:02:15 | 000,023,444 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 11:01:18 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 10:57:52 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/10 10:57:15 | 000,434,168 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 10:51:20 | 000,447,570 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/10 10:51:20 | 000,074,056 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/10 10:51:16 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/04 05:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/04 05:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 05:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 05:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 05:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 05:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 05:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 05:00:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 05:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2002/03/04 10:16:34 | 000,110,592 | R— | C] () – C:\WINDOWS\System32\Jpeg32.dll

========== LOP Check ==========

[2009/07/07 12:39:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ableton
[2007/09/04 16:11:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Agilix
[2008/10/29 11:06:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Applications
[2008/12/16 18:10:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avery
[2010/11/05 11:00:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2010/11/05 10:51:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/11/05 11:00:06 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2009/07/09 10:36:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2009/04/08 09:03:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Linksys
[2011/04/26 09:31:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Media Get LLC
[2011/04/10 09:41:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2007/12/13 01:49:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Mindjet
[2007/08/31 10:34:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2011/04/24 00:46:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2011/02/20 16:43:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/03/13 13:01:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2009/03/13 07:57:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010/04/02 19:56:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/11 20:44:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/06 12:22:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/04/26 09:32:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{9907AB3C-A686-4AA4-93A7-B0AF98DFA3B9}
[2009/04/18 08:22:39 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{D0D0BE61-F9F3-4330-BF43-3FC63530C4E6}
[2009/07/08 16:14:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\Ableton
[2010/11/06 16:43:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\AVG10
[2010/06/08 12:37:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\AVG9
[2008/01/24 11:09:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\BitTorrent
[2011/04/05 17:06:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\DDMSettings
[2009/02/12 22:40:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\Deusty
[2008/08/27 14:32:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\FranklinCovey
[2011/04/26 09:31:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\FreeTorrentPlayer
[2009/07/10 09:08:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\InterTrust
[2007/09/04 16:31:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\Leadertech
[2009/01/21 11:02:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\OpenOffice.org
[2007/09/11 08:52:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\PPIMAGES
[2007/09/11 08:52:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\ScanSoft
[2011/04/26 09:31:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\searchqutoolbar(2)
[2009/12/13 22:10:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\Sierra Wireless
[2007/12/18 21:41:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\Snapfish
[2009/04/28 11:03:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\Stamps.com Internet Postage
[2011/04/26 09:33:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\uTorrent
[2010/08/11 12:58:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Anney Smith\Application Data\webex
[2011/04/27 09:45:41 | 000,000,434 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{7E75C16F-E961-4DB6-8F62-37261A90CECE}.job
[2011/04/27 09:46:00 | 000,000,300 | -H– | M] () – C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2011/04/27 09:40:00 | 000,000,258 | -H– | M] () – C:\WINDOWS\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2011/04/27 09:52:00 | 000,000,300 | -H– | M] () – C:\WINDOWS\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2008/09/26 14:26:17 | 000,000,020 | -HS- | M] () – C:\ArcDeviceInfo
[2008/12/07 06:29:59 | 000,019,942 | —- | M] () – C:\ASLog.txt
[2004/08/10 11:04:08 | 000,000,000 | -HS- | M] () – C:\AUTOEXEC.BAT
[2007/08/29 15:58:51 | 000,000,223 | -HS- | M] () – C:\boot.ini
[2004/08/10 11:04:08 | 000,000,000 | -HS- | M] () – C:\CONFIG.SYS
[2007/08/06 17:56:32 | 000,006,130 | RH– | M] () – C:\dell.sdr
[2010/04/07 07:11:32 | 000,000,368 | —- | M] () – C:\drmHeader.bin
[2011/04/26 09:35:47 | 3689,336,832 | -HS- | M] () – C:\hiberfil.sys
[2007/08/29 15:55:32 | 000,004,128 | —- | M] () – C:\INFCACHE.1
[2004/08/10 11:04:08 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2004/08/10 11:04:08 | 000,000,000 | -H– | M] () – C:\MSDOS.SYS
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/08/19 10:54:29 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/04/26 09:35:42 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2009/10/19 06:28:23 | 000,000,872 | —- | M] () – C:\SpokeUninstall_4424_2009-10-19-13-28-28.txt
[2009/04/18 08:18:32 | 000,000,032 | —- | M] () – C:\t.txt
[2009/09/20 12:07:58 | 000,000,204 | —- | M] () – C:\UI_Anney Smith.log
[2008/01/11 03:59:54 | 006,139,760 | —- | M] (Microsoft Corporation) – C:\WindowsUpdateAgent30-x86.exe

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2007/08/29 16:01:22 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007/04/03 09:32:40 | 000,008,704 | —- | M] (Agilix Labs) – C:\WINDOWS\system32\spool\prtprocs\w32x86\AgilPrt.DLL
[2003/07/29 22:00:00 | 000,016,384 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD56.DLL
[2003/07/29 22:00:00 | 000,048,128 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP56.DLL
[2008/07/06 05:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/09/29 22:27:24 | 000,084,480 | —- | M] (Microsoft Corporation.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\lmdippr8.dll
[2001/11/20 14:37:28 | 000,047,616 | R— | M] (Black Ice Software) – C:\WINDOWS\system32\spool\prtprocs\w32x86\ppbiPr.dll
[2008/07/06 03:50:04 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2009/03/13 13:42:16 | 000,001,722 | -H– | M] () – C:\Documents and Settings\Anney Smith\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2007/08/29 08:52:36 | 000,262,144 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2007/08/29 15:45:39 | 000,262,144 | —- | M] () – C:\WINDOWS\system32\config\security.sav
[2007/08/29 08:52:36 | 013,107,200 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2007/08/29 08:52:37 | 004,718,592 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/08/19 10:58:31 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >
[2011/01/03 15:46:15 | 000,006,144 | -HS- | M] () – C:\WINDOWS\system32\Thumbs.db
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/08/28 22:24:51 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Anney Smith\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2004/08/10 11:08:38 | 000,000,079 | —- | M] () – C:\Documents and Settings\Anney Smith\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2009/02/09 06:15:36 | 000,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\Anney Smith\Desktop\ATF-Cleaner.exe
[2011/04/26 13:51:23 | 004,330,632 | R— | M] () – C:\Documents and Settings\Anney Smith\Desktop\ComboFix.exe
[2011/04/26 10:25:25 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Anney Smith\Desktop\HiJackThis.exe
[2011/04/27 07:50:39 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Anney Smith\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-04-27 15:13:28

========== Alternate Data Streams ==========

@Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4BF2F6B5
@Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:88050731

< End of report >

More to come,

Chonchy

And the Extras.txt:
OTL Extras logfile created on: 4/27/2011 9:51:09 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Anney Smith\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 76.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.77 Gb Total Space | 25.79 Gb Free Space | 11.08% Space Free | Partition Type: NTFS
Drive I: | 298.02 Gb Total Space | 42.39 Gb Free Space | 14.22% Space Free | Partition Type: FAT32

Computer Name: ANNEYFRIDAY | User Name: Anney Smith | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
http [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"67:UDP" = 67:UDP:*:Enabled:DHCP Discovery Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\CyberLink\PCM4Everio\PCM4Everio.exe" = C:\Program Files\CyberLink\PCM4Everio\PCM4Everio.exe:*:Enabled:CyberLink PowerCinema NE for Everio – (CyberLink Corp.)
"C:\Program Files\CyberLink\PCM4Everio\EverioService.exe" = C:\Program Files\CyberLink\PCM4Everio\EverioService.exe:*:Enabled:CyberLink PowerCinema NE for Everio Resident Program – (CyberLink Corp.)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe" = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe:*:Disabled:CLI Application (Command Line Interface) – (ATI Technologies Inc.)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\AVG\AVG10\avgmfapx.exe" = C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:AVG Installer – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe" = C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:LocalSubNet:Enabled:Pure Networks Platform Service – (Cisco Systems, Inc.)
"C:\Program Files\AVG\AVG10\avgdiagex.exe" = C:\Program Files\AVG\AVG10\avgdiagex.exe:*:Enabled:AVG Diagnostics 2011 – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgnsx.exe" = C:\Program Files\AVG\AVG10\avgnsx.exe:*:Enabled:Online Shield – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgemcx.exe" = C:\Program Files\AVG\AVG10\avgemcx.exe:*:Enabled:Personal E-mail Scanner – (AVG Technologies CZ, s.r.o.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{004F0409-78E1-11D2-B60F-006097C998E7}" = Microsoft Access 2000 SR-1 Runtime
"{071B9AFA-EBE8-4ABF-8F4A-9F92612F517E}" = Broadcom ASF Management Applications
"{0A146245-DB79-4197-BF5D-FE1A699A2CC7}" = Camera Window DS
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{227246B3-74D1-412D-9442-36983718096B}" = Mindjet MindManager Pro 6
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 24
"{281ECE39-F043-492B-8337-F2E546B5604A}" = PowerDVD
"{28F451B0-44E5-48C0-8706-84114249F5B4}" = LightScribe [removed]
"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2CA41BA1-9842-4819-8ABB-76FDC14AB9EA}" = ATI Catalyst Control Center
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{39CEE1F2-12B6-4C50-9131-04BFCA110578}" = PowerCinema NE for Everio
"{3F3C0456-E391-41AB-9523-A6B5558069A0}" = PaperPort 9.0
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{50A0893D-47D8-48E0-A7E8-44BCD7E4422E}" = Microsoft SQL Server Native Client
"{50E25180-3BDC-4B6D-80A2-3F1F0C9CF39D}" = Camera Window DVC
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{652C4ADF-0A29-4B02-9211-EE61675847DE}" = Canon Camera WIA Driver
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6C3A75A6-9A90-44A3-A703-82AC1EA6A85D}" = Camera Window MC
"{71F6DF7D-B639-4FAD-BA93-E6DF267AA44D}" = DesignPro 5.4 Limited Edition
"{71FEF72D-8F41-455E-8854-08F687154319}" = QBFC3.0b
"{74BE7519-41A7-45A8-8AA6-78C7907A4808}" = EOS Capture 1.2
"{750CF8D7-4B04-404F-AFA2-14C129C42373}" = EOS Viewer Utility 1.2.1
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{874E44F3-B9A7-4AA1-B4BA-83E5684ED9C6}" = PhotoStitch
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{92FD71D5-ED7E-40B2-8DF3-4B5E6F684367}" = Dell ETS Factory Installation
"{9474E37D-FC45-49C7-BD1D-840BFE6A2A4F}" = FranklinCovey PlanPlus for Microsoft Outlook
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1D0D14A-B776-4907-BC00-5149F2298086}" = Camera Support Core Library
"{A2EB8F2E-6D9B-4F8B-96EB-F976D33F416F}" = Camera Window DVC
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A64FF1D4-9CBC-467C-8D11-C1AFAA0B8AFF}" = AVG 2011
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{A867EC17-B7A5-BF54-338B-A306E634D927}" = MyFonts Order M893154
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.6
"{B147DC1B-49B3-4368-8A01-5AD9992CD58D}" = MovieEdit Task
"{BAA43DA2-B6C5-46EC-B163-0E8EEAF975A4}" = RAW Image Task 2.2
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BBBC2B89-E193-4348-A83C-C8DD8210A4AC}" = Canon PhotoRecord
"{BF2A74BF-8D12-47F1-8B19-22B30AF6B0D1}" = Linksys EasyLink Advisor
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C0D2F614-5CE5-4DCB-8678-E5C9AF7044F8}" = Microsoft SQL Server VSS Writer
"{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver
"{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}" = Canon ZoomBrowser EX (E)
"{C537C86E-22C0-41CF-8A8E-3B23E986C3D9}" = Canon Camera WIA Driver
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF9CD37C-E29A-11D5-AE3D-005004B8E30C}" = Digital Photo Navigator 1.5
"{D4E53304-1F6C-4111-9872-1BCD2CF5B642}" = AVG 2011
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{ED9775A0-383E-4EAA-8DA5-8CC6860D60A3}" = Canon Camera WIA Driver
"{EDE721EC-870A-11D8-9D75-000129760D75}" = PowerDirector Express
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
"{FB64BF25-3593-4E4E-AA85-84AEF1D1475F}" = Broadcom Management Programs
"{FBDBC490-089D-4476-BF72-1F7A6368200A}" = Pure Networks Platform
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 6.0" = Adobe Photoshop 6.0
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"ATI Display Driver" = ATI Display Driver
"AVG" = AVG 2011
"CANONBJ_Deinstall_CNMCP56.DLL" = Canon i860
"CdaC13Ba" = SafeCast Shared Components
"Dell Laser MFP 1600n" = Dell Laser MFP 1600n Software Uninstall
"DivX Setup.divx.com" = DivX Setup
"Golden Tee Golf Course Addon #1" = Golden Tee Golf Course Addon #1
"Google Base Store Connector" = Google Base Store Connector
"Google Updater" = Google Updater
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{0A146245-DB79-4197-BF5D-FE1A699A2CC7}" = Canon Camera Window DSLR 5 for ZoomBrowser EX
"InstallShield_{50E25180-3BDC-4B6D-80A2-3F1F0C9CF39D}" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"InstallShield_{652C4ADF-0A29-4B02-9211-EE61675847DE}" = Canon EOS-1Ds Mark II WIA Driver
"InstallShield_{6C3A75A6-9A90-44A3-A703-82AC1EA6A85D}" = Canon Camera Window MC 6 for ZoomBrowser EX
"InstallShield_{71F6DF7D-B639-4FAD-BA93-E6DF267AA44D}" = DesignPro 5.4 Limited Edition
"InstallShield_{74BE7519-41A7-45A8-8AA6-78C7907A4808}" = Canon Utilities EOS Capture 1.2
"InstallShield_{750CF8D7-4B04-404F-AFA2-14C129C42373}" = Canon Utilities EOS Viewer Utility 1.2
"InstallShield_{874E44F3-B9A7-4AA1-B4BA-83E5684ED9C6}" = Canon Utilities PhotoStitch 3.1
"InstallShield_{A1D0D14A-B776-4907-BC00-5149F2298086}" = Canon Camera Support Core Library
"InstallShield_{A2EB8F2E-6D9B-4F8B-96EB-F976D33F416F}" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"InstallShield_{B147DC1B-49B3-4368-8A01-5AD9992CD58D}" = Canon MovieEdit Task for ZoomBrowser EX
"InstallShield_{BAA43DA2-B6C5-46EC-B163-0E8EEAF975A4}" = Canon RAW Image Task for ZoomBrowser EX
"InstallShield_{C537C86E-22C0-41CF-8A8E-3B23E986C3D9}" = Canon EOS-1D Mark II WIA Driver
"InstallShield_{ED9775A0-383E-4EAA-8DA5-8CC6860D60A3}" = Canon EOS 20D WIA Driver
"IrfanView" = IrfanView (remove only)
"Jewelry Designer Manager Deluxe" = Jewelry Designer Manager Deluxe
"Lexmark Printer Software Uninstall" = Lexmark Printer Software Uninstall
"Lexmark_HostCD" = MarkVision Professional Software Uninstall
"Linksys EasyLink Advisor" = Linksys EasyLink Advisor
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NeroMultiInstaller!UninstallKey" = Nero Suite
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"PDF-XChange 3_is1" = PDF-XChange 3.0
"PROR" = Microsoft Office Professional 2007
"RealPlayer 12.0" = RealPlayer
"uTorrent" = µTorrent
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XP Codec Pack" = XP Codec Pack
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/20/2011 4:47:01 AM | Computer Name = ANNEYFRIDAY | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 4/20/2011 4:47:01 AM | Computer Name = ANNEYFRIDAY | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1969

Error - 4/20/2011 4:47:01 AM | Computer Name = ANNEYFRIDAY | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1969

Error - 4/20/2011 4:47:03 AM | Computer Name = ANNEYFRIDAY | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 4/20/2011 4:47:03 AM | Computer Name = ANNEYFRIDAY | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 3953

Error - 4/20/2011 4:47:03 AM | Computer Name = ANNEYFRIDAY | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 3953

Error - 4/21/2011 12:09:18 AM | Computer Name = ANNEYFRIDAY | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x08f57e30.

Error - 4/21/2011 12:09:27 AM | Computer Name = ANNEYFRIDAY | Source = Application Error | ID = 1001
Description = Fault bucket 447954038.

Error - 4/21/2011 6:06:49 PM | Computer Name = ANNEYFRIDAY | Source = Broadcom ASF IP Monitor | ID = 0
Description = !ERROR 53 Refreshing BMAPI data

Error - 4/26/2011 2:12:09 AM | Computer Name = ANNEYFRIDAY | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module avisplitter.ax, version 1.0.0.9, fault address 0x00021ea4.

[ OSession Events ]
Error - 6/4/2008 2:58:11 PM | Computer Name = ANNEYFRIDAY | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 645
seconds with 480 seconds of active time. This session ended with a crash.

Error - 6/4/2008 3:31:25 PM | Computer Name = ANNEYFRIDAY | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 29
seconds with 0 seconds of active time. This session ended with a crash.

Error - 6/4/2008 4:40:40 PM | Computer Name = ANNEYFRIDAY | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 315
seconds with 60 seconds of active time. This session ended with a crash.

Error - 6/4/2008 8:40:06 PM | Computer Name = ANNEYFRIDAY | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 13312
seconds with 900 seconds of active time. This session ended with a crash.

Error - 6/11/2008 2:28:13 PM | Computer Name = ANNEYFRIDAY | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 11794
seconds with 780 seconds of active time. This session ended with a crash.

Error - 6/11/2008 2:48:37 PM | Computer Name = ANNEYFRIDAY | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1213
seconds with 600 seconds of active time. This session ended with a crash.

Error - 6/26/2008 5:10:16 PM | Computer Name = ANNEYFRIDAY | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 22388
seconds with 4260 seconds of active time. This session ended with a crash.

Error - 9/11/2008 4:21:56 PM | Computer Name = ANNEYFRIDAY | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1986
seconds with 660 seconds of active time. This session ended with a crash.

Error - 9/11/2008 7:37:44 PM | Computer Name = ANNEYFRIDAY | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 741
seconds with 0 seconds of active time. This session ended with a crash.

Error - 11/11/2008 6:42:46 PM | Computer Name = ANNEYFRIDAY | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 381
seconds with 240 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 4/20/2011 9:14:32 AM | Computer Name = ANNEYFRIDAY | Source = Cdrom | ID = 262155
Description = The driver detected a controller error on \Device\CdRom0.

Error - 4/20/2011 9:14:33 AM | Computer Name = ANNEYFRIDAY | Source = Cdrom | ID = 262155
Description = The driver detected a controller error on \Device\CdRom0.

Error - 4/20/2011 9:14:34 AM | Computer Name = ANNEYFRIDAY | Source = Cdrom | ID = 262155
Description = The driver detected a controller error on \Device\CdRom0.

Error - 4/20/2011 9:14:35 AM | Computer Name = ANNEYFRIDAY | Source = Cdrom | ID = 262155
Description = The driver detected a controller error on \Device\CdRom0.

Error - 4/20/2011 9:14:36 AM | Computer Name = ANNEYFRIDAY | Source = Cdrom | ID = 262155
Description = The driver detected a controller error on \Device\CdRom0.

Error - 4/20/2011 9:14:37 AM | Computer Name = ANNEYFRIDAY | Source = Cdrom | ID = 262155
Description = The driver detected a controller error on \Device\CdRom0.

Error - 4/20/2011 9:14:38 AM | Computer Name = ANNEYFRIDAY | Source = Cdrom | ID = 262155
Description = The driver detected a controller error on \Device\CdRom0.

Error - 4/20/2011 9:14:39 AM | Computer Name = ANNEYFRIDAY | Source = Cdrom | ID = 262155
Description = The driver detected a controller error on \Device\CdRom0.

Error - 4/20/2011 9:14:40 AM | Computer Name = ANNEYFRIDAY | Source = Cdrom | ID = 262155
Description = The driver detected a controller error on \Device\CdRom0.

Error - 4/25/2011 7:31:32 PM | Computer Name = ANNEYFRIDAY | Source = DCOM | ID = 10010
Description = The server {DF390AA1-1E65-4825-B8E7-BE6B47BD56B8} did not register
with DCOM within the required timeout.


< End of report >

Muchas Gracias,

Chonchy

Here is the GMER report:

GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-27 16:09:38
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\00000067 ST3250820AS rev.3.ADG
Running: gmer.exe; Driver: C:\DOCUME~1\ANNEYS~1\LOCALS~1\Temp\fxriikow.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xBA3A9738]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xBA3A97DC]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xBA3A9878]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xBA3A9914]

—- Kernel code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB91FF360, 0x2462AD, 0xE8000020]

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Mozilla Firefox\firefox.exe[5236] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[5280] USER32.dll!TrackPopupMenu 7E46531E 5 Bytes JMP 10402024 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\3B6427221D47D21449246389738190B6\Usage@Program_Pro 1050357244
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@LoadAppInit_DLLs 1

—- EOF - GMER 1.0.15 —-

I became aware of searchqu when I opened a window and found it to be my home page. I assumed it was from the PowerISO agreement, or something that was bundled in with it.

Chonchy

Satchfan-

I unfortunately shut the OTL fix log window before copying it to a reply. I hope that is not too big a problem.
I took your advise and got rid of the utorrent.
Here is the new OTL log:

OTL logfile created on: 4/28/2011 9:55:36 AM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Anney Smith\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 80.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.77 Gb Total Space | 27.40 Gb Free Space | 11.77% Space Free | Partition Type: NTFS
Drive I: | 298.02 Gb Total Space | 42.39 Gb Free Space | 14.22% Space Free | Partition Type: FAT32

Computer Name: ANNEYFRIDAY | User Name: Anney Smith | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Anney Smith\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\system32\java.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\WINDOWS\system32\drivers\CDAC11BA.EXE (Macrovision)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\CyberLink\PCM4Everio\EverioService.exe (CyberLink Corp.)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe (Broadcom Corporation)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Ahead\ODD Toolkit\dvdtray.exe (Hewlett-Packard Company)
PRC - C:\Program Files\DELL\Dell Laser MFP 1600n\PSU\ScanToPc.exe ()
PRC - C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe (ScanSoft, Inc.)
PRC - C:\WINDOWS\system32\LexWebService.exE ()
PRC - C:\WINDOWS\system32\LexMvService.exE ()


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Anney Smith\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (stllssvr) – File not found
SRV - (HidServ) – File not found
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (C-DillaCdaC11BA) – C:\WINDOWS\system32\drivers\CDAC11BA.EXE (Macrovision)
SRV - (nmservice) – C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
SRV - (LinksysUpdater) – C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe ()
SRV - (ASFIPmon) – C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe (Broadcom Corporation)
SRV - (MvWebServer) – C:\WINDOWS\system32\LexWebService.exE ()
SRV - (MvServer) – C:\WINDOWS\system32\LexMvService.exE ()


========== Driver Services (SafeList) ==========

DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (CdaC15BA) – C:\WINDOWS\system32\drivers\CdaC15BA.SYS (Macrovision Europe Ltd)
DRV - (purendis) – C:\WINDOWS\system32\drivers\purendis.sys (Cisco Systems, Inc.)
DRV - (pnarp) – C:\WINDOWS\system32\drivers\pnarp.sys (Cisco Systems, Inc.)
DRV - (nvata) – C:\WINDOWS\system32\drivers\nvata.sys (NVIDIA Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (Afc) – C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (BASFND) – C:\Program Files\Broadcom\ASFIPMon\BASFND.sys (Broadcom Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.cnn.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: ""
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=18707"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "Web Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.espn.com"
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.9
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.63
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1319

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/04/26 09:32:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/02/27 22:45:52 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/02/27 22:45:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/04/10 09:32:17 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/23 17:54:39 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/26 09:32:09 | 000,000,000 | —D | M]

[2011/04/23 17:57:27 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Extensions
[2011/04/28 09:31:22 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions
[2010/07/11 22:43:11 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/11 22:43:11 | 000,000,000 | —D | M] (FireFTP) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2010/07/26 20:29:00 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/09/29 21:04:22 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions\[removed]-TRASH
[2011/04/25 11:07:31 | 000,002,571 | —- | M] () – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\searchplugins\askcom.xml
[2011/04/28 09:31:22 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/04/20 21:36:56 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/13 14:31:18 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/05 11:03:14 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/02/16 23:22:42 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/04/10 09:32:17 | 000,000,000 | —D | M] (AVG Safe Search) – C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2011/02/27 22:45:52 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\HTML5VIDEO
[2011/02/27 22:45:53 | 000,000,000 | —D | M] (DivX HiQ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\WPA
[2009/03/11 08:22:48 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2007/08/29 14:47:44 | 000,054,600 | —- | M] (BitTorrent, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
[2011/02/02 22:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2008/09/15 12:52:06 | 000,376,832 | —- | M] ( ) – C:\Program Files\Mozilla Firefox\plugins\npsnapfish.dll
[2011/04/24 00:46:45 | 000,002,226 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml

O1 HOSTS File: ([2004/08/04 03:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (CmjBrowserHelperObject Object) - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll (Mindjet)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\dvdtray.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [EverioService] C:\Program Files\CyberLink\PCM4Everio\EverioService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\IndexSearch.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [P3000x_S2P] C:\Program Files\DELL\Dell Laser MFP 1600n\PSU\ScanToPc.exe ()
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [NBJ] C:\Program Files\Ahead\Nero BackItUp\NBJ.exe (Ahead Software AG)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll (Mindjet)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/7…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://support.microsoft.com/OAS/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} http://www2.snapfish.com/SnapfishOutlookImport.cab (Snapfish Outlook Import ActiveX Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www2.snapfish.com/SnapfishActivia.cab (Snapfish Activia)
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} http://www.linkedin.com/cab/LinkedInContactFinderControl.cab (LinkedIn ContactFinderControl)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1200049379125 (WUWebControl Class)
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} http://www.facebook.com/controls/contactx.dll (ContactExtractor Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1188457318343 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\wallpaper.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 11:04:08 | 000,000,000 | -HS- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/28 06:51:12 | 000,000,000 | —D | C] – C:\_OTL
[2011/04/27 11:13:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Desktop\gmer
[2011/04/27 09:30:32 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Desktop\backups
[2011/04/26 14:00:28 | 000,000,000 | —D | C] – C:\Qoobox
[2011/04/26 10:28:23 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Anney Smith\Desktop\OTL.exe
[2011/04/26 10:25:25 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Anney Smith\Desktop\HiJackThis.exe
[2011/04/26 09:33:06 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/04/26 09:33:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/04/26 09:33:00 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/04/26 09:32:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Real
[2011/04/26 09:09:14 | 000,000,000 | —D | C] – C:\Config.Msi
[2011/04/24 00:46:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2011/04/23 19:22:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Media Get LLC
[2011/04/23 19:22:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\MediaGet2
[2011/04/23 17:44:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Application Data\FreeTorrentPlayer
[2011/04/21 22:26:38 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\Ilivid Player
[2011/04/21 22:25:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\{9907AB3C-A686-4AA4-93A7-B0AF98DFA3B9}
[2011/04/21 22:24:50 | 000,000,000 | —D | C] – C:\Program Files\Windows iLivid Toolbar
[2011/04/21 22:20:22 | 000,000,000 | —D | C] – C:\Program Files\Xvid
[2011/04/21 20:35:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Application Data\Media Player Classic
[2011/04/21 08:15:34 | 000,000,000 | —D | C] – C:\Program Files\iTunes(2)
[2011/04/21 08:12:33 | 000,000,000 | —D | C] – C:\Program Files\Bonjour(2)
[2011/04/19 15:08:08 | 000,000,000 | —D | C] – C:\Program Files\PowerISO(2)
[2011/04/06 16:20:16 | 000,197,920 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\dnssdX.dll
[2011/04/06 16:20:16 | 000,107,808 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\dns-sd.exe
[2011/04/06 16:20:16 | 000,091,424 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\dnssd.dll
[2011/04/06 16:20:16 | 000,075,040 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\jdns_sd.dll
[2011/04/05 17:06:55 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Application Data\DDMSettings
[2011/04/04 11:49:10 | 000,000,000 | -H-D | C] – C:\WINDOWS\PIF
[2004/11/24 12:25:52 | 000,335,872 | —- | C] ( ) – C:\WINDOWS\System32\drvc.dll
[2004/04/05 08:44:22 | 000,053,248 | —- | C] ( ) – C:\WINDOWS\System32\RCCOLLAB.DLL

========== Files - Modified Within 30 Days ==========

[2011/04/28 09:56:38 | 000,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/04/28 09:21:07 | 000,013,668 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/04/28 09:20:47 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2011/04/28 09:20:37 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/28 09:20:36 | 000,000,290 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1400810997-1629098539-268569676-1006.job
[2011/04/28 09:20:36 | 000,000,282 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1400810997-1629098539-268569676-1007.job
[2011/04/28 09:20:25 | 000,002,048 | —- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/28 09:20:24 | 3689,336,832 | -HS- | M] () – C:\hiberfil.sys
[2011/04/28 09:09:45 | 113,592,104 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/04/28 09:00:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/27 11:28:39 | 000,112,640 | —- | M] () – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/27 10:59:55 | 000,000,000 | —- | M] () – C:\Documents and Settings\Anney Smith\defogger_reenable
[2011/04/27 10:35:14 | 000,293,019 | —- | M] () – C:\Documents and Settings\Anney Smith\Desktop\gmer.zip
[2011/04/27 10:33:12 | 000,050,477 | —- | M] () – C:\Documents and Settings\Anney Smith\Desktop\Defogger.exe
[2011/04/27 08:10:21 | 000,000,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/04/27 07:50:39 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Anney Smith\Desktop\OTL.exe
[2011/04/26 13:51:23 | 004,330,632 | R— | M] () – C:\Documents and Settings\Anney Smith\Desktop\ComboFix.exe
[2011/04/26 10:25:25 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Anney Smith\Desktop\HiJackThis.exe
[2011/04/25 18:39:24 | 000,000,298 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1400810997-1629098539-268569676-1006.job
[2011/04/25 18:27:13 | 000,240,029 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/04/22 10:28:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/04/19 16:35:28 | 002,007,654 | —- | M] () – C:\WINDOWS\System32\Prescan.dib
[2011/04/14 20:27:00 | 000,000,290 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1400810997-1629098539-268569676-1007.job
[2011/04/14 10:05:48 | 000,447,570 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/04/14 10:05:48 | 000,074,056 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/04/14 10:03:42 | 000,434,168 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/14 03:09:03 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/04/05 17:05:35 | 000,001,796 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Converter.lnk
[2011/04/05 17:05:34 | 000,001,543 | —- | M] () – C:\Documents and Settings\Anney Smith\Desktop\DivX Movies.lnk
[2011/03/30 17:17:22 | 000,134,480 | —- | M] (AVG Technologies CZ, s.r.o. ) – C:\WINDOWS\System32\drivers\AVGIDSDriver.sys

========== Files Created - No Company Name ==========

[2011/04/27 10:59:55 | 000,000,000 | —- | C] () – C:\Documents and Settings\Anney Smith\defogger_reenable
[2011/04/27 10:35:14 | 000,293,019 | —- | C] () – C:\Documents and Settings\Anney Smith\Desktop\gmer.zip
[2011/04/27 10:33:12 | 000,050,477 | —- | C] () – C:\Documents and Settings\Anney Smith\Desktop\Defogger.exe
[2011/04/26 13:51:19 | 004,330,632 | R— | C] () – C:\Documents and Settings\Anney Smith\Desktop\ComboFix.exe
[2011/04/21 08:16:19 | 000,001,581 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/04/05 17:05:35 | 000,001,796 | —- | C] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Converter.lnk
[2011/04/05 17:05:34 | 000,001,543 | —- | C] () – C:\Documents and Settings\Anney Smith\Desktop\DivX Movies.lnk
[2010/07/12 06:36:39 | 000,243,768 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/12/02 12:28:19 | 000,093,728 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/10/08 13:41:14 | 000,000,038 | —- | C] () – C:\WINDOWS\AviSplitter.INI
[2009/05/07 16:48:53 | 000,116,224 | —- | C] () – C:\WINDOWS\System32\pdfcmnnt.dll
[2009/03/23 08:15:36 | 000,000,021 | —- | C] () – C:\WINDOWS\SOL.INI
[2009/03/11 14:49:43 | 000,000,015 | —- | C] () – C:\WINDOWS\popcinfo.dat
[2009/03/11 14:36:34 | 000,122,880 | —- | C] () – C:\WINDOWS\UnGins.exe
[2009/01/31 17:37:44 | 000,000,163 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2008/12/19 08:15:58 | 004,338,246 | —- | C] () – C:\WINDOWS\System32\libavcodec.dll
[2008/12/17 10:41:18 | 000,884,237 | —- | C] () – C:\WINDOWS\System32\ff_x264.dll
[2008/12/17 10:22:58 | 000,093,184 | —- | C] () – C:\WINDOWS\System32\ff_wmv9.dll
[2008/12/17 10:22:48 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2008/12/17 10:17:34 | 000,239,247 | —- | C] () – C:\WINDOWS\System32\ff_theora.dll
[2008/12/17 09:59:54 | 000,560,802 | —- | C] () – C:\WINDOWS\System32\libmplayer.dll
[2008/09/26 14:26:07 | 000,000,094 | —- | C] () – C:\WINDOWS\MusicRip.ini
[2008/09/16 17:29:29 | 000,000,036 | -H– | C] () – C:\WINDOWS\System32\f9t.dat
[2008/09/03 21:30:00 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2008/08/26 09:53:47 | 000,023,206 | —- | C] () – C:\Documents and Settings\Anney Smith\Application Data\Comma Separated Values (Windows).ADR
[2008/01/24 10:56:28 | 000,000,597 | —- | C] () – C:\WINDOWS\SYMGAMES.INI
[2008/01/10 12:44:48 | 000,198,144 | —- | C] () – C:\WINDOWS\System32\_psisdecd.dll
[2008/01/03 21:56:41 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/12/27 15:31:41 | 000,000,088 | -HS- | C] () – C:\Documents and Settings\Anney Smith\Application Data\KR56ZG2YE73GVCXB3T2UDEXAMC
[2007/12/19 21:26:12 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2007/11/02 12:56:41 | 000,001,156 | —- | C] () – C:\WINDOWS\mozver.dat
[2007/11/02 12:21:26 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2007/10/30 17:31:11 | 000,025,565 | —- | C] () – C:\Documents and Settings\Anney Smith\Application Data\Microsoft Excel 97-2003.ADR
[2007/10/14 19:33:01 | 000,000,042 | -HS- | C] () – C:\Documents and Settings\Anney Smith\Application Data\J5WZQHDU65ZHW2XGUT4SE69VG7
[2007/09/13 13:24:25 | 000,112,640 | —- | C] () – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/09/04 16:30:22 | 000,000,088 | -HS- | C] () – C:\Documents and Settings\Anney Smith\Application Data\CGFBDNJ3JNV77ZR8UC3R7TKENL
[2007/09/04 16:11:26 | 000,167,936 | R— | C] () – C:\WINDOWS\System32\GBInf.dll
[2007/09/04 15:31:58 | 000,000,042 | -HS- | C] () – C:\Documents and Settings\Anney Smith\Application Data\ZT3WAQ7HBAUC9KGKBAC7YLPFDV
[2007/09/04 12:37:11 | 000,002,528 | —- | C] () – C:\Documents and Settings\Anney Smith\Application Data\$_hpcst$.hpc
[2007/08/31 10:57:03 | 000,006,656 | —- | C] () – C:\WINDOWS\System32\CNMVS56.DLL
[2007/08/31 10:35:09 | 000,027,019 | —- | C] () – C:\WINDOWS\maxlink.ini
[2007/08/31 10:33:12 | 000,024,576 | —- | C] () – C:\WINDOWS\SvcCon.exe
[2007/08/30 11:30:10 | 000,000,089 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2007/08/30 00:12:18 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\LexWebService.exE
[2007/08/30 00:12:17 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\LexMvService.exE
[2007/08/29 23:55:53 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\hlinkprx.dll
[2007/08/29 23:55:51 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[2007/08/29 22:52:55 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/08/28 22:24:35 | 000,000,134 | —- | C] () – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\fusioncache.dat
[2007/08/06 18:21:29 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2007/08/06 18:18:48 | 000,000,120 | —- | C] () – C:\WINDOWS\wininit.ini
[2007/08/06 17:56:13 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2007/08/06 17:56:13 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2007/08/06 17:56:13 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2007/08/06 17:56:11 | 000,129,112 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2007/08/06 17:56:05 | 000,077,824 | —- | C] () – C:\WINDOWS\setpwr32.exe
[2007/08/06 17:55:19 | 000,001,027 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2007/04/03 09:33:44 | 000,035,328 | R— | C] () – C:\WINDOWS\System32\Inetwh32.dll
[2007/03/05 13:34:28 | 000,676,224 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2006/11/02 09:10:16 | 000,080,912 | —- | C] () – C:\WINDOWS\System32\sherlock2.exe
[2005/03/24 04:58:36 | 000,053,315 | —- | C] () – C:\WINDOWS\System32\Sswiadrv.dll
[2005/02/01 21:39:32 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\WIAEH.dll
[2004/11/17 02:16:16 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\WIAIPH.dll
[2004/10/15 02:09:28 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\WIASTIIO.dll
[2004/10/03 10:50:54 | 000,129,024 | —- | C] () – C:\WINDOWS\System32\ff_mpeg2enc.dll
[2004/08/10 11:12:05 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/10 11:07:31 | 000,002,048 | —- | C] () – C:\WINDOWS\bootstat.dat
[2004/08/10 11:02:15 | 000,023,444 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 11:01:18 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 10:57:52 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/10 10:57:15 | 000,434,168 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 10:51:20 | 000,447,570 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/10 10:51:20 | 000,074,056 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/10 10:51:16 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/04 05:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/04 05:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 05:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 05:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 05:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 05:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 05:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 05:00:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 05:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2002/03/04 10:16:34 | 000,110,592 | R— | C] () – C:\WINDOWS\System32\Jpeg32.dll

< End of report >
Thanks,

More to come.

OTL fix log:

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Prefs.js: "" removed from browser.search.defaultengine
Prefs.js: "Web Search" removed from browser.search.defaultenginename
Prefs.js: "http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=18707" removed from browser.search.defaulturl
Prefs.js: "Web Search" removed from browser.search.order.1
Prefs.js: "Web Search" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Anney Smith
->Temp folder emptied: 23176350 bytes
->Temporary Internet Files folder emptied: 99106 bytes
->Java cache emptied: 19780 bytes
->FireFox cache emptied: 44167422 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Her Boy
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 0 bytes

User: log

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 60164416 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 122.00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 04292011_132711

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\Her Boy\Local Settings\Temp\alicia-silverstone-head.jpg not found!

Registry entries deleted on Reboot…


OTL log:

OTL logfile created on: 4/29/2011 2:29:41 PM - Run 3
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Anney Smith\Desktop\Malware Tools
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 80.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.77 Gb Total Space | 25.93 Gb Free Space | 11.14% Space Free | Partition Type: NTFS
Drive I: | 298.02 Gb Total Space | 42.39 Gb Free Space | 14.22% Space Free | Partition Type: FAT32

Computer Name: ANNEYFRIDAY | User Name: Anney Smith | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Anney Smith\Desktop\Malware Tools\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\system32\java.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\WINDOWS\system32\drivers\CDAC11BA.EXE (Macrovision)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\CyberLink\PCM4Everio\EverioService.exe (CyberLink Corp.)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe (Broadcom Corporation)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Ahead\ODD Toolkit\dvdtray.exe (Hewlett-Packard Company)
PRC - C:\Program Files\DELL\Dell Laser MFP 1600n\PSU\ScanToPc.exe ()
PRC - C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe (ScanSoft, Inc.)
PRC - C:\WINDOWS\system32\LexWebService.exE ()
PRC - C:\WINDOWS\system32\LexMvService.exE ()


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Anney Smith\Desktop\Malware Tools\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (stllssvr) – File not found
SRV - (HidServ) – File not found
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (C-DillaCdaC11BA) – C:\WINDOWS\system32\drivers\CDAC11BA.EXE (Macrovision)
SRV - (nmservice) – C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
SRV - (LinksysUpdater) – C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe ()
SRV - (ASFIPmon) – C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe (Broadcom Corporation)
SRV - (MvWebServer) – C:\WINDOWS\system32\LexWebService.exE ()
SRV - (MvServer) – C:\WINDOWS\system32\LexMvService.exE ()


========== Driver Services (SafeList) ==========

DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (CdaC15BA) – C:\WINDOWS\system32\drivers\CdaC15BA.SYS (Macrovision Europe Ltd)
DRV - (purendis) – C:\WINDOWS\system32\drivers\purendis.sys (Cisco Systems, Inc.)
DRV - (pnarp) – C:\WINDOWS\system32\drivers\pnarp.sys (Cisco Systems, Inc.)
DRV - (nvata) – C:\WINDOWS\system32\drivers\nvata.sys (NVIDIA Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (Afc) – C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (BASFND) – C:\Program Files\Broadcom\ASFIPMon\BASFND.sys (Broadcom Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.cnn.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: ""
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: ""
FF - prefs.js..browser.startup.homepage: "www.espn.com"
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.9
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.63
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1319

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/04/26 09:32:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/02/27 22:45:52 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/02/27 22:45:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/04/10 09:32:17 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/29 14:21:18 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/29 14:21:18 | 000,000,000 | —D | M]

[2011/04/23 17:57:27 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Extensions
[2011/04/28 09:31:22 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions
[2010/07/11 22:43:11 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/11 22:43:11 | 000,000,000 | —D | M] (FireFTP) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2010/07/26 20:29:00 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/09/29 21:04:22 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\extensions\[removed]-TRASH
[2011/04/25 11:07:31 | 000,002,571 | —- | M] () – C:\Documents and Settings\Anney Smith\Application Data\Mozilla\Firefox\Profiles\smpfigvq.default\searchplugins\askcom.xml
[2011/04/28 09:31:22 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/04/20 21:36:56 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/13 14:31:18 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/05 11:03:14 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/02/16 23:22:42 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/04/10 09:32:17 | 000,000,000 | —D | M] (AVG Safe Search) – C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2011/02/27 22:45:52 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\HTML5VIDEO
[2011/02/27 22:45:53 | 000,000,000 | —D | M] (DivX HiQ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\WPA
[2009/03/11 08:22:48 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2007/08/29 14:47:44 | 000,054,600 | —- | M] (BitTorrent, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
[2011/02/02 22:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2008/09/15 12:52:06 | 000,376,832 | —- | M] ( ) – C:\Program Files\Mozilla Firefox\plugins\npsnapfish.dll
[2011/04/24 00:46:45 | 000,002,226 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml

O1 HOSTS File: ([2004/08/04 03:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (CmjBrowserHelperObject Object) - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll (Mindjet)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\dvdtray.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [EverioService] C:\Program Files\CyberLink\PCM4Everio\EverioService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\IndexSearch.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [P3000x_S2P] C:\Program Files\DELL\Dell Laser MFP 1600n\PSU\ScanToPc.exe ()
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [NBJ] C:\Program Files\Ahead\Nero BackItUp\NBJ.exe (Ahead Software AG)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll (Mindjet)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/7…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://support.microsoft.com/OAS/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} http://www2.snapfish.com/SnapfishOutlookImport.cab (Snapfish Outlook Import ActiveX Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www2.snapfish.com/SnapfishActivia.cab (Snapfish Activia)
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} http://www.linkedin.com/cab/LinkedInContactFinderControl.cab (LinkedIn ContactFinderControl)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1200049379125 (WUWebControl Class)
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} http://www.facebook.com/controls/contactx.dll (ContactExtractor Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1188457318343 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\wallpaper.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 11:04:08 | 000,000,000 | -HS- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/29 10:49:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/04/29 10:49:03 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/04/29 10:47:29 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/04/29 09:11:05 | 000,000,000 | —D | C] – C:\Program Files\7-Zip
[2011/04/29 09:11:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip
[2011/04/28 17:11:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Desktop\Malware Tools
[2011/04/28 10:56:10 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Application Data\Malwarebytes
[2011/04/28 10:56:03 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/04/28 10:56:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/04/28 10:56:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/04/28 10:56:00 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/04/28 10:56:00 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/04/28 06:51:12 | 000,000,000 | —D | C] – C:\_OTL
[2011/04/26 14:00:28 | 000,000,000 | —D | C] – C:\Qoobox
[2011/04/26 09:32:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Real
[2011/04/26 09:09:14 | 000,000,000 | —D | C] – C:\Config.Msi
[2011/04/24 00:46:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2011/04/23 19:22:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Media Get LLC
[2011/04/23 19:22:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\MediaGet2
[2011/04/23 17:44:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Application Data\FreeTorrentPlayer
[2011/04/21 22:26:38 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\Ilivid Player
[2011/04/21 22:25:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\{9907AB3C-A686-4AA4-93A7-B0AF98DFA3B9}
[2011/04/21 22:24:50 | 000,000,000 | —D | C] – C:\Program Files\Windows iLivid Toolbar
[2011/04/21 22:20:22 | 000,000,000 | —D | C] – C:\Program Files\Xvid
[2011/04/21 20:35:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Application Data\Media Player Classic
[2011/04/21 08:15:34 | 000,000,000 | —D | C] – C:\Program Files\iTunes(2)
[2011/04/21 08:12:33 | 000,000,000 | —D | C] – C:\Program Files\Bonjour(2)
[2011/04/19 15:08:08 | 000,000,000 | —D | C] – C:\Program Files\PowerISO(2)
[2011/04/06 16:20:16 | 000,197,920 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\dnssdX.dll
[2011/04/06 16:20:16 | 000,107,808 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\dns-sd.exe
[2011/04/06 16:20:16 | 000,091,424 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\dnssd.dll
[2011/04/06 16:20:16 | 000,075,040 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\jdns_sd.dll
[2011/04/05 17:06:55 | 000,000,000 | —D | C] – C:\Documents and Settings\Anney Smith\Application Data\DDMSettings
[2011/04/04 11:49:10 | 000,000,000 | -H-D | C] – C:\WINDOWS\PIF
[2004/11/24 12:25:52 | 000,335,872 | —- | C] ( ) – C:\WINDOWS\System32\drvc.dll
[2004/04/05 08:44:22 | 000,053,248 | —- | C] ( ) – C:\WINDOWS\System32\RCCOLLAB.DLL

========== Files - Modified Within 30 Days ==========

[2011/04/29 14:00:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/29 13:29:53 | 000,013,668 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/04/29 13:29:33 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2011/04/29 13:29:22 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/29 13:29:22 | 000,000,290 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1400810997-1629098539-268569676-1006.job
[2011/04/29 13:29:22 | 000,000,282 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1400810997-1629098539-268569676-1007.job
[2011/04/29 13:29:12 | 000,002,048 | —- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/29 13:29:11 | 3689,336,832 | -HS- | M] () – C:\hiberfil.sys
[2011/04/29 10:49:51 | 000,001,581 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/04/29 10:28:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/04/29 09:12:45 | 000,113,152 | —- | M] () – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/29 09:06:44 | 000,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/04/29 08:55:58 | 113,706,359 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/04/28 20:27:00 | 000,000,290 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1400810997-1629098539-268569676-1007.job
[2011/04/27 10:59:55 | 000,000,000 | —- | M] () – C:\Documents and Settings\Anney Smith\defogger_reenable
[2011/04/27 08:10:21 | 000,000,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/04/26 13:51:23 | 004,330,632 | R— | M] () – C:\Documents and Settings\Anney Smith\Desktop\ComboFix.exe
[2011/04/25 18:39:24 | 000,000,298 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1400810997-1629098539-268569676-1006.job
[2011/04/25 18:27:13 | 000,240,029 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/04/19 16:35:28 | 002,007,654 | —- | M] () – C:\WINDOWS\System32\Prescan.dib
[2011/04/14 10:05:48 | 000,447,570 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/04/14 10:05:48 | 000,074,056 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/04/14 10:03:42 | 000,434,168 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/14 03:09:03 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/04/06 16:20:16 | 000,197,920 | —- | M] (Apple Inc.) – C:\WINDOWS\System32\dnssdX.dll
[2011/04/06 16:20:16 | 000,107,808 | —- | M] (Apple Inc.) – C:\WINDOWS\System32\dns-sd.exe
[2011/04/06 16:20:16 | 000,091,424 | —- | M] (Apple Inc.) – C:\WINDOWS\System32\dnssd.dll
[2011/04/06 16:20:16 | 000,075,040 | —- | M] (Apple Inc.) – C:\WINDOWS\System32\jdns_sd.dll
[2011/04/05 17:05:35 | 000,001,796 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Converter.lnk
[2011/04/05 17:05:34 | 000,001,543 | —- | M] () – C:\Documents and Settings\Anney Smith\Desktop\DivX Movies.lnk
[2011/03/30 17:17:22 | 000,134,480 | —- | M] (AVG Technologies CZ, s.r.o. ) – C:\WINDOWS\System32\drivers\AVGIDSDriver.sys

========== Files Created - No Company Name ==========

[2011/04/29 10:49:51 | 000,001,581 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/04/27 10:59:55 | 000,000,000 | —- | C] () – C:\Documents and Settings\Anney Smith\defogger_reenable
[2011/04/26 13:51:19 | 004,330,632 | R— | C] () – C:\Documents and Settings\Anney Smith\Desktop\ComboFix.exe
[2011/04/05 17:05:35 | 000,001,796 | —- | C] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Converter.lnk
[2011/04/05 17:05:34 | 000,001,543 | —- | C] () – C:\Documents and Settings\Anney Smith\Desktop\DivX Movies.lnk
[2010/07/12 06:36:39 | 000,243,768 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/12/02 12:28:19 | 000,093,728 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/10/08 13:41:14 | 000,000,038 | —- | C] () – C:\WINDOWS\AviSplitter.INI
[2009/05/07 16:48:53 | 000,116,224 | —- | C] () – C:\WINDOWS\System32\pdfcmnnt.dll
[2009/03/23 08:15:36 | 000,000,021 | —- | C] () – C:\WINDOWS\SOL.INI
[2009/03/11 14:49:43 | 000,000,015 | —- | C] () – C:\WINDOWS\popcinfo.dat
[2009/03/11 14:36:34 | 000,122,880 | —- | C] () – C:\WINDOWS\UnGins.exe
[2009/01/31 17:37:44 | 000,000,163 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2008/12/19 08:15:58 | 004,338,246 | —- | C] () – C:\WINDOWS\System32\libavcodec.dll
[2008/12/17 10:41:18 | 000,884,237 | —- | C] () – C:\WINDOWS\System32\ff_x264.dll
[2008/12/17 10:22:58 | 000,093,184 | —- | C] () – C:\WINDOWS\System32\ff_wmv9.dll
[2008/12/17 10:22:48 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2008/12/17 10:17:34 | 000,239,247 | —- | C] () – C:\WINDOWS\System32\ff_theora.dll
[2008/12/17 09:59:54 | 000,560,802 | —- | C] () – C:\WINDOWS\System32\libmplayer.dll
[2008/09/26 14:26:07 | 000,000,094 | —- | C] () – C:\WINDOWS\MusicRip.ini
[2008/09/16 17:29:29 | 000,000,036 | -H– | C] () – C:\WINDOWS\System32\f9t.dat
[2008/09/03 21:30:00 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2008/08/26 09:53:47 | 000,023,206 | —- | C] () – C:\Documents and Settings\Anney Smith\Application Data\Comma Separated Values (Windows).ADR
[2008/01/24 10:56:28 | 000,000,597 | —- | C] () – C:\WINDOWS\SYMGAMES.INI
[2008/01/10 12:44:48 | 000,198,144 | —- | C] () – C:\WINDOWS\System32\_psisdecd.dll
[2008/01/03 21:56:41 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/12/27 15:31:41 | 000,000,088 | -HS- | C] () – C:\Documents and Settings\Anney Smith\Application Data\KR56ZG2YE73GVCXB3T2UDEXAMC
[2007/12/19 21:26:12 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2007/11/02 12:56:41 | 000,001,156 | —- | C] () – C:\WINDOWS\mozver.dat
[2007/11/02 12:21:26 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2007/10/30 17:31:11 | 000,025,565 | —- | C] () – C:\Documents and Settings\Anney Smith\Application Data\Microsoft Excel 97-2003.ADR
[2007/10/14 19:33:01 | 000,000,042 | -HS- | C] () – C:\Documents and Settings\Anney Smith\Application Data\J5WZQHDU65ZHW2XGUT4SE69VG7
[2007/09/13 13:24:25 | 000,113,152 | —- | C] () – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/09/04 16:30:22 | 000,000,088 | -HS- | C] () – C:\Documents and Settings\Anney Smith\Application Data\CGFBDNJ3JNV77ZR8UC3R7TKENL
[2007/09/04 16:11:26 | 000,167,936 | R— | C] () – C:\WINDOWS\System32\GBInf.dll
[2007/09/04 15:31:58 | 000,000,042 | -HS- | C] () – C:\Documents and Settings\Anney Smith\Application Data\ZT3WAQ7HBAUC9KGKBAC7YLPFDV
[2007/09/04 12:37:11 | 000,002,528 | —- | C] () – C:\Documents and Settings\Anney Smith\Application Data\$_hpcst$.hpc
[2007/08/31 10:57:03 | 000,006,656 | —- | C] () – C:\WINDOWS\System32\CNMVS56.DLL
[2007/08/31 10:35:09 | 000,027,019 | —- | C] () – C:\WINDOWS\maxlink.ini
[2007/08/31 10:33:12 | 000,024,576 | —- | C] () – C:\WINDOWS\SvcCon.exe
[2007/08/30 11:30:10 | 000,000,089 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2007/08/30 00:12:18 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\LexWebService.exE
[2007/08/30 00:12:17 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\LexMvService.exE
[2007/08/29 23:55:53 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\hlinkprx.dll
[2007/08/29 23:55:51 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[2007/08/29 22:52:55 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/08/28 22:24:35 | 000,000,134 | —- | C] () – C:\Documents and Settings\Anney Smith\Local Settings\Application Data\fusioncache.dat
[2007/08/06 18:21:29 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2007/08/06 18:18:48 | 000,000,120 | —- | C] () – C:\WINDOWS\wininit.ini
[2007/08/06 17:56:13 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2007/08/06 17:56:13 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2007/08/06 17:56:13 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2007/08/06 17:56:11 | 000,129,112 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2007/08/06 17:56:05 | 000,077,824 | —- | C] () – C:\WINDOWS\setpwr32.exe
[2007/08/06 17:55:19 | 000,001,027 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2007/04/03 09:33:44 | 000,035,328 | R— | C] () – C:\WINDOWS\System32\Inetwh32.dll
[2007/03/05 13:34:28 | 000,676,224 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2006/11/02 09:10:16 | 000,080,912 | —- | C] () – C:\WINDOWS\System32\sherlock2.exe
[2005/03/24 04:58:36 | 000,053,315 | —- | C] () – C:\WINDOWS\System32\Sswiadrv.dll
[2005/02/01 21:39:32 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\WIAEH.dll
[2004/11/17 02:16:16 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\WIAIPH.dll
[2004/10/15 02:09:28 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\WIASTIIO.dll
[2004/10/03 10:50:54 | 000,129,024 | —- | C] () – C:\WINDOWS\System32\ff_mpeg2enc.dll
[2004/08/10 11:12:05 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/10 11:07:31 | 000,002,048 | —- | C] () – C:\WINDOWS\bootstat.dat
[2004/08/10 11:02:15 | 000,023,444 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 11:01:18 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 10:57:52 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/10 10:57:15 | 000,434,168 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 10:51:20 | 000,447,570 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/10 10:51:20 | 000,074,056 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/10 10:51:16 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/04 05:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/04 05:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 05:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 05:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 05:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 05:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 05:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 05:00:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 05:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2002/03/04 10:16:34 | 000,110,592 | R— | C] () – C:\WINDOWS\System32\Jpeg32.dll

< End of report >
I'll post the Malwarebytes next.
Thanks,

Chonchy