Might as well use a Typewriter - overloaded with malware and other no

Hi -

My computer is bogged down by some nonsense.
The CPU constantly runs at 100%, and opening new windows and performing any task takes forever.
I ran Spybot, Ad-Aware, and Malwarebytes to no avail.

Coincidentally, I downloaded Google Chrome on Friday.
I doubt this has any correlation, but I mention it nonetheless.

Attached are the requested logs.
Thank you in advance for any help. It will greatly be appreciated.

Frank


System Info
OS Version: Microsoft Windows XP Professional, Service Pack 3, 32 bit
Processor: Genuine Intel® CPU T2400 @ 1.83GHz, x86 Family 6 Model 14 Stepping 8
Processor Count: 2
RAM: 1014 Mb
Graphics Card: Mobile Intel® 945GM Express Chipset Family, 224 Mb
Hard Drives: C: Total - 50995 MB, Free - 7599 MB;
Motherboard: Dell Inc., 0MG532, , .GKV20B1.CN7016664L0HUB.
Antivirus: Lavasoft Ad-Watch Live! Anti-Virus, Updated: Yes, On-Demand Scanner: Enabled


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:05:46 AM, on 5/16/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\Mixer\CTSVolFE.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Documents and Settings\Brian Williams\My Documents\Downloads\5koikqn3.exe
C:\Documents and Settings\Brian Williams\Desktop\dds.pif
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Documents and Settings\Brian Williams\Local Settings\Temp\7A.tmp\SED.DAT
C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: ::1 localhost
O1 - Hosts: 91.212.127.226 os-secure2009.com
O1 - Hosts: 91.212.127.226 www.os-secure2009.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ShowLOMControl]

O4 - HKLM\..\Run: [CTSVolFE.exe] "C:\Program Files\Creative\Mixer\CTSVolFE.exe" /r
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh…1/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by133fd.bay133.hotmail.msn.co…s/MsnPUpld.cab
O20 - AppInit_DLLs: C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Windows\mspdb27.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: McAfee Application Installer Cleanup (0038071284469571) (0038071284469571mcinstcleanup) - Unknown owner - C:\DOCUME~1\BRIANW~1\LOCALS~1\Temp\003807~1.EXE (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/BRIANW~1/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

–
End of file - 9760 bytes



.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 11:00:21.67 on Mon 05/16/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_24
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.201 [GMT -4:00]
.
AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\Mixer\CTSVolFE.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Documents and Settings\Brian Williams\My Documents\Downloads\5koikqn3.exe
C:\Documents and Settings\Brian Williams\Desktop\dds.pif
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [msnmsgr] "c:\program files\msn messenger\msnmsgr.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Google Update] "c:\documents and settings\brian williams\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [ShowLOMControl] 1 (0x1)
mRun: [CTSVolFE.exe] "c:\program files\creative\mixer\CTSVolFE.exe" /r
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ramasst.lnk - c:\windows\system32\RAMASST.exe
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: turbotax.com
Trusted Zone: musicmatch.com\online
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www2.snapfish.com/SnapfishActivia.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://by133fd.bay133.hotmail.msn.com/resources/MsnPUpld.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\docume~1\alluse~1\applic~1\micros~1\windows\mspdb27.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 127.0.0.1 www.spywareinfo.com
Hosts: 91.212.127.226 os-secure2009.com
Hosts: 91.212.127.226 www.os-secure2009.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\docume~1\brianw~1\applic~1\mozilla\firefox\profiles\cq6e8o1f.default\
FF - prefs.js: browser.startup.homepage - hxxp://my.msn.com/
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\brian williams\local settings\application data\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\documents and settings\brian williams\local settings\application data\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
.
============= SERVICES / DRIVERS ===============
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-5-16 64512]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 165264]
R1 MpKslc0d1c994;MpKslc0d1c994;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b9725b79-44cb-4ebe-a818-e12564495e56}\MpKslc0d1c994.sys [2011-5-16 28752]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2011-4-29 2146496]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2011-4-29 15232]
S1 MpKsl0e0896e5;MpKsl0e0896e5;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6e322e41-16ee-4610-af23-b59ab75adceb}\mpksl0e0896e5.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6e322e41-16ee-4610-af23-b59ab75adceb}\MpKsl0e0896e5.sys [?]
S1 MpKsl103297fb;MpKsl103297fb;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3ae7e671-d7af-40d1-ae2c-beab53931567}\mpksl103297fb.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3ae7e671-d7af-40d1-ae2c-beab53931567}\MpKsl103297fb.sys [?]
S1 MpKsl16c2d4f2;MpKsl16c2d4f2;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{89813ccf-248c-4200-8f1e-63823e3e63ab}\mpksl16c2d4f2.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{89813ccf-248c-4200-8f1e-63823e3e63ab}\MpKsl16c2d4f2.sys [?]
S1 MpKsl1c9bf2f6;MpKsl1c9bf2f6;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{fd58702c-8a23-4fac-a364-e7415e37e52a}\mpksl1c9bf2f6.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{fd58702c-8a23-4fac-a364-e7415e37e52a}\MpKsl1c9bf2f6.sys [?]
S1 MpKsl384bcd9b;MpKsl384bcd9b;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{bb0fca32-d7c2-4f69-a63f-524bb6711e64}\mpksl384bcd9b.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{bb0fca32-d7c2-4f69-a63f-524bb6711e64}\MpKsl384bcd9b.sys [?]
S1 MpKsl44db9da1;MpKsl44db9da1;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b4228db2-9be4-4552-aafa-8c2d8b8b1151}\mpksl44db9da1.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b4228db2-9be4-4552-aafa-8c2d8b8b1151}\MpKsl44db9da1.sys [?]
S1 MpKsl47bb1e51;MpKsl47bb1e51;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{14a497be-7d6a-46fc-8d57-ff024f4b7228}\mpksl47bb1e51.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{14a497be-7d6a-46fc-8d57-ff024f4b7228}\MpKsl47bb1e51.sys [?]
S1 MpKsl7e1df160;MpKsl7e1df160;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{bc657804-44e4-43ae-ad03-1cc422eb0d4a}\mpksl7e1df160.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{bc657804-44e4-43ae-ad03-1cc422eb0d4a}\MpKsl7e1df160.sys [?]
S1 MpKsl902efda9;MpKsl902efda9;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{002e0b2b-5071-4841-a695-01cea6efe880}\mpksl902efda9.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{002e0b2b-5071-4841-a695-01cea6efe880}\MpKsl902efda9.sys [?]
S1 MpKsla7e8f3c2;MpKsla7e8f3c2;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{89813ccf-248c-4200-8f1e-63823e3e63ab}\mpksla7e8f3c2.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{89813ccf-248c-4200-8f1e-63823e3e63ab}\MpKsla7e8f3c2.sys [?]
S1 MpKsla81c5545;MpKsla81c5545;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{830c4c04-d291-4f03-8722-fffdebfa8448}\mpksla81c5545.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{830c4c04-d291-4f03-8722-fffdebfa8448}\MpKsla81c5545.sys [?]
S1 MpKslad970c36;MpKslad970c36;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{002e0b2b-5071-4841-a695-01cea6efe880}\mpkslad970c36.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{002e0b2b-5071-4841-a695-01cea6efe880}\MpKslad970c36.sys [?]
S1 MpKslbdb31f3c;MpKslbdb31f3c;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{22acd95f-478c-4b70-95c2-4a2759f7bf26}\mpkslbdb31f3c.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{22acd95f-478c-4b70-95c2-4a2759f7bf26}\MpKslbdb31f3c.sys [?]
S1 MpKsld541aaad;MpKsld541aaad;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{bb0fca32-d7c2-4f69-a63f-524bb6711e64}\mpksld541aaad.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{bb0fca32-d7c2-4f69-a63f-524bb6711e64}\MpKsld541aaad.sys [?]
S1 MpKsle2c4e96e;MpKsle2c4e96e;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{485247b6-af06-4cf1-b7ca-7f3301a1e7c9}\mpksle2c4e96e.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{485247b6-af06-4cf1-b7ca-7f3301a1e7c9}\MpKsle2c4e96e.sys [?]
S1 MpKslea5b7d65;MpKslea5b7d65;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3c4cea63-263b-485f-8961-554c54dc5a84}\mpkslea5b7d65.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3c4cea63-263b-485f-8961-554c54dc5a84}\MpKslea5b7d65.sys [?]
S2 0038071284469571mcinstcleanup;McAfee Application Installer Cleanup (0038071284469571);c:\docume~1\brianw~1\locals~1\temp\003807~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service –> c:\docume~1\brianw~1\locals~1\temp\003807~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
.
=============== Created Last 30 ================
.
2011-05-16 14:58:21 ——– d–h–w- c:\windows\PIF
2011-05-16 14:16:04 388096 —-a-r- c:\docume~1\brianw~1\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-05-16 14:15:53 ——– d—–w- c:\program files\Trend Micro
2011-05-16 14:14:35 98392 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-05-16 14:08:40 64512 —-a-w- c:\windows\system32\drivers\Lbd.sys
2011-05-16 14:06:48 ——– d—–w- c:\program files\Lavasoft
2011-05-16 13:49:34 28752 —-a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{b9725b79-44cb-4ebe-a818-e12564495e56}\MpKslc0d1c994.sys
2011-05-16 13:47:53 7071056 —-a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{b9725b79-44cb-4ebe-a818-e12564495e56}\mpengine.dll
2011-04-28 23:17:32 ——– d—–w- c:\docume~1\brianw~1\applic~1\Unity
2011-04-28 23:07:07 ——– d—–w- c:\docume~1\brianw~1\locals~1\applic~1\Unity
2011-04-22 07:02:31 ——– d—–w- C:\42670b8330456c5d7fb669
2011-04-21 03:23:57 ——– d—–w- c:\docume~1\brianw~1\locals~1\applic~1\Temp
2011-04-20 15:10:42 ——– d—–w- c:\windows\system32\XPSViewer
2011-04-20 15:09:41 89088 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
2011-04-20 15:08:25 117760 ——w- c:\windows\system32\prntvpt.dll
2011-04-20 15:08:24 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2011-04-20 15:08:16 597504 ——w- c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2011-04-20 15:08:16 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2011-04-20 15:08:14 575488 ——w- c:\windows\system32\xpsshhdr.dll
2011-04-20 15:08:14 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2011-04-20 15:08:05 1676288 ——w- c:\windows\system32\xpssvcs.dll
2011-04-20 15:08:05 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2011-04-20 15:07:56 ——– d—–w- C:\ee25d90026fb59672097c565e84b1b
.
==================== Find3M ====================
.
2011-04-12 00:52:28 196 —h–w- c:\windows\system32\tscct1.dll
2011-03-23 05:08:53 6580 –sha-w- c:\windows\system32\KGyGaAvL.sys
2011-03-23 05:08:22 56 –sh–r- c:\windows\system32\F32CA98BCC.sys
2011-03-23 05:05:14 88 –sh–r- c:\windows\system32\CC8BA92CF3.sys
2011-03-15 00:46:23 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-03-15 00:46:23 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-03-07 05:33:50 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37:06 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21:11 1857920 —-a-w- c:\windows\system32\win32k.sys
2011-02-22 23:06:29 916480 —-a-w- c:\windows\system32\wininet.dll
2011-02-22 23:06:29 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-02-22 23:06:29 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-02-22 11:41:59 385024 —-a-w- c:\windows\system32\html.iec
2011-02-17 12:32:12 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2009-10-27 15:06:48 34101624 -c–a-w- c:\program files\sdsetup_aff.exe
2009-10-05 01:49:26 2169915 -c–a-w- c:\program files\SetupImgBurn_2.5.0.0.exe
2009-10-05 00:08:00 12951423 -c–a-w- c:\program files\dvdflick_setup_1.3.0.7.exe
.
============= FINISH: 11:11:54.12 ===============




GMER 1.0.15.15627 - http://www.gmer.net
Rootkit scan 2011-05-16 12:31:36
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 Hitachi_HTS541060G9SA00 rev.MB3OC60G
Running: 5koikqn3.exe; Driver: C:\DOCUME~1\BRIANW~1\LOCALS~1\Temp\pwdyqpob.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\DRIVERS\Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xA8E0C87E]
SSDT \SystemRoot\system32\DRIVERS\Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xA8E0CBFE]

INT 0x01 \??\C:\DOCUME~1\BRIANW~1\LOCALS~1\Temp\mbr.sys F79F6C42

—- User code sections - GMER 1.0.15 —-

.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90ED1A
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90ED8B
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EEB9
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1316] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90ED1A
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90ED8B
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EEB9
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2828] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90ED1A
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90ED8B
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EEB9
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 17, 00]
.text C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3064] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device A8B95D20

Hey mowman -


Thanks for getting back to me so quickly.

I deleted Lavasoft and disabled the other programs.
I ran ComboFix and installed the Recovery Console.

Attached is the Combo log:


ComboFix 11-05-17.03 - Brian Williams 05/19/2011 0:01.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.576 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\tscct1.dll
.
—– BITS: Possible infected sites —–
.
hxxp://au.download.windowsupdate.comj+|Cv+@J:NGD_DQ{zcxLJS@G@*oH
.
((((((((((((((((((((((((( Files Created from 2011-04-19 to 2011-05-19 )))))))))))))))))))))))))))))))
.
.
2011-05-19 02:57 . 2011-05-19 03:31 ——– d—–w- c:\windows\SxsCaPendDel
2011-05-19 01:23 . 2011-04-11 04:04 7071056 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{77217183-3FC6-441A-96B4-89669B37F3F4}\mpengine.dll
2011-05-18 01:11 . 2011-05-18 01:11 ——– d–h–w- c:\windows\PIF
2011-05-16 14:16 . 2011-05-16 14:16 388096 —-a-r- c:\documents and settings\Brian Williams\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-16 14:15 . 2011-05-16 14:15 ——– d—–w- c:\program files\Trend Micro
2011-05-16 14:14 . 2011-05-16 14:14 98392 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-05-16 14:06 . 2011-05-16 14:07 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2011-04-28 23:17 . 2011-04-28 23:17 ——– d—–w- c:\documents and settings\Brian Williams\Application Data\Unity
2011-04-28 23:07 . 2011-04-28 23:07 ——– d—–w- c:\documents and settings\Brian Williams\Local Settings\Application Data\Unity
2011-04-22 07:02 . 2011-05-16 03:47 ——– d—–w- C:\42670b8330456c5d7fb669
2011-04-21 03:23 . 2011-04-21 03:23 ——– d—–w- c:\documents and settings\Brian Williams\Local Settings\Application Data\Temp
2011-04-20 15:10 . 2011-04-20 15:10 ——– d—–w- c:\windows\system32\XPSViewer
2011-04-20 15:10 . 2011-04-20 15:10 ——– d—–w- c:\program files\MSBuild
2011-04-20 15:10 . 2011-04-20 15:10 ——– d—–w- c:\program files\Reference Assemblies
2011-04-20 15:09 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2011-04-20 15:08 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2011-04-20 15:08 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2011-04-20 15:08 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2011-04-20 15:08 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2011-04-20 15:08 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2011-04-20 15:08 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2011-04-20 15:08 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2011-04-20 15:08 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2011-04-20 15:07 . 2011-04-20 15:09 ——– d—–w- C:\ee25d90026fb59672097c565e84b1b
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-11 04:04 . 2010-09-16 11:49 7071056 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-03-15 00:46 . 2011-03-15 00:46 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-03-15 00:46 . 2011-03-15 00:46 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-03-07 05:33 . 2005-08-16 09:40 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2005-08-16 09:18 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2005-08-16 09:18 1857920 —-a-w- c:\windows\system32\win32k.sys
2011-02-22 23:06 . 2005-08-16 09:18 916480 —-a-w- c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2005-08-16 09:18 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-02-22 23:06 . 2005-08-16 09:18 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-02-22 11:41 . 2005-08-16 09:18 385024 —-a-w- c:\windows\system32\html.iec
2009-10-27 15:06 . 2009-10-27 15:05 34101624 -c–a-w- c:\program files\sdsetup_aff.exe
2009-10-05 01:49 . 2009-10-05 01:49 2169915 -c–a-w- c:\program files\SetupImgBurn_2.5.0.0.exe
2009-10-05 00:08 . 2009-10-05 00:07 12951423 -c–a-w- c:\program files\dvdflick_setup_1.3.0.7.exe
2011-04-30 15:44 . 2011-03-30 17:38 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ShowLOMControl"="1 (0x1)" [X]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2006-01-09 417792]
"CTSVolFE.exe"="c:\program files\Creative\Mixer\CTSVolFE.exe" [2005-02-23 57344]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-5-17 24576]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2009-9-30 155648]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
.
S1 MpKsl0e0896e5;MpKsl0e0896e5;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E322E41-16EE-4610-AF23-B59AB75ADCEB}\MpKsl0e0896e5.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E322E41-16EE-4610-AF23-B59AB75ADCEB}\MpKsl0e0896e5.sys [?]
S1 MpKsl103297fb;MpKsl103297fb;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3AE7E671-D7AF-40D1-AE2C-BEAB53931567}\MpKsl103297fb.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3AE7E671-D7AF-40D1-AE2C-BEAB53931567}\MpKsl103297fb.sys [?]
S1 MpKsl16c2d4f2;MpKsl16c2d4f2;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{89813CCF-248C-4200-8F1E-63823E3E63AB}\MpKsl16c2d4f2.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{89813CCF-248C-4200-8F1E-63823E3E63AB}\MpKsl16c2d4f2.sys [?]
S1 MpKsl1c9bf2f6;MpKsl1c9bf2f6;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FD58702C-8A23-4FAC-A364-E7415E37E52A}\MpKsl1c9bf2f6.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FD58702C-8A23-4FAC-A364-E7415E37E52A}\MpKsl1c9bf2f6.sys [?]
S1 MpKsl384bcd9b;MpKsl384bcd9b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BB0FCA32-D7C2-4F69-A63F-524BB6711E64}\MpKsl384bcd9b.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BB0FCA32-D7C2-4F69-A63F-524BB6711E64}\MpKsl384bcd9b.sys [?]
S1 MpKsl44db9da1;MpKsl44db9da1;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B4228DB2-9BE4-4552-AAFA-8C2D8B8B1151}\MpKsl44db9da1.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B4228DB2-9BE4-4552-AAFA-8C2D8B8B1151}\MpKsl44db9da1.sys [?]
S1 MpKsl47bb1e51;MpKsl47bb1e51;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{14A497BE-7D6A-46FC-8D57-FF024F4B7228}\MpKsl47bb1e51.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{14A497BE-7D6A-46FC-8D57-FF024F4B7228}\MpKsl47bb1e51.sys [?]
S1 MpKsl7e1df160;MpKsl7e1df160;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BC657804-44E4-43AE-AD03-1CC422EB0D4A}\MpKsl7e1df160.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BC657804-44E4-43AE-AD03-1CC422EB0D4A}\MpKsl7e1df160.sys [?]
S1 MpKsl902efda9;MpKsl902efda9;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{002E0B2B-5071-4841-A695-01CEA6EFE880}\MpKsl902efda9.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{002E0B2B-5071-4841-A695-01CEA6EFE880}\MpKsl902efda9.sys [?]
S1 MpKsla7e8f3c2;MpKsla7e8f3c2;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{89813CCF-248C-4200-8F1E-63823E3E63AB}\MpKsla7e8f3c2.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{89813CCF-248C-4200-8F1E-63823E3E63AB}\MpKsla7e8f3c2.sys [?]
S1 MpKsla81c5545;MpKsla81c5545;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{830C4C04-D291-4F03-8722-FFFDEBFA8448}\MpKsla81c5545.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{830C4C04-D291-4F03-8722-FFFDEBFA8448}\MpKsla81c5545.sys [?]
S1 MpKslad970c36;MpKslad970c36;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{002E0B2B-5071-4841-A695-01CEA6EFE880}\MpKslad970c36.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{002E0B2B-5071-4841-A695-01CEA6EFE880}\MpKslad970c36.sys [?]
S1 MpKslbdb31f3c;MpKslbdb31f3c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{22ACD95F-478C-4B70-95C2-4A2759F7BF26}\MpKslbdb31f3c.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{22ACD95F-478C-4B70-95C2-4A2759F7BF26}\MpKslbdb31f3c.sys [?]
S1 MpKsld541aaad;MpKsld541aaad;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BB0FCA32-D7C2-4F69-A63F-524BB6711E64}\MpKsld541aaad.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BB0FCA32-D7C2-4F69-A63F-524BB6711E64}\MpKsld541aaad.sys [?]
S1 MpKsle2c4e96e;MpKsle2c4e96e;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{485247B6-AF06-4CF1-B7CA-7F3301A1E7C9}\MpKsle2c4e96e.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{485247B6-AF06-4CF1-B7CA-7F3301A1E7C9}\MpKsle2c4e96e.sys [?]
S1 MpKslea5b7d65;MpKslea5b7d65;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3C4CEA63-263B-485F-8961-554C54DC5A84}\MpKslea5b7d65.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3C4CEA63-263B-485F-8961-554C54DC5A84}\MpKslea5b7d65.sys [?]
S2 0038071284469571mcinstcleanup;McAfee Application Installer Cleanup (0038071284469571);c:\docume~1\BRIANW~1\LOCALS~1\Temp\003807~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service –> c:\docume~1\BRIANW~1\LOCALS~1\Temp\003807~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
2011-05-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2818633985-1491378312-326800967-1005Core.job
- c:\documents and settings\Brian Williams\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-12 16:27]
.
2011-05-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2818633985-1491378312-326800967-1005UA.job
- c:\documents and settings\Brian Williams\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-12 16:27]
.
2011-05-19 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 17:26]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
Trusted Zone: turbotax.com
Trusted Zone: musicmatch.com\online
FF - ProfilePath - c:\documents and settings\Brian Williams\Application Data\Mozilla\Firefox\Profiles\cq6e8o1f.default\
FF - prefs.js: browser.startup.homepage - hxxp://my.msn.com/
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-msnmsgr - c:\program files\MSN Messenger\msnmsgr.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
MSConfigStartUp-ModemOnHold - c:\program files\NetWaiting\netWaiting.exe
AddRemove-McAfee Uninstall Utility - c:\progra~1\McAfee.com\Shared\mcappins.exe
AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-19 00:25
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(892)
c:\windows\System32\BCMLogon.dll
.
Completion time: 2011-05-19 00:41:34
ComboFix-quarantined-files.txt 2011-05-19 04:41
.
Pre-Run: 9,184,698,368 bytes free
Post-Run: 10,421,452,800 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
.
- - End Of File - - F64C8215C380D6C3D8A0D16DC4B6FC0F

Here are the logs:



OTL logfile created on: 5/19/2011 12:46:57 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Brian Williams\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 597.00 Mb Available Physical Memory | 59.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 69.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 49.80 Gb Total Space | 9.75 Gb Free Space | 19.57% Space Free | Partition Type: NTFS

Computer Name: WILLIAMS | User Name: Brian Williams | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Brian Williams\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Creative\Mixer\CTSVolFE.exe (Creative Technology Ltd)
PRC - C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)
PRC - C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Brian Williams\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\hccutils.dll (Intel Corporation)


========== Win32 Services (SafeList) ==========

SRV - (0038071284469571mcinstcleanup) McAfee Application Installer Cleanup (0038071284469571) – File not found
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (DSBrokerService) – C:\Program Files\DellSupport\brkrsvc.exe ()
SRV - (DVD-RAM_Service) – C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)


========== Driver Services (SafeList) ==========

DRV - (MpKslb462d927) – c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2F0DDEA3-156C-4402-A595-C410755C31DC}\MpKslb462d927.sys (Microsoft Corporation)
DRV - (dsunidrv) – C:\WINDOWS\system32\drivers\dsunidrv.sys (Gteko Ltd.)
DRV - (winusb) – C:\WINDOWS\system32\drivers\winusb.sys (Microsoft Corporation)
DRV - (DSproct) – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (ASCTRM) – C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (APPDRV) – C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (rimmptsk) – C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (rismxdp) – C:\WINDOWS\system32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) – C:\WINDOWS\system32\drivers\rimsptsk.sys (REDC)
DRV - (meiudf) – C:\WINDOWS\system32\drivers\meiudf.sys (Matsushita Electric Industrial Co.,Ltd.)
DRV - (pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://my.msn.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/30 11:44:50 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/20 23:00:43 | 000,000,000 | —D | M]

[2011/02/04 20:04:23 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Brian Williams\Application Data\Mozilla\Extensions
[2011/02/04 20:04:23 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Brian Williams\Application Data\Mozilla\Firefox\Profiles\cq6e8o1f.default\extensions
[2011/03/30 13:38:16 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) –
[2011/03/14 20:47:23 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/04/22 03:24:31 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/04/30 11:44:37 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011/03/14 20:46:25 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/01/01 04:00:00 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/05/19 00:25:01 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CTSVolFE.exe] C:\Program Files\Creative\Mixer\CTSVolFE.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ShowLOMControl] Reg Error: Invalid data type. File not found
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil10p_Plugin.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: musicmatch.com ([online] https in Trusted sites)
O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www2.snapfish.com/SnapfishActivia.cab (Snapfish Activia)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://by133fd.bay133.hotmail.msn.com/resources/MsnPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 () - file:///C:/DOCUME~1/BRIANW~1/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/16 05:43:04 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2011/05/19 12:25:55 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Brian Williams\Desktop\OTL.exe
[2011/05/18 23:55:32 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/05/18 23:40:06 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/05/18 23:40:06 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/05/18 23:40:06 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/05/18 23:40:06 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/05/18 23:28:27 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/05/18 23:01:15 | 000,000,000 | —D | C] – C:\Qoobox
[2011/05/18 22:57:16 | 000,000,000 | —D | C] – C:\WINDOWS\SxsCaPendDel
[2011/05/17 21:11:03 | 000,000,000 | -H-D | C] – C:\WINDOWS\PIF
[2011/05/17 21:11:02 | 000,000,000 | —D | C] – C:\Documents and Settings\Brian Williams\Start Menu\Programs\HiJackThis
[2011/05/16 10:15:53 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/05/16 10:14:35 | 000,098,392 | —- | C] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011/05/16 10:06:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2011/05/12 12:30:29 | 000,000,000 | —D | C] – C:\Documents and Settings\Brian Williams\Start Menu\Programs\Google Chrome
[2011/04/28 19:17:32 | 000,000,000 | —D | C] – C:\Documents and Settings\Brian Williams\Application Data\Unity
[2011/04/28 19:07:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Unity
[2011/04/22 03:02:31 | 000,000,000 | —D | C] – C:\42670b8330456c5d7fb669
[2011/04/20 23:23:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Brian Williams\Local Settings\Application Data\Temp
[2011/04/20 23:18:10 | 000,000,000 | R–D | C] – C:\Documents and Settings\Brian Williams\Desktop\Frank
[2011/04/20 11:10:42 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2011/04/20 11:10:32 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2011/04/20 11:10:09 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2011/04/20 11:08:25 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2011/04/20 11:08:24 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2011/04/20 11:08:16 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2011/04/20 11:08:14 | 000,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2011/04/20 11:08:05 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2011/04/20 11:08:05 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2011/04/20 11:07:56 | 000,000,000 | —D | C] – C:\ee25d90026fb59672097c565e84b1b
[2009/10/27 11:05:47 | 034,101,624 | —- | C] (PC Tools ) – C:\Program Files\sdsetup_aff.exe
[2009/10/04 21:49:15 | 002,169,915 | —- | C] (LIGHTNING UK!) – C:\Program Files\SetupImgBurn_2.5.0.0.exe
[2009/10/04 20:07:53 | 012,951,423 | —- | C] (Dennis Meuwissen ) – C:\Program Files\dvdflick_setup_1.3.0.7.exe
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/19 12:33:01 | 000,001,014 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2818633985-1491378312-326800967-1005UA.job
[2011/05/19 12:33:01 | 000,000,962 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2818633985-1491378312-326800967-1005Core.job
[2011/05/19 12:24:59 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Brian Williams\Desktop\OTL.exe
[2011/05/19 11:52:03 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/05/19 00:25:01 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/05/18 23:55:41 | 000,000,325 | RHS- | M] () – C:\boot.ini
[2011/05/18 23:40:14 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/05/18 23:34:36 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/05/18 23:31:29 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/05/18 23:31:24 | 1063,714,816 | -HS- | M] () – C:\hiberfil.sys
[2011/05/18 22:58:03 | 004,351,251 | R— | M] () – C:\Documents and Settings\Brian Williams\Desktop\ComboFix.exe
[2011/05/17 17:28:32 | 000,445,938 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/05/17 17:28:32 | 000,072,978 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/05/16 10:14:33 | 000,098,392 | —- | M] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011/05/12 12:30:47 | 000,002,329 | —- | M] () – C:\Documents and Settings\Brian Williams\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/05/10 12:24:28 | 000,002,497 | —- | M] () – C:\Documents and Settings\Brian Williams\Desktop\Microsoft Office Word 2003.lnk
[2011/05/09 12:25:53 | 000,002,495 | —- | M] () – C:\Documents and Settings\Brian Williams\Desktop\Microsoft Office Excel 2003 (2).lnk
[2011/04/22 10:45:06 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/04/20 13:03:42 | 000,261,432 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/18 23:55:41 | 000,000,209 | —- | C] () – C:\Boot.bak
[2011/05/18 23:55:36 | 000,260,272 | RHS- | C] () – C:\cmldr
[2011/05/18 23:40:06 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/05/18 23:40:06 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/05/18 23:40:06 | 000,089,088 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/05/18 23:40:06 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/05/18 23:40:06 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/05/18 22:57:51 | 004,351,251 | R— | C] () – C:\Documents and Settings\Brian Williams\Desktop\ComboFix.exe
[2011/05/16 09:32:42 | 1063,714,816 | -HS- | C] () – C:\hiberfil.sys
[2011/05/12 12:30:47 | 000,002,329 | —- | C] () – C:\Documents and Settings\Brian Williams\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/05/12 12:28:27 | 000,001,014 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2818633985-1491378312-326800967-1005UA.job
[2011/05/12 12:28:23 | 000,000,962 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2818633985-1491378312-326800967-1005Core.job
[2011/04/21 00:37:46 | 000,050,849 | —- | C] () – C:\Documents and Settings\Brian Williams\Desktop\Frank and David.jpg
[2011/04/20 23:00:44 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2010/07/02 12:47:02 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2008/12/19 13:28:33 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2007/09/19 20:03:51 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2007/05/03 20:14:33 | 000,003,072 | —- | C] () – C:\Documents and Settings\Brian Williams\Application Data\dvd.bmk
[2007/02/01 08:35:58 | 000,007,680 | —- | C] () – C:\Documents and Settings\Brian Williams\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/08/23 00:00:19 | 000,000,029 | —- | C] () – C:\WINDOWS\atid.ini
[2006/08/01 14:12:17 | 000,000,072 | —- | C] () – C:\WINDOWS\CmdFile.INI
[2006/06/28 20:53:18 | 000,000,056 | RHS- | C] () – C:\WINDOWS\System32\F32CA98BCC.sys
[2006/05/27 16:29:59 | 000,006,656 | —- | C] () – C:\WINDOWS\System32\CNMVSyf.DLL
[2006/05/27 16:29:49 | 000,000,356 | —- | C] () – C:\WINDOWS\System32\CNCASv51.ini
[2006/05/27 16:29:23 | 000,000,599 | —- | C] () – C:\WINDOWS\System32\CNCMP51.INI
[2006/05/25 17:30:23 | 000,006,580 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2006/05/25 17:30:23 | 000,000,088 | RHS- | C] () – C:\WINDOWS\System32\CC8BA92CF3.sys
[2006/05/24 09:36:14 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/05/23 16:36:35 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\instlsp.exe
[2006/05/23 16:19:57 | 000,000,137 | —- | C] () – C:\Documents and Settings\Brian Williams\Local Settings\Application Data\fusioncache.dat
[2006/05/17 23:07:04 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/05/17 23:03:19 | 000,004,469 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/05/17 22:58:15 | 000,149,504 | —- | C] () – C:\WINDOWS\UNWISE.EXE
[2006/05/17 22:52:32 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/05/17 22:50:14 | 000,000,004 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare
[2006/05/17 22:24:06 | 000,049,152 | —- | C] () – C:\WINDOWS\setpwrcg.exe
[2006/05/17 22:23:58 | 000,016,480 | —- | C] () – C:\WINDOWS\System32\rixdicon.dll
[2006/05/17 22:23:42 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2006/05/17 22:23:42 | 000,018,944 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2006/05/17 22:23:38 | 000,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2006/05/17 22:23:24 | 000,000,392 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/08/16 05:48:31 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2005/08/16 05:38:45 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2005/08/16 05:37:24 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2005/08/16 05:33:38 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2005/08/16 05:27:59 | 000,261,432 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/08/16 05:18:35 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2005/08/16 05:18:33 | 000,445,938 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2005/08/16 05:18:33 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2005/08/16 05:18:33 | 000,072,978 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2005/08/16 05:18:33 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2005/08/16 05:18:32 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2005/08/16 05:18:30 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/08/16 05:18:28 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2005/08/16 05:18:23 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2005/08/16 05:18:23 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2005/08/16 05:18:15 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2005/08/16 05:18:08 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2005/08/05 15:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2011/02/07 22:19:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Age of Empires 3 YPack Trial
[2008/01/31 17:51:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SupportSoft
[2011/04/11 21:43:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2006/05/17 22:53:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/02/10 13:20:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/04/11 21:06:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Brian Williams\Application Data\Bullzip
[2011/04/28 19:17:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Brian Williams\Application Data\Unity
[2011/05/18 23:40:14 | 000,000,424 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2011/05/17 21:11:49 | 000,000,668 | —- | M] () – C:\aaw7boot.log
[2005/08/16 05:43:04 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2011/04/02 23:48:57 | 000,000,209 | —- | M] () – C:\Boot.bak
[2011/05/18 23:55:41 | 000,000,325 | RHS- | M] () – C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2011/05/19 00:41:38 | 000,018,404 | —- | M] () – C:\ComboFix.txt
[2005/08/16 05:43:04 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2006/05/17 22:29:14 | 000,006,432 | RH– | M] () – C:\dell.sdr
[2011/05/18 23:31:24 | 1063,714,816 | -HS- | M] () – C:\hiberfil.sys
[2006/05/23 21:29:38 | 000,004,128 | —- | M] () – C:\INFCACHE.1
[2005/08/16 05:43:04 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2007/08/26 13:45:41 | 000,002,514 | -H– | M] () – C:\IPH.PH
[2005/08/16 05:43:04 | 000,000,000 | -H– | M] () – C:\MSDOS.SYS
[2004/08/10 06:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/10/28 08:34:58 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/05/18 23:31:22 | 1598,029,824 | -HS- | M] () – C:\pagefile.sys
[2008/12/11 15:53:17 | 000,000,268 | -H– | M] () – C:\sqmdata00.sqm
[2008/12/13 23:01:36 | 000,000,268 | -H– | M] () – C:\sqmdata01.sqm
[2008/12/13 23:33:33 | 000,000,268 | -H– | M] () – C:\sqmdata02.sqm
[2008/12/16 22:56:29 | 000,000,268 | -H– | M] () – C:\sqmdata03.sqm
[2008/12/17 00:03:06 | 000,000,268 | -H– | M] () – C:\sqmdata04.sqm
[2008/12/19 21:35:32 | 000,000,268 | -H– | M] () – C:\sqmdata05.sqm
[2008/11/10 17:43:41 | 000,000,232 | -H– | M] () – C:\sqmdata06.sqm
[2008/11/12 13:26:18 | 000,000,268 | -H– | M] () – C:\sqmdata07.sqm
[2008/11/12 20:38:41 | 000,000,268 | -H– | M] () – C:\sqmdata08.sqm
[2008/11/12 21:08:18 | 000,000,268 | -H– | M] () – C:\sqmdata09.sqm
[2008/11/12 22:54:16 | 000,000,268 | -H– | M] () – C:\sqmdata10.sqm
[2008/11/18 18:01:33 | 000,000,268 | -H– | M] () – C:\sqmdata11.sqm
[2008/11/21 07:48:02 | 000,000,268 | -H– | M] () – C:\sqmdata12.sqm
[2008/11/23 23:28:34 | 000,000,268 | -H– | M] () – C:\sqmdata13.sqm
[2008/11/23 23:47:09 | 000,000,268 | -H– | M] () – C:\sqmdata14.sqm
[2008/11/26 22:05:07 | 000,000,268 | -H– | M] () – C:\sqmdata15.sqm
[2008/11/26 23:43:53 | 000,000,268 | -H– | M] () – C:\sqmdata16.sqm
[2008/11/30 13:44:10 | 000,000,268 | -H– | M] () – C:\sqmdata17.sqm
[2008/12/01 18:03:35 | 000,000,268 | -H– | M] () – C:\sqmdata18.sqm
[2008/12/01 23:26:39 | 000,000,268 | -H– | M] () – C:\sqmdata19.sqm
[2008/12/11 15:53:17 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2008/12/13 23:01:36 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2008/12/13 23:33:33 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2008/12/16 22:56:29 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2008/12/17 00:03:06 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2008/12/19 21:35:32 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2008/11/10 17:43:41 | 000,000,244 | -H– | M] () – C:\sqmnoopt06.sqm
[2008/11/12 13:26:18 | 000,000,244 | -H– | M] () – C:\sqmnoopt07.sqm
[2008/11/12 20:38:41 | 000,000,244 | -H– | M] () – C:\sqmnoopt08.sqm
[2008/11/12 21:08:18 | 000,000,244 | -H– | M] () – C:\sqmnoopt09.sqm
[2008/11/12 22:54:16 | 000,000,244 | -H– | M] () – C:\sqmnoopt10.sqm
[2008/11/18 18:01:33 | 000,000,244 | -H– | M] () – C:\sqmnoopt11.sqm
[2008/11/21 07:48:02 | 000,000,244 | -H– | M] () – C:\sqmnoopt12.sqm
[2008/11/23 23:28:34 | 000,000,244 | -H– | M] () – C:\sqmnoopt13.sqm
[2008/11/23 23:47:09 | 000,000,244 | -H– | M] () – C:\sqmnoopt14.sqm
[2008/11/26 22:05:07 | 000,000,244 | -H– | M] () – C:\sqmnoopt15.sqm
[2008/11/26 23:43:53 | 000,000,244 | -H– | M] () – C:\sqmnoopt16.sqm
[2008/11/30 13:44:10 | 000,000,244 | -H– | M] () – C:\sqmnoopt17.sqm
[2008/12/01 18:03:35 | 000,000,244 | -H– | M] () – C:\sqmnoopt18.sqm
[2008/12/01 23:26:39 | 000,000,244 | -H– | M] () – C:\sqmnoopt19.sqm
[2006/05/17 22:54:01 | 000,000,071 | —- | M] () – C:\SystemInfo.ini

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2005/08/16 05:42:12 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2003/09/05 05:00:00 | 000,016,384 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPDyf.DLL
[2003/09/05 05:00:00 | 000,048,128 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPPyf.DLL
[2008/07/06 08:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 06:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/10/04 20:08:00 | 012,951,423 | —- | M] (Dennis Meuwissen ) – C:\Program Files\dvdflick_setup_1.3.0.7.exe
[2009/10/27 11:06:48 | 034,101,624 | —- | M] (PC Tools ) – C:\Program Files\sdsetup_aff.exe
[2009/10/04 21:49:26 | 002,169,915 | —- | M] (LIGHTNING UK!) – C:\Program Files\SetupImgBurn_2.5.0.0.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/08/16 05:27:08 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2005/08/16 05:27:08 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2005/08/16 05:27:08 | 000,876,544 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2005/06/09 12:33:42 | 000,027,648 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\3 Months Free NetZero.exe
[2008/10/28 08:45:19 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2006/05/23 16:20:11 | 000,000,170 | -HS- | M] () – C:\Documents and Settings\Brian Williams\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2005/08/16 05:50:28 | 000,000,079 | —- | M] () – C:\Documents and Settings\Brian Williams\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/05/18 22:58:03 | 004,351,251 | R— | M] () – C:\Documents and Settings\Brian Williams\Desktop\ComboFix.exe
[2011/05/19 12:24:59 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Brian Williams\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2004/08/10 06:00:00 | 000,000,791 | —- | M] () – C:\WINDOWS\addins\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2006/05/23 16:20:10 | 000,000,122 | -HS- | M] () – C:\Documents and Settings\Brian Williams\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2009/08/05 10:27:58 | 000,000,067 | -HS- | M] () – C:\Documents and Settings\Brian Williams\Cookies\desktop.ini
[2011/05/18 23:33:15 | 000,016,384 | -HS- | M] () – C:\Documents and Settings\Brian Williams\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >
[2003/02/06 13:41:18 | 000,019,994 | —- | M] () – C:\WINDOWS\system32\Fonts\ACADEMY_.PFB
[2003/02/06 13:41:18 | 000,000,932 | —- | M] () – C:\WINDOWS\system32\Fonts\ACADEMY_.PFM
[2003/02/06 13:41:18 | 000,032,300 | —- | M] () – C:\WINDOWS\system32\Fonts\ACADEMY_.TTF

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-11 13:43:24

========== Alternate Data Streams ==========

@Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >





OTL Extras logfile created on: 5/19/2011 12:46:57 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Brian Williams\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 597.00 Mb Available Physical Memory | 59.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 69.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 49.80 Gb Total Space | 9.75 Gb Free Space | 19.57% Space Free | Partition Type: NTFS

Computer Name: WILLIAMS | User Name: Brian Williams | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0
"C:\Program Files\MSN Messenger\msncall.exe" = C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\TurboTax\Home & Business 2007\32bit\ttax.exe" = C:\Program Files\TurboTax\Home & Business 2007\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax – (Intuit, Inc.)
"C:\Program Files\TurboTax\Home & Business 2007\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Home & Business 2007\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager – (Intuit, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F528948-0E80-4C96-B455-DE4167CB1DF7}" = Internal Network Card Power Management
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java™ 6 Update 24
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{352310C3-E46B-42D3-8F32-54721FDD72D9}" = NetZeroInstallers
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4667B940-BB01-428B-986E-A0CC46497BF7}" = ELIcon
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5B6BE547-21E2-49CA-B2E2-6A5F470593B1}" = Sonic Activation Module
"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support
"{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D5FCA42-1486-4E32-AFE8-1B7E2AA59D33}" = Digital Content Portal
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{774088D4-0777-4D78-904D-E435B318F5D2}" = Microsoft Antimalware
"{77A776C4-D10F-416D-88F0-53F2D9DCD9B3}" = Microsoft Security Client
"{7DD9A065-2C86-4A9F-A5FF-796EC1B99DCA}" = AnswerWorks 4.0 Runtime - English
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{85D3CC30-8859-481A-9654-FD9B74310BEF}" = Musicmatch® Jukebox
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{9D765FA6-F2BC-40AF-8145-50808F9BDF4E}" = DVD-RAM Driver
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{B0DF58A2-40DF-4465-AA56-38623EC9938C}" = Documentation & Support Launcher
"{B7A9E601-0E82-11D5-AE91-444553540000}" = DVD-MovieAlbumSE 3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2988E9B-C73F-422C-AD4B-A66EBE257120}" = MCU
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E42BD75A-FC23-4E3F-9F91-2658334C644F}" = Internet Service Offers Launcher
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E93E5EF6-D361-481E-849D-F16EF5C78EBC}" = Musicmatch for Windows Media Player
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"Bullzip PDF Printer_is1" = Bullzip PDF Printer 4.0.0.463
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV;_2BFA&SUBSYS;_14F100C3" = Conexant HDA D110 MDC V.92 Modem
"CTMBDemo_Audigy" = Sound Blaster Audigy ADVANCED MB Demo
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"DVD Decrypter" = DVD Decrypter (Remove Only)
"EmeraldQFE2" = Windows Media Player 10 Hotfix [See EmeraldQFE2 for more information]
"GPL Ghostscript Lite_is1" = GPL Ghostscript Lite 8.70
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"MIXERLITE" = Mixer
"Mozilla Firefox 4.0.1 (x86 en-US)" = Mozilla Firefox 4.0.1 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"RealPlayer 6.0" = RealPlayer Basic
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TurboTax Home & Business 2007" = TurboTax Home & Business 2007
"ViewpointMediaPlayer" = Viewpoint Media Player
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WET7Cable" = Windows Easy Transfer for Windows 7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"winusb0100" = Microsoft WinUsb 1.0
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/19/2011 8:31:46 AM | Computer Name = WILLIAMS | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 5/19/2011 8:31:46 AM | Computer Name = WILLIAMS | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 22730671

Error - 5/19/2011 8:31:46 AM | Computer Name = WILLIAMS | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 22730671

Error - 5/19/2011 8:31:52 AM | Computer Name = WILLIAMS | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 5/19/2011 8:31:52 AM | Computer Name = WILLIAMS | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 22736875

Error - 5/19/2011 8:31:52 AM | Computer Name = WILLIAMS | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 22736875

Error - 5/19/2011 8:31:59 AM | Computer Name = WILLIAMS | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 5/19/2011 8:31:59 AM | Computer Name = WILLIAMS | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 22744078

Error - 5/19/2011 8:31:59 AM | Computer Name = WILLIAMS | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 22744078

Error - 5/19/2011 12:18:03 PM | Computer Name = WILLIAMS | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 11.0.8328.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 5/17/2011 2:05:02 PM | Computer Name = WILLIAMS | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.101 for the Network Card with network
address 0016CE635D69 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 5/17/2011 4:59:48 PM | Computer Name = WILLIAMS | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.100 for the Network Card with network
address 0016CE635D69 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 5/17/2011 5:00:26 PM | Computer Name = WILLIAMS | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Dnscache service.

Error - 5/17/2011 5:01:03 PM | Computer Name = WILLIAMS | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Dnscache service.

Error - 5/17/2011 5:01:34 PM | Computer Name = WILLIAMS | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Dnscache service.

Error - 5/17/2011 5:03:10 PM | Computer Name = WILLIAMS | Source = DCOM | ID = 10010
Description = The server {0228576F-6E6C-4E1A-B175-0E46A316AFE2} did not register
with DCOM within the required timeout.

Error - 5/17/2011 5:25:51 PM | Computer Name = WILLIAMS | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Dnscache service.

Error - 5/18/2011 5:48:54 AM | Computer Name = WILLIAMS | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.100 for the Network Card with network
address 0016CE635D69 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 5/18/2011 3:13:09 PM | Computer Name = WILLIAMS | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.100 for the Network Card with network
address 0016CE635D69 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 5/19/2011 12:00:36 AM | Computer Name = WILLIAMS | Source = Service Control Manager | ID = 7034
Description = The Dell Wireless WLAN Tray Service service terminated unexpectedly.
It has done this 1 time(s).


< End of report >