Spyware / Malware / Virus Removal

Audio Lag and Slow Start up

7 min read

Looking for the outcome? Ask AI

stacks Topic Starter

Post #1May 29, 2011, 11:57 PM UTC

Hello What the Tech Team,

If you could please assist, it would be appreciated. My computer's audio periodically lags. The audio would slow down or stop and start altogether. Additionally, the PC takes forever to start-up. I've done malware searches with Malwarebytes and have come up clean. I've also done Avast (free) virus scan and have come up clean again.

If you could please help me troubleshoot, it would be appreciated. Below is an OTL scan as instructed. Please note it only produced one notepad and not the other "Extras" notepad.

Thanks very much,

Stacks

SCAN:

OTL logfile created on: 29/05/2011 4:41:46 PM - Run 2
OTL by OldTimer - Version 3.1.35.0 Folder = C:\Documents and Settings\Compaq_Administrator\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 49.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 178.10 Gb Total Space | 7.18 Gb Free Space | 4.03% Space Free | Partition Type: NTFS
Drive D: | 8.19 Gb Total Space | 0.55 Gb Free Space | 6.67% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive K: | 74.52 Gb Total Space | 20.64 Gb Free Space | 27.69% Space Free | Partition Type: NTFS

Computer Name: LARAKARLO1
Current User Name: Compaq_Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
PRC - C:\Documents and Settings\Compaq_Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe ()
PRC - C:\Program Files\AskBarDis\bar\bin\AskService.exe ()
PRC - C:\Program Files\Citrix\GoToMyPC\g2tray.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToMyPC\g2svc.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToMyPC\g2pre.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToMyPC\g2comm.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)
PRC - C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
PRC - C:\WINDOWS\arservice.exe (Microsoft)

========== Modules (SafeList) ==========

MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Documents and Settings\Compaq_Administrator\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (ASKUpgrade) – C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe ()
SRV - (ASKService) – C:\Program Files\AskBarDis\bar\bin\AskService.exe ()
SRV - (GoToMyPC) – C:\Program Files\Citrix\GoToMyPC\g2svc.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)
SRV - (Macromedia Licensing Service) – C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe ()
SRV - (ARSVC) – C:\WINDOWS\arservice.exe (Microsoft)

========== Driver Services (SafeList) ==========

DRV - (aswSnx) – C:\WINDOWS\system32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\system32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\system32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\system32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\system32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\system32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\system32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (LVUVC) Logitech Webcam C210(UVC) – C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (LVPr2Mon) – C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\eengine\eectrl.sys (Symantec Corporation)
DRV - (SCDEmu) – C:\WINDOWS\system32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (xnacc) – C:\WINDOWS\system32\drivers\xnacc.sys (Microsoft Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)
DRV - (RT73) – C:\WINDOWS\system32\drivers\Dr71WU.sys (Ralink Technology, Corp.)
DRV - (ftsata2) – C:\WINDOWS\system32\DRIVERS\ftsata2.sys (Promise Technology, Inc.)
DRV - (iaStor) – C:\WINDOWS\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (ndiscm) – C:\WINDOWS\system32\drivers\NetMotCM.sys (Motorola Inc.)
DRV - (bb-run) – C:\WINDOWS\system32\DRIVERS\bb-run.sys (Promise Technology, Inc.)
DRV - (dwusbdnt) – C:\WINDOWS\system32\drivers\dwusbdnt.sys (Digit@lway Co., Ltd.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = www.live.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://mail.google.com/mail/?auth=DQAAAHgAAABm–rIb2ukdNifi4pFyCJyGQ_6fivhRXSGBvwwsIWKms4BfvuvHd5d3gvUJ1xJB5BMHcDusOvaV9IYJVsvoj
HgHAwb0lOu75vFGf8nUaqSsYx76PnF9jWhkgSY5G8ZoOgNjMfsdp-fS7lzCq6b5nxhrbGzJ67Kg8lWUF5wIq2Jew"
FF - prefs.js..extensions.enabledItems: {191d3f14-ff4c-4895-bdea-db54526cb49a}:0.2
FF - prefs.js..extensions.enabledItems: {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F}:1.3.3
FF - prefs.js..extensions.enabledItems: [removed]:1.0

FF - HKLM\software\mozilla\Firefox\Extensions\\{191d3f14-ff4c-4895-bdea-db54526cb49a}: C:\Program Files\Adobe\Flash [2009/09/14 17:56:51 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/03 15:07:15 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/03 15:07:11 | 000,000,000 | —D | M]

[2009/05/25 19:07:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Extensions
[2010/06/02 23:43:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\ec8g9ht5.default\extensions
[2008/09/24 21:59:22 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\ec8g9ht5.default\extensions\{2fa4ed95-0317-4c6a-a74c-5f3e3912c1f9}
[2008/04/18 10:40:17 | 000,000,000 | —D | M] (del.icio.us) – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\ec8g9ht5.default\extensions\{5a2b4e34-ce62-42e9-a658-06ba4490adf8}
[2009/07/18 11:39:46 | 000,000,000 | —D | M] (Calorie Count Toolbar) – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\ec8g9ht5.default\extensions\{77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F}
[2008/09/28 19:53:37 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\ec8g9ht5.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2010/06/02 23:43:15 | 000,000,000 | —D | M] (Vuze Remote Toolbar) – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\ec8g9ht5.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2009/11/20 19:30:35 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\ec8g9ht5.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2008/08/31 11:08:47 | 000,000,000 | —D | M] (FoxLingo) – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\ec8g9ht5.default\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
[2008/05/12 23:34:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\ec8g9ht5.default\extensions\[removed]
[2009/09/19 17:56:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\ec8g9ht5.default\extensions\[removed]
[2010/06/02 23:43:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\gt8i32ph.New FireFox\extensions
[2010/06/02 23:43:21 | 000,000,000 | —D | M] (Vuze Remote Toolbar) – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\gt8i32ph.New FireFox\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2011/05/06 07:51:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\jptt8rdl.newest firefox\extensions
[2010/08/21 13:28:47 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\jptt8rdl.newest firefox\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/05/06 07:51:38 | 000,000,000 | —D | M] (Vuze Remote Community Toolbar) – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\jptt8rdl.newest firefox\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2011/05/06 07:51:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\jptt8rdl.newest firefox\extensions\[removed]
[2010/04/05 10:48:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\jptt8rdl.newest firefox\extensions\[removed]
[2011/05/03 15:07:14 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2011/02/05 17:47:07 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011/04/11 07:59:08 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/04/14 09:26:02 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011/04/19 23:43:02 | 000,288,568 | —- | M] (Cisco WebEx LLC) – C:\Program Files\Mozilla Firefox\plugins\ieatgpc.dll
[2011/04/19 23:43:12 | 000,171,320 | —- | M] (Cisco WebEx LLC) – C:\Program Files\Mozilla Firefox\plugins\npatgpc.dll
[2011/02/02 21:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2006/08/15 19:37:22 | 000,114,688 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npmozax.dll
[2010/01/01 01:00:00 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

O1 HOSTS File: ([2010/11/15 22:17:01 | 000,417,094 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 14418 more lines…
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [GoToMyPC] C:\Program Files\Citrix\GoToMyPC\g2svc.exe (Citrix Online, a division of Citrix Systems, Inc.)
O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil10k_Plugin.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe (Hewlett-Packard)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe ()
O4 - Startup: C:\Documents and Settings\Compaq_Administrator\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2…78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\intu-qt2007 {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll File not found
O18 - Protocol\Handler\intu-qt2009 {03947252-2355-4e9b-B446-8CCC75C43370} - C:\Program Files\QuickTax 2009\ic2009pp.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToMyPC: DllName - C:\Program Files\Citrix\GoToMyPC\G2WinLogon.dll - C:\Program Files\Citrix\GoToMyPC\G2WinLogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/30 14:02:02 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/27 15:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 07:01:14 | 000,000,053 | -HS- | M] () - D:\AUTORUN.FCB – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/10 21:08:09 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/05/10 21:00:00 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/12/15 13:00:07 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Apple Computer
[2010/11/01 19:00:13 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\McAfee
[2010/08/19 22:30:01 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICS
[2010/06/05 03:01:34 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/07/19 22:45:00 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/07/19 22:14:03 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009/03/16 20:15:32 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2008/03/24 12:05:00 | 001,612,672 | —- | C] (Acro Software Inc. ) – C:\Program Files\CuteWriter.exe
[2008/03/24 01:37:57 | 000,047,360 | —- | C] (VSO Software) – C:\Documents and Settings\Compaq_Administrator\Application Data\pcouffin.sys
[2007/09/27 13:21:04 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2007/09/15 19:14:13 | 006,221,304 | —- | C] (Nullsoft, Inc.) – C:\Program Files\winamp535_full_emusic-7plus.exe
[2007/04/03 23:42:48 | 015,096,568 | —- | C] (Smith Micro Software, Inc.) – C:\Program Files\StuffItStd9.5.0.9en.exe
[2006/05/25 04:46:01 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2006/05/25 04:46:00 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2006/02/19 03:28:56 | 000,012,288 | —- | C] (Hewlett-Packard Development Company, L.P.) – C:\WINDOWS\Fonts\RandFont.dll
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Compaq_Administrator\My Documents\*.tmp files -> C:\Documents and Settings\Compaq_Administrator\My Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/29 16:38:42 | 016,252,928 | -H– | M] () – C:\Documents and Settings\Compaq_Administrator\NTUSER.DAT
[2011/05/29 16:14:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/05/29 15:14:01 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/05/29 12:52:43 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/05/29 01:44:50 | 000,071,680 | —- | M] () – C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/27 18:10:05 | 000,001,821 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2011/05/27 17:46:16 | 000,000,187 | —- | M] () – C:\WINDOWS\System\hpsysdrv.DAT
[2011/05/27 17:44:35 | 014,721,024 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2011/05/27 17:44:32 | 007,286,784 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mb
[2011/05/27 17:39:37 | 000,043,531 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2011/05/27 17:39:07 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2011/05/27 17:38:53 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/05/27 17:38:49 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/05/27 17:38:43 | 2078,855,168 | -HS- | M] () – C:\hiberfil.sys
[2011/05/23 13:32:52 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Compaq_Administrator\ntuser.ini
[2011/05/23 10:47:35 | 000,097,816 | —- | M] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Connie Wicker CRC.pdf
[2011/05/23 10:46:10 | 000,097,851 | —- | M] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Jenna Nestman CRC.pdf
[2011/05/13 11:55:47 | 000,002,265 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2011/05/13 09:45:16 | 000,521,745 | —- | M] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Kate Simmonds CPR.JPG
[2011/05/13 09:13:56 | 000,097,966 | —- | M] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Stefanie Molicki CRC.pdf
[2011/05/13 09:10:48 | 000,098,276 | —- | M] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Klara Szekely CRC.pdf
[2011/05/13 08:52:38 | 000,097,105 | —- | M] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Danielle Poe CRC.pdf
[2011/05/13 08:30:16 | 000,065,016 | —- | M] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Ref verification for Gillian Cooper from Monica Edwards.pdf
[2011/05/13 08:28:46 | 001,612,288 | —- | M] () – C:\Documents and Settings\Compaq_Administrator\Desktop\NOC letterhead template.doc
[2011/05/10 22:34:46 | 000,001,550 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/05/06 08:57:35 | 000,067,082 | —- | M] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Nannies-on-Call-Application1.pdf
[2011/05/03 15:07:21 | 000,000,732 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Compaq_Administrator\My Documents\*.tmp files -> C:\Documents and Settings\Compaq_Administrator\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/23 10:47:33 | 000,097,816 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Connie Wicker CRC.pdf
[2011/05/23 10:46:03 | 000,097,851 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Jenna Nestman CRC.pdf
[2011/05/13 09:45:25 | 000,521,745 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Kate Simmonds CPR.JPG
[2011/05/13 09:13:54 | 000,097,966 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Stefanie Molicki CRC.pdf
[2011/05/13 09:10:47 | 000,098,276 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Klara Szekely CRC.pdf
[2011/05/13 08:52:35 | 000,097,105 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Danielle Poe CRC.pdf
[2011/05/13 08:30:13 | 000,065,016 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Desktop\Ref verification for Gillian Cooper from Monica Edwards.pdf
[2011/05/13 08:28:44 | 001,612,288 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Desktop\NOC letterhead template.doc
[2011/05/10 21:09:47 | 000,001,550 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/11/09 19:45:30 | 010,871,128 | —- | C] () – C:\WINDOWS\System32\LogiDPP.dll
[2010/11/09 19:45:20 | 000,316,248 | —- | C] () – C:\WINDOWS\System32\DevManagerCore.dll
[2010/11/09 19:31:42 | 000,026,286 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2010/05/07 19:46:36 | 000,014,168 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2010/05/07 19:43:30 | 000,025,824 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2009/11/29 14:59:25 | 000,000,127 | —- | C] () – C:\Documents and Settings\All Users\Application Data\Microsoft.SqlServer.Compact.351.32.bc
[2009/11/29 14:57:59 | 000,000,547 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009/11/29 14:57:58 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2008/07/24 18:03:07 | 000,000,151 | —- | C] () – C:\WINDOWS\PhotoSnapViewer.INI
[2008/03/27 10:48:50 | 000,000,080 | —- | C] () – C:\WINDOWS\intuprof.ini
[2008/03/24 12:11:31 | 000,087,552 | —- | C] () – C:\WINDOWS\System32\cpwmon2k.dll
[2008/03/24 10:27:45 | 010,421,953 | —- | C] () – C:\Program Files\imtoo dvd.exe
[2008/03/24 10:09:54 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/03/24 01:45:06 | 000,000,014 | —- | C] () – C:\WINDOWS\System32\systeminfo3.dll
[2008/03/24 01:38:04 | 000,000,033 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Application Data\pcouffin.log
[2008/03/24 01:37:57 | 000,087,608 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Application Data\ezpinst.exe
[2008/03/24 01:37:57 | 000,007,824 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Application Data\pcouffin.cat
[2008/03/24 01:37:57 | 000,001,144 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Application Data\pcouffin.inf
[2007/03/16 09:19:47 | 000,000,186 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Application Data\wklnhst.dat
[2006/09/11 21:14:49 | 000,077,824 | R— | C] () – C:\WINDOWS\System32\HPZIDS01.dll
[2006/08/30 21:28:42 | 000,000,251 | —- | C] () – C:\Program Files\wt3d.ini
[2006/08/03 23:05:15 | 000,001,353 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/08/01 08:01:32 | 000,071,680 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/07/30 22:43:02 | 000,001,423 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2006/07/30 16:13:15 | 000,000,143 | —- | C] () – C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\fusioncache.dat
[2006/05/25 05:59:32 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/05/25 05:38:31 | 000,028,848 | —- | C] () – C:\WINDOWS\System32\drivers\USBkey.sys
[2006/05/25 05:34:13 | 000,012,987 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2006/05/25 05:34:08 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2006/05/25 05:31:49 | 000,000,076 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2006/05/25 05:30:38 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/05/25 05:20:57 | 000,004,345 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/05/25 05:19:43 | 000,000,698 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.ini
[2006/05/25 05:14:56 | 000,002,343 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2006/05/25 05:13:56 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2006/05/25 05:11:52 | 000,031,746 | —- | C] () – C:\WINDOWS\System32\xshhp32.dll
[2006/05/25 05:11:52 | 000,022,530 | —- | C] () – C:\WINDOWS\System32\32kndit.dll
[2006/05/25 05:11:03 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/05/25 05:11:03 | 001,466,368 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/05/25 05:11:03 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/05/25 05:11:03 | 000,573,440 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2006/05/25 05:11:03 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/05/25 05:11:03 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2006/05/25 05:11:03 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/05/25 05:09:47 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2006/05/25 04:49:22 | 000,323,584 | —- | C] () – C:\WINDOWS\System32\pythoncom22.dll
[2006/05/25 04:49:22 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\pywintypes22.dll
[2006/05/25 04:49:06 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2006/05/02 15:38:24 | 000,000,748 | —- | C] () – C:\WINDOWS\SetBrowser.ini
[2005/08/05 14:01:54 | 000,239,104 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/08/02 16:19:16 | 000,050,176 | —- | C] () – C:\WINDOWS\armcex.dll
[2004/07/26 00:51:38 | 000,000,557 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2001/07/07 03:00:00 | 000,003,399 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
[2000/09/08 17:53:50 | 000,073,839 | —- | C] () – C:\WINDOWS\System32\KodakOneTouch.dll

========== LOP Check ==========

[2010/03/11 19:35:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2009/11/20 19:31:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2006/05/25 05:18:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Digital Interactive Systems Corporation
[2009/11/29 14:58:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\doubleTwist Corporation
[2007/08/26 16:07:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2007/08/11 17:02:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RoboForm
[2011/03/07 22:24:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/07/05 08:37:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/11/28 00:42:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2007/01/14 15:12:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Alien Skin
[2007/08/26 15:31:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\AVSMedia
[2011/05/29 16:40:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Azureus
[2008/10/30 18:46:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\de.makesoft.twhirl.0EA062BC275E7ED1E6EC3762EFFD73C7158ADF33.1
[2010/06/11 20:56:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Facebook
[2009/04/16 19:05:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Flock
[2009/07/15 23:09:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\GetRightToGo
[2008/03/24 01:03:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Image Zone Express
[2009/07/15 23:10:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\ImTOO Software Studio
[2006/12/21 20:48:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Leadertech
[2007/04/06 19:32:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Netscape
[2007/09/19 18:49:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Quask Response Data Viewer
[2008/03/24 01:43:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\SlySoft
[2007/02/14 12:14:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\SmartDraw
[2010/09/17 17:38:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Smilebox
[2007/04/03 23:57:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Smith Micro
[2007/03/16 09:19:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Template
[2010/09/13 21:10:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Administrator\Application Data\Vso

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
< End of report >

Conspire

Post #2May 31, 2011, 10:10 AM UTC

**In any case where you happen to be busy or unable to give us a reply, we would be grateful if you keep us informed in advance and we will be more than happy to wait. Failure to do so we will have your thread closed in THREE(3) days.

Hello there, stacks

I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:

Read the entire procedure
It is important to perform ALL actions in sequence.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Stick with me till you're given the all clear.
Remember, absence of symptoms does not mean the infection is all gone.
Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

—————————————————————————————————

I need to see your Extras.txt log. This can be found under OTL folder.

—————————————————————————————————

[external image: Posted Image]

Please download GMER from one of the following locations, and save it to your desktop:
Main Mirror
This version will download a randomly named file (Recommended)
Zip Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

Extract the contents of the zipped file to desktop (applicable only to Zip mirror) .
Double click [external image: Posted Image] or [external image: Posted Image] on your desktop.
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
[external image: Posted Image]

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===================================================

On your next reply please post :
OTL Extras log
GMER log

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

stacks

Post #3June 2, 2011, 3:44 AM UTC

Hello Conspire, Thanks very much for agreeing to help me. As mentioned, there were no Extras.txt output produced from the OTL scan. I downloaded the OTL again and ran it again (in case the OTL I ran was an old version) - still no Extras.txt output. I have read the "Getting started" post again and noticed that the OTL scan instructions were for Vista and Windows 7 users. I am using XP (2002). Please let me know if this is the reason why Extras.txt is not being produced. Just to be safe, I will await your response to the above before I run the GMER scan you had requested. Look forward to hearing from you. Cheers, Stacks.

Conspire

Post #4June 2, 2011, 9:00 AM UTC last edited June 2, 2011, 9:00 AM UTC

Hello, OTL will produce Extras log regardless of the operating system. Try to look the file under C:\Documents and Settings\Compaq_Administrator\Desktop\_OTL If you still cannot find it, we will just skip that for now. In the mean time, please continue with GMER scan. Thanks.

stacks

Post #5June 4, 2011, 10:23 PM UTC

Hello Conspire, Thanks very much for the reply. I apologize for the delay. I had forgotten that we no longer receive notifications for additional posts. I still cannot find the "Extras.txt" log anywhere. However, please find attached my GMER scan log. thanks again for your help, Stacks.

Attachments:

📎Gmer.txt

Conspire

Post #6June 5, 2011, 3:37 AM UTC

Hello,

I am not finding anything harmful in your computer. However, as I noticed your free space in C drive appears to be critically low. Normally I would recommend at least 15% and as you can see below, it is 4.03%.

Drive C: | 178.10 Gb Total Space | 7.18 Gb Free Space | 4.03% Space Free | Partition Type: NTFS

Clear off some unused files or programs and see if that improves anything.

Here is another tip,

If space is a problem, have a look in:
C:\Windows\SoftwareDistribution\Download

The contents of that folder are Windows Updates. They serve no purpose after installation and can safely be deleted. You could claim quite a bit of space by deleting those files.

Also in your Windows directory, you should lots of folders like:
$NtUninstallKB******$

These are Windows Updates uninstaller files. Removing these will mean you won't be able to uninstall the corresponding updates but if your system is running stable and you have no issues that may be related to a Windows Update, they can be deleted. As a precaution, you could backup the contents to a dvd/cd just incase you may need them in future.

Another option is to disable the hibernate feature if you don't use it as it could save a little space. Could also resize your pagefile on your system drive to accommodate any crash dump requirements and place another pagefile on a non-system partition.

Another good option is to delete all but your most recent system restore point. You would instantly lose the ability to restore your system back more than one point but if all is running well, it should be fine and you could gain a significant amount of disk space back.

stacks

Post #7June 5, 2011, 8:52 PM UTC

Thanks for your help. I will definitely clean up my drive for more space. In regards to your other suggestions, would you mind just giving quick instructions on how to do the following? 1. disable hibernate feature 2. resize pagefile 3. place another pagefile on a non-system partition 4. delete most recent system restore point Any assistance you can provide would be greatly appreciated. thanks again for your help, Stacks.

Conspire

Post #8June 6, 2011, 3:45 AM UTC

You're welcome

1. Microsoft has provided a setup file to download for the ease of troubleshooting under Fix it for me sub-topic : http://support.microsoft.com/kb/920730

2.

http://support.microsoft.com/kb/308417
How to manually change the size of the virtual memory paging file
You must be logged on as an administrator or as a member of the administrator’s group to complete this procedure. If your computer is connected to a network, network policy settings may prevent you from completing this procedure.

To manually change the size of virtual memory, follow these steps:

Click Start, click Run, type sysdm.cpl in the Open box, and then press ENTER.
Click the Advanced tab, and then under Performance click Settings.
Click the Advanced tab, and then under Virtual memory click Change.
Under Drive [Volume Label], click the drive that contains the paging file that you want to change.
Under Paging file size for selected drive, click Custom size, type a new paging file size in megabytes (MB) in the Initial size (MB) or Maximum size (MB) box, and then click Set.
Click OK to close the dialog box and apply changes.

Note After you change the size of the paging file, you may be prompted to restart Windows. If you are prompted to restart, the changes will not take effect until Windows is restarted.

Have a look at the link given above and take your time to read on Notes in that page for setting the best paging file size.

3. Same as no.2

4. Below is my usual canned for resetting system restore and remove all previous points.

Now Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

Go to Start > Programs > Accessories > System Tools and click "System Restore".
Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
Then go to Start > Run and type: Cleanmgr
Click "OK".
Click the "More Options" Tab.
Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

Hope that helps

Conspire

Post #9June 9, 2011, 4:27 AM UTC

Do you still need any help?

stacks

Post #10June 9, 2011, 5:46 AM UTC

Thanks very much, for your help! I've cleared lots of data on my drive. Reading a little more about your other suggestions, I think I'll play it safe for now. I don't really understand it very well and it seems resizing the pagefile might make my PC even slower if I don't do it correctly. If all it will do is to create more space, I will do the simple thing and just delete some old files. Thanks, again, for your help. Much appreciated! Stacks.

Conspire

Post #11June 9, 2011, 8:20 AM UTC

You're welcome

It's not really necessary to resize your pagefile if you think the allocated space is adequate for your usage. Deleting some old files will do as well. Do you want me to leave this open or consider this as solved?

Conspire

Post #12June 11, 2011, 3:20 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Audio Lag and Slow Start up

✨ Ask AI

Ask AI