Web page flickers

Hello everyone,

I would like to say I never had this problem happen before… when looking/searching through the internet there would be times where some web page would flicker and/or when I scroll the page downward or upward. It had only happened today; so, I am guessing there might be a virus/malware in my machine. I have been doing scans every week (Malwarebytes, Anti-virus (Kaspersky) and SuperAntiSpyware) but nothing shows up. There are no other symptoms other than described above. I hope you can help me with this.

Angel of the Moon

Here is the logs you need.

OTL logfile created on: 6/1/2011 5:57:43 PM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Owner.amarlowe\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.98 Gb Total Physical Memory | 1.29 Gb Available Physical Memory | 65.02% Memory free
3.82 Gb Paging File | 3.25 Gb Available in Paging File | 85.10% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 292.74 Gb Total Space | 266.77 Gb Free Space | 91.13% Space Free | Partition Type: NTFS
Drive D: | 5.33 Gb Total Space | 1.73 Gb Free Space | 32.45% Space Free | Partition Type: FAT32
Drive J: | 232.83 Gb Total Space | 227.65 Gb Free Space | 97.78% Space Free | Partition Type: FAT32

Computer Name: AMARLOWE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner.amarlowe\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
PRC - C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
PRC - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
PRC - C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe (Affinegy, Inc.)
PRC - C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe (Affinegy, Inc.)
PRC - C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe (Affinegy, Inc.)
PRC - C:\Program Files\OpenDNS Updater\OpenDNSUpdater.exe ()
PRC - C:\Program Files\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)
PRC - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe (Intel Corporation)
PRC - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe (Intel Corporation)
PRC - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe (Intel Corporation)
PRC - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\ELService.exe (Intel Corporation)
PRC - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe (Intel Corporation)
PRC - C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe (Intel Corporation)
PRC - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe ()
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Digital Media Reader\readericon45G.exe (Alcor Micro, Corp.)
PRC - C:\WINDOWS\arservice.exe (Microsoft)
PRC - C:\WINDOWS\mHotkey.exe ()
PRC - C:\WINDOWS\CNYHKey.exe (Chicony)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner.amarlowe\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (Secunia PSI Agent) – C:\Program Files\Secunia\PSI\PSIA.exe (Secunia)
SRV - (Kodak AiO Network Discovery Service) – C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
SRV - (AVP) – C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
SRV - (AffinegyService) – C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe (Affinegy, Inc.)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies)
SRV - (PrismXL) – C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)
SRV - (AlertService) Intel® – C:\Program Files\Intel\IntelDH\CCU\AlertService.exe (Intel Corporation)
SRV - (Remote UI Service) Intel® – C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe (Intel Corporation)
SRV - (MCLServiceATL) Intel® – C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe (Intel Corporation)
SRV - (ELService) Intel® – C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\ELService.exe (Intel Corporation)
SRV - (ISSM) Intel® – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe (Intel Corporation)
SRV - (M1 Server) Intel® Viiv™ – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe ()
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (ARSVC) – C:\WINDOWS\arservice.exe (Microsoft)


========== Driver Services (SafeList) ==========

DRV - (KeyScrambler) – C:\WINDOWS\system32\drivers\keyscrambler.sys (QFX Software Corporation)
DRV - (KLIF) – C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (PSI) – C:\WINDOWS\system32\drivers\psi_mf.sys (Secunia)
DRV - (kl2) – C:\WINDOWS\system32\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV - (KL1) – C:\WINDOWS\system32\DRIVERS\kl1.sys (Kaspersky Lab ZAO)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (klim5) – C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab ZAO)
DRV - (AFGSp50) – C:\WINDOWS\system32\drivers\AFGSp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (NPF) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (klmouflt) – C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (GoProto) – C:\WINDOWS\system32\drivers\goprot51.sys (Gteko Ltd.)
DRV - (TSHWMDTCP) – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys ()
DRV - (ELacpi) – C:\WINDOWS\system32\drivers\ELacpi.sys (Intel Corporation)
DRV - (ELmon) – C:\WINDOWS\system32\drivers\Elmon.sys (Intel Corporation)
DRV - (ELkbd) – C:\WINDOWS\system32\drivers\Elkbd.sys (Intel Corporation)
DRV - (ELmou) – C:\WINDOWS\system32\drivers\Elmou.sys (Intel Corporation)
DRV - (ELhid) – C:\WINDOWS\system32\drivers\Elhid.sys (Intel Corporation)
DRV - (HECI) Intel® – C:\WINDOWS\system32\drivers\HECI.sys (Intel Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (hcwPP2) – C:\WINDOWS\system32\drivers\hcwPP2.sys (Hauppauge Computer Works, Inc.)
DRV - (sfng32) – C:\WINDOWS\system32\drivers\sfng32.sys (Sonic Focus, Inc)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWBS2) – C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (Cdralw2k) – C:\WINDOWS\System32\drivers\cdralw2k.sys (Roxio)
DRV - (Cdr4_xp) – C:\WINDOWS\System32\drivers\cdr4_xp.sys (Roxio)
DRV - (Ser2pl) – C:\WINDOWS\system32\drivers\ser2pl.sys (Prolific Technology Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (Aspi32) – C:\WINDOWS\System32\drivers\aspi32.sys (Adaptec)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/webhp?hl=en
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A4 2D 2F D4 FE 45 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.suggest.enabled: false

FF - HKLM\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\[removed] [2011/05/31 12:26:15 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\[removed] [2011/05/31 12:26:15 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\[removed] [2011/05/31 12:26:15 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/29 09:17:32 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/04/27 09:47:29 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Extensions
[2011/06/01 16:50:27 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\9g9qu4if.default\extensions
[2011/04/27 09:54:38 | 000,000,000 | —D | M] (Ghostery) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\9g9qu4if.default\extensions\[removed]
[2011/04/29 10:05:03 | 000,000,000 | —D | M] (KeyScrambler) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\9g9qu4if.default\extensions\[removed]
[2011/05/07 09:58:00 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/05/07 09:58:00 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
File not found (No name found) –
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\{35106BCA-6C78-48C7-AC28-56DF30B51D2A}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\{455D905A-D37C-4643-A9E2-F6FEFAA0424A}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\{46551EC9-40F0-4E47-8E18-8E5CF550CFB8}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\{A0D7CCB3-214D-498B-B4AA-0E8FDA9A7BF7}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\{ADA4B710-8346-4B82-8199-5DE2B400A6AE}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\{DC572301-7619-498C-A57D-39143191B318}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\{FDD8ECF0-451A-414D-8C8F-7B7F78B0ECD3}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER.AMARLOWE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9G9QU4IF.DEFAULT\EXTENSIONS\[removed]
[2011/05/07 09:57:41 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/05/31 12:26:15 | 000,000,000 | —D | M] (Anti-Banner) – C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2011\FFEXT\[removed]
[2011/05/31 12:26:15 | 000,000,000 | —D | M] (Kaspersky URL Advisor) – C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2011\FFEXT\[removed]
[2011/05/31 12:26:15 | 000,000,000 | —D | M] (Kaspersky Virtual Keyboard) – C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2011\FFEXT\[removed]
[2011/04/29 09:17:28 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 04:00:00 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/05/10 09:46:44 | 000,508,092 | —- | M]) - C:\WINDOWS\system32\drivers\etc\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost #[IPv6]
O1 - Hosts: 127.0.0.1 fr.a2dfp.net
O1 - Hosts: 127.0.0.1 m.fr.a2dfp.net
O1 - Hosts: 127.0.0.1 ad.a8.net
O1 - Hosts: 127.0.0.1 asy.a8ww.net
O1 - Hosts: 127.0.0.1 abcstats.com
O1 - Hosts: 127.0.0.1 a.abv.bg
O1 - Hosts: 127.0.0.1 adserver.abv.bg
O1 - Hosts: 127.0.0.1 adv.abv.bg
O1 - Hosts: 127.0.0.1 bimg.abv.bg
O1 - Hosts: 127.0.0.1 ca.abv.bg
O1 - Hosts: 127.0.0.1 www2.a-counter.kiev.ua
O1 - Hosts: 127.0.0.1 track.acclaimnetwork.com
O1 - Hosts: 127.0.0.1 accuserveadsystem.com
O1 - Hosts: 127.0.0.1 www.accuserveadsystem.com
O1 - Hosts: 127.0.0.1 achmedia.com
O1 - Hosts: 127.0.0.1 aconti.net
O1 - Hosts: 127.0.0.1 secure.aconti.net
O1 - Hosts: 127.0.0.1 www.aconti.net #[Dialer.Aconti]
O1 - Hosts: 127.0.0.1 am1.activemeter.com
O1 - Hosts: 127.0.0.1 www.activemeter.com #[Tracking.Cookie]
O1 - Hosts: 127.0.0.1 ads.activepower.net
O1 - Hosts: 127.0.0.1 stat.active24stats.nl #[Tracking.Cookie]
O1 - Hosts: 127.0.0.1 ad2games.com
O1 - Hosts: 14617 more lines…
O2 - BHO: (KeyScramblerBHO Class) - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll (QFX Software Corporation)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - Reg Error: Value error. File not found
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {AEC32322-9D72-4C55-A108-33875F07BC03} - No CLSID value found.
O4 - HKLM..\Run: [AlwaysReady Power Message APP] C:\WINDOWS\arpwrmsg.exe (Microsoft)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [CHotkey] C:\WINDOWS\mHotkey.exe ()
O4 - HKLM..\Run: [Conime] C:\WINDOWS\system32\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [InstaLAN] C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe (Affinegy, Inc.)
O4 - HKLM..\Run: [IntelAudioStudio] C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe (Intel Corporation)
O4 - HKLM..\Run: [ledpointer] C:\WINDOWS\CNYHKey.exe (Chicony)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe (Alcor Micro, Corp.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [showwnd] C:\WINDOWS\ShowWnd.exe ()
O4 - HKCU..\Run: [OpenDNS Updater] C:\Program Files\OpenDNS Updater\OpenDNSUpdater.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk = C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm ()
O9 - Extra Button: &Virtual; Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra 'Tools' menuitem : &KeyScrambler; Options - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll (QFX Software Corporation)
O9 - Extra Button: URLs c&heck; - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {B3E32D88-8E7F-468F-B0E2-3A300FD4A82C} http://myitlab.pearsoned.com/Pegasus/Modul…ces/ax/stub.cab (Enlite 2.x Simulation Engine Installer)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} Reg Error: Key error. (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\kloehk.dll (Kaspersky Lab ZAO)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab ZAO)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/06/17 05:41:16 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2006/08/08 09:59:46 | 000,000,000 | —D | M] - J:\autorun – [ FAT32 ]
O33 - MountPoints2\{107cfd9c-d702-11df-93f2-001676dfe735}\Shell\AutoRun\command - "" = K:\start_presentation.bat
O33 - MountPoints2\{12093205-a542-11dd-8eb1-001676dfe735}\Shell - "" = AutoRun
O33 - MountPoints2\{12093205-a542-11dd-8eb1-001676dfe735}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{12093205-a542-11dd-8eb1-001676dfe735}\Shell\AutoRun\command - "" = L:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.clmp3enc - C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM File not found
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2011/06/01 17:55:08 | 000,580,096 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner.amarlowe\Desktop\OTL.exe
[2011/06/01 17:10:17 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Owner.amarlowe\Recent
[2011/05/29 23:16:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Application Data\Foxit Software
[2011/05/29 23:16:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Foxit Reader
[2011/05/29 23:15:37 | 000,000,000 | —D | C] – C:\Program Files\Foxit Software
[2011/05/28 20:38:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\My Documents\Downloads
[2011/05/26 18:50:50 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2011/05/26 18:50:50 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2011/05/16 20:00:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Application Data\SUPERAntiSpyware.com
[2011/05/16 20:00:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2011/05/16 20:00:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
[2011/05/16 20:00:35 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2011/05/15 22:42:47 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\Secunia PSI
[2011/05/15 22:42:37 | 000,000,000 | —D | C] – C:\Program Files\Secunia
[2011/05/15 12:26:06 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/05/12 17:08:30 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Auslogics
[2011/05/12 17:08:29 | 000,000,000 | —D | C] – C:\Program Files\Auslogics
[2011/05/07 09:58:11 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2011/05/07 09:57:58 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2011/05/07 09:57:58 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2011/05/07 09:57:58 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2011/05/07 09:57:58 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2011/05/07 09:57:35 | 000,000,000 | —D | C] – C:\Program Files\Java

========== Files - Modified Within 30 Days ==========

[2011/06/01 17:55:08 | 000,580,096 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner.amarlowe\Desktop\OTL.exe
[2011/06/01 09:30:31 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/06/01 09:29:21 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/01 09:29:20 | 2128,416,768 | -HS- | M] () – C:\hiberfil.sys
[2011/06/01 08:53:55 | 000,000,392 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{406DD865-D8AB-4400-9774-7CDE1C72CD42}.job
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/27 21:49:26 | 000,006,091 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\.recently-used.xbel
[2011/05/23 17:29:34 | 000,115,369 | —- | M] () – C:\WINDOWS\System32\drivers\klin.dat
[2011/05/15 22:42:39 | 000,000,753 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2011/05/15 12:26:19 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/05/11 14:03:45 | 000,006,984 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\Application Data\wklnhst.dat
[2011/05/07 09:57:40 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2011/05/07 09:57:40 | 000,157,472 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2011/05/07 09:57:40 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2011/05/07 09:57:40 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2011/05/07 09:57:40 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl

========== Files Created - No Company Name ==========

[2011/05/27 21:49:26 | 000,006,091 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\.recently-used.xbel
[2011/05/15 22:42:39 | 000,000,753 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2011/05/15 22:42:39 | 000,000,716 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Secunia PSI.lnk
[2011/01/07 13:28:47 | 000,683,801 | —- | C] () – C:\WINDOWS\unins000.exe
[2011/01/07 13:28:47 | 000,001,068 | —- | C] () – C:\WINDOWS\unins000.dat
[2010/12/25 23:10:31 | 000,000,000 | —- | C] () – C:\WINDOWS\Game.INI
[2010/10/16 21:39:29 | 000,115,369 | —- | C] () – C:\WINDOWS\System32\drivers\klin.dat
[2010/10/16 21:39:29 | 000,097,859 | —- | C] () – C:\WINDOWS\System32\drivers\klick.dat
[2010/09/17 12:15:18 | 000,093,408 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2010/07/20 14:17:17 | 000,057,395 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2010/03/27 13:44:28 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CmdLineExt03.dll
[2010/01/30 15:44:02 | 000,000,088 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\76449CB090.sys
[2010/01/30 15:44:01 | 000,002,516 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2009/12/10 16:26:38 | 000,041,047 | —- | C] () – C:\WINDOWS\System32\ActPanel.dll
[2009/09/24 09:29:26 | 000,000,066 | —- | C] () – C:\WINDOWS\wininit.ini
[2009/09/09 19:01:40 | 000,027,675 | —- | C] () – C:\WINDOWS\System32\drivers\klopp.dat
[2009/05/29 18:47:13 | 000,000,130 | —- | C] () – C:\WINDOWS\cfplogvw.INI
[2009/05/01 00:31:06 | 001,466,368 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2009/03/20 21:13:08 | 000,168,208 | —- | C] () – C:\WINDOWS\System32\guard32(2)(2).dll
[2009/03/20 21:12:36 | 000,000,120 | —- | C] () – C:\WINDOWS\CIS_Setup_3.5.57173.439_XP_Vista_x32.INI
[2008/12/19 15:18:26 | 000,002,560 | —- | C] () – C:\WINDOWS\_MSRSTRT.EXE
[2008/12/19 15:11:52 | 000,000,000 | —- | C] () – C:\WINDOWS\WB.ini
[2008/08/11 11:14:38 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2008/01/04 22:47:51 | 000,000,038 | —- | C] () – C:\WINDOWS\3D Text Factory.INI
[2007/12/02 18:09:59 | 000,000,031 | -H– | C] () – C:\WINDOWS\uccspecc.sys
[2007/11/04 22:02:47 | 000,000,019 | —- | C] () – C:\WINDOWS\addrem.ini
[2007/09/29 20:14:00 | 000,006,984 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\Application Data\wklnhst.dat
[2007/07/13 23:21:51 | 000,000,716 | —- | C] () – C:\WINDOWS\eReg.dat
[2007/06/09 19:24:00 | 000,000,126 | —- | C] () – C:\WINDOWS\srxAdmin.INI
[2007/06/07 17:24:41 | 000,002,560 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\Application Data\Default.cls
[2007/06/07 17:20:19 | 000,002,560 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\Application Data\AceFTP Storage.ftp
[2007/06/07 17:18:56 | 000,014,336 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\Application Data\Settings.cfg
[2007/05/26 20:56:57 | 000,084,480 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/05/26 19:01:56 | 000,023,552 | —- | C] () – C:\WINDOWS\System32\jesterss.dll
[2007/05/26 19:00:02 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\Elusetup.exe
[2007/05/26 18:56:17 | 000,001,756 | —- | C] () – C:\WINDOWS\nsreg.dat
[2007/05/26 18:55:58 | 000,000,004 | —- | C] () – C:\WINDOWS\Pix11.dat
[2007/05/26 18:52:08 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/05/26 18:50:20 | 000,550,912 | —- | C] () – C:\WINDOWS\mHotkey.exe
[2007/05/26 18:50:20 | 000,532,544 | —- | C] () – C:\WINDOWS\PIC.dll
[2007/05/26 18:50:20 | 000,049,152 | —- | C] () – C:\WINDOWS\CNYUSB.dll
[2007/05/26 18:50:20 | 000,036,864 | —- | C] () – C:\WINDOWS\ShowWnd.exe
[2007/05/26 18:50:20 | 000,024,576 | —- | C] () – C:\WINDOWS\HKNTDLL.dll
[2007/05/26 18:50:20 | 000,011,776 | —- | C] () – C:\WINDOWS\HIDMNT.dll
[2007/05/26 18:50:20 | 000,005,120 | —- | C] () – C:\WINDOWS\HKCYDLL.dll
[2007/05/26 18:50:20 | 000,000,360 | —- | C] () – C:\WINDOWS\CNYHKey.ini
[2007/05/26 18:37:04 | 000,000,060 | —- | C] () – C:\WINDOWS\System32\SYSDRV.DAT
[2007/05/26 18:31:26 | 001,339,392 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2007/05/26 18:31:22 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2007/05/26 18:22:39 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\hcwXDS.dll
[2007/05/26 17:50:03 | 000,000,137 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\fusioncache.dat
[2007/05/26 16:34:35 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2007/05/26 16:26:05 | 000,000,498 | —- | C] () – C:\WINDOWS\lexstat.ini
[2007/03/05 14:34:28 | 000,676,224 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2006/06/21 05:48:15 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/06/21 05:12:42 | 000,352,256 | —- | C] () – C:\WINDOWS\System32\HotlineClient.exe
[2006/06/17 05:44:22 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2006/06/17 05:37:18 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2006/06/17 05:24:58 | 000,001,280 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2006/06/17 05:24:57 | 000,000,522 | —- | C] () – C:\WINDOWS\System32\emver.ini
[2006/06/17 05:23:25 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2006/06/17 05:23:22 | 000,468,584 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2006/06/17 05:23:22 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2006/06/17 05:23:22 | 000,082,516 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2006/06/17 05:23:22 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2006/06/17 05:23:20 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2006/06/17 05:23:20 | 000,005,151 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2006/06/17 05:23:20 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2006/06/17 05:23:19 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2006/06/17 05:23:19 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2006/06/17 05:23:16 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2006/06/17 05:23:08 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2006/06/16 22:31:45 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2006/06/16 22:30:47 | 000,892,664 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2006/01/04 21:28:00 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/01/04 21:28:00 | 001,519,616 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2006/01/04 21:28:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/01/04 21:28:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/01/04 21:28:00 | 000,442,368 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2005/10/14 16:04:44 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2005/08/06 00:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/08/02 19:19:16 | 000,050,176 | —- | C] () – C:\WINDOWS\armcex.dll
[1996/02/23 17:34:48 | 000,014,629 | —- | C] () – C:\WINDOWS\System32\Declw.dll
[1996/02/22 15:09:20 | 000,032,256 | —- | C] () – C:\WINDOWS\System32\Decln.dll

========== LOP Check ==========

[2010/03/06 21:55:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\abelhadigital.com
[2009/05/21 21:15:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2009/03/19 16:35:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore(2)
[2010/09/23 17:40:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Affinegy
[2010/07/20 14:22:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Belkin
[2009/01/01 20:20:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund Software
[2007/06/06 20:36:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GlobalSCAPE
[2008/08/11 11:14:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MailFrontier
[2010/12/28 14:32:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2011/01/07 13:32:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\myitlab
[2009/11/13 19:21:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PlayFirst
[2011/04/29 10:05:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\QFX Software
[2011/06/01 08:53:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2007/06/09 19:14:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Titan
[2010/03/06 21:55:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\abelhadigital.com
[2009/03/20 17:41:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\acccore(2)
[2011/01/29 14:50:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Auslogics
[2007/06/07 17:18:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Dynamic
[2008/08/21 22:43:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Fingerfox (SE)
[2011/05/29 23:16:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Foxit Software
[2011/05/26 14:28:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\gtk-2.0
[2010/10/26 14:52:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\ICAClient
[2008/10/12 21:42:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Leadertech
[2009/09/22 10:27:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\MiniDm
[2009/05/31 10:29:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\OfficeUpdate12
[2010/07/15 07:54:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\OpenDNS Updater
[2009/11/13 19:21:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\PlayFirst
[2008/08/21 20:46:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Popular Sites
[2011/04/29 10:05:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\QFX Software
[2010/12/05 22:38:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\SampleView
[2009/06/22 14:13:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Sony
[2011/03/29 11:13:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Temp
[2007/09/29 20:14:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Template
[2011/06/01 08:53:55 | 000,000,392 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{406DD865-D8AB-4400-9774-7CDE1C72CD42}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2007/05/26 18:49:51 | 000,000,002 | —- | M] () – C:\AUDIT_INSTALL_IN_PROGRESS
[2006/06/17 05:41:16 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2007/05/26 16:19:33 | 000,000,209 | —- | M] () – C:\Boot.bak
[2009/06/08 05:19:06 | 000,000,279 | RHS- | M] () – C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | —- | M] () – C:\cmldr
[2006/06/17 05:41:16 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2011/06/01 09:29:20 | 2128,416,768 | -HS- | M] () – C:\hiberfil.sys
[2006/06/17 05:41:16 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/10/14 07:22:09 | 000,002,616 | -H– | M] () – C:\IPH.PH
[2006/06/17 05:41:16 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/10 15:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/05/09 22:33:38 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/06/01 09:29:19 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2007/05/26 19:08:21 | 000,000,000 | —- | M] () – C:\REQUEST_OEMRESET_ENDUSER
[2007/05/26 18:42:23 | 000,000,002 | RHS- | M] () – C:\USER
[2007/11/07 09:09:22 | 001,442,522 | —- | M] () – C:\VC_RED.cab

< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/06/17 05:40:30 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2011/03/03 07:45:06 | 000,196,608 | —- | M] (Eastman Kodak Company) – C:\WINDOWS\system32\spool\prtprocs\w32x86\EKIJ5000PPR.dll
[2008/07/06 08:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2008/07/06 06:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2006/10/31 22:32:30 | 001,559,056 | —- | M] (XMLAuthor Inc.) – C:\WINDOWS\screengenie.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/06/16 22:30:11 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2006/06/16 22:30:11 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2006/06/16 22:30:11 | 000,897,024 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/05/09 22:37:34 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/05/26 16:19:57 | 000,000,170 | -HS- | M] () – C:\Documents and Settings\Owner.amarlowe\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2006/06/17 05:46:25 | 000,000,079 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/10/26 20:08:08 | 000,421,888 | —- | M] (e-academy Inc.) – C:\Documents and Settings\Owner.amarlowe\Desktop\Microsoft_Office_Enterprise_2007_Suite.exe
[2011/06/01 17:55:08 | 000,580,096 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner.amarlowe\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-11 13:13:35

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >


OTL Extras logfile created on: 6/1/2011 5:57:43 PM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Owner.amarlowe\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.98 Gb Total Physical Memory | 1.29 Gb Available Physical Memory | 65.02% Memory free
3.82 Gb Paging File | 3.25 Gb Available in Paging File | 85.10% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 292.74 Gb Total Space | 266.77 Gb Free Space | 91.13% Space Free | Partition Type: NTFS
Drive D: | 5.33 Gb Total Space | 1.73 Gb Free Space | 32.45% Space Free | Partition Type: FAT32
Drive J: | 232.83 Gb Total Space | 227.65 Gb Free Space | 97.78% Space Free | Partition Type: FAT32

Computer Name: AMARLOWE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] – Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
http [open] – Reg Error: Value error.
https [open] – Reg Error: Value error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"5353:UDP" = 5353:UDP:*:Enabled:Bonjour Port 5353
"9322:TCP" = 9322:TCP:*:Enabled:EKDiscovery

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe" = C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe:LocalSubNet:Enabled:Belkin Setup – (Affinegy, Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (AOL LLC)
"C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe" = C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe:LocalSubNet:Enabled:Belkin Setup – (Affinegy, Inc.)
"C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe" = C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe:*:Enabled:Kodak.AiO.HomeCenter – (Eastman Kodak Company)
"C:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe" = C:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe:*:Enabled:Kodak.AiO.Statistics – (Eastman Kodak Company)
"C:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe" = C:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe:*:Enabled:Kodak.AiO.SetupUtility – (Eastman Kodak Company)
"C:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe" = C:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe:*:Enabled:Kodak.AiO.FwUpdater – (Eastman Kodak Company)
"C:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe" = C:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe:*:Enabled:Kodak.AiO.Installer – (Eastman Kodak Company)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0645A454-AD44-4F0D-99CF-6B762735AD1F}" = aioprnt
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{10934A28-0CC6-4B98-A14F-76B3546003AF}" = ksDIP
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java™ 6 Update 25
"{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{48B41C3A-9A92-4B81-B653-C97FEB85C910}" = C4USelfUpdater
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56BA241F-580C-43D2-8403-947241AAE633}" = center
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Internet Security 2011
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6ED53E0C-EAC0-4F0F-947D-6BA817E4C8C3}" = HostsMan 3.2.73
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISER_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D210D79-AEC5-453B-960C-4DD2C73931E1}" = Bonjour Print Services
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{B124E6D3-91B4-4E3C-AD03-BA959B223537}" = Citrix online plug-in (Web)
"{B7DE81A4-71D5-4F22-9D72-84AC8A266F43}" = Sony Vegas Movie Studio 6.0b
"{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials
"{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK AiO Software
"{EBD9A954-6C1A-4E9F-A098-C98653035381}" = PrintMaster Platinum 18
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{FE24086F-3B0C-4C47-A874-97A7B8E2FBBE}" = aioscnnr
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Belkin Setup and Router Monitor_is1" = Belkin Setup and Router Monitor
"CCleaner" = CCleaner
"Diner Dash 2" = Diner Dash 2
"ENTERPRISER" = Microsoft Office Enterprise 2007
"ERUNT_is1" = ERUNT 1.1j
"Foxit Reader" = Foxit Reader
"ie8" = Windows Internet Explorer 8
"InstallWIX_{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Internet Security 2011
"KeyScrambler" = KeyScrambler
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.0.1200
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MozBackup" = MozBackup 1.5.1
"Mozilla Firefox 4.0.1 (x86 en-US)" = Mozilla Firefox 4.0.1 (x86 en-US)
"MyITLab ActiveX Installer_is1" = MyITLab ActiveX Installer 2, 9, 8, 65535
"Nancy Drew Message in a Haunted Mansion" = Nancy Drew Message in a Haunted Mansion
"OpenDNS Updater" = OpenDNS Updater 2.2.1
"Revo Uninstaller" = Revo Uninstaller 1.92
"Secunia PSI" = Secunia PSI (2.0.0.3003)
"SpywareBlaster_is1" = SpywareBlaster 4.4
"VLC media player" = VLC media player 1.1.9
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.11

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/1/2011 1:32:44 PM | Computer Name = AMARLOWE | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 930687

Error - 6/1/2011 5:10:42 PM | Computer Name = AMARLOWE | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 6/1/2011 5:10:42 PM | Computer Name = AMARLOWE | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1953

Error - 6/1/2011 5:10:42 PM | Computer Name = AMARLOWE | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1953

Error - 6/1/2011 5:10:44 PM | Computer Name = AMARLOWE | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 6/1/2011 5:10:44 PM | Computer Name = AMARLOWE | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 3937

Error - 6/1/2011 5:10:44 PM | Computer Name = AMARLOWE | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 3937

Error - 6/1/2011 5:44:43 PM | Computer Name = AMARLOWE | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 6/1/2011 5:44:49 PM | Computer Name = AMARLOWE | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2042672

Error - 6/1/2011 5:44:49 PM | Computer Name = AMARLOWE | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2042672

[ IntelDH Events ]
Error - 3/15/2011 9:31:29 AM | Computer Name = AMARLOWE | Source = TrayIcon | ID = 15
Description = A CCU internal function detected an error: CCU_TrayIcon::Could not
create ICCUEngine interface pointer

Error - 3/15/2011 4:38:52 PM | Computer Name = AMARLOWE | Source = CCU_Engine | ID = 15
Description = A CCU internal function detected an error: CCUEngine failed to hook
to the DataManager (data store updates)

Error - 3/15/2011 4:38:52 PM | Computer Name = AMARLOWE | Source = TrayIcon | ID = 15
Description = A CCU internal function detected an error: CCU_TrayIcon::Could not
create ICCUEngine interface pointer

Error - 3/16/2011 8:14:53 AM | Computer Name = AMARLOWE | Source = CCU_Engine | ID = 15
Description = A CCU internal function detected an error: CCUEngine failed to hook
to the DataManager (data store updates)

Error - 3/16/2011 8:14:53 AM | Computer Name = AMARLOWE | Source = TrayIcon | ID = 15
Description = A CCU internal function detected an error: CCU_TrayIcon::Could not
create ICCUEngine interface pointer

Error - 3/16/2011 5:42:54 PM | Computer Name = AMARLOWE | Source = CCU_Engine | ID = 15
Description = A CCU internal function detected an error: CCUEngine failed to hook
to the DataManager (data store updates)

Error - 3/16/2011 5:42:54 PM | Computer Name = AMARLOWE | Source = TrayIcon | ID = 15
Description = A CCU internal function detected an error: CCU_TrayIcon::Could not
create ICCUEngine interface pointer

Error - 3/17/2011 9:12:17 AM | Computer Name = AMARLOWE | Source = CCU_Engine | ID = 15
Description = A CCU internal function detected an error: CCUEngine failed to hook
to the DataManager (data store updates)

Error - 3/17/2011 9:12:17 AM | Computer Name = AMARLOWE | Source = TrayIcon | ID = 15
Description = A CCU internal function detected an error: CCU_TrayIcon::Could not
create ICCUEngine interface pointer

Error - 3/18/2011 9:18:30 AM | Computer Name = AMARLOWE | Source = TrayIcon | ID = 15
Description = A CCU internal function detected an error: IsLimitedUser call failed

[ System Events ]
Error - 5/30/2011 10:23:09 AM | Computer Name = AMARLOWE | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 5/30/2011 10:23:09 AM | Computer Name = AMARLOWE | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 5/30/2011 10:23:10 AM | Computer Name = AMARLOWE | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 5/30/2011 10:23:10 AM | Computer Name = AMARLOWE | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 6/1/2011 8:50:34 AM | Computer Name = AMARLOWE | Source = Service Control Manager | ID = 7022
Description = The Intel® Quick Resume technology service hung on starting.

Error - 6/1/2011 10:53:55 AM | Computer Name = AMARLOWE | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 6/1/2011 10:53:55 AM | Computer Name = AMARLOWE | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 6/1/2011 10:53:55 AM | Computer Name = AMARLOWE | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 6/1/2011 10:53:55 AM | Computer Name = AMARLOWE | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 6/1/2011 1:32:45 PM | Computer Name = AMARLOWE | Source = Dhcp | ID = 1001
Description = Your computer was not assigned an address from the network (by the
DHCP Server) for the Network Card with network address 001676DFE735. The following
error occurred: %%1223. Your computer will continue to try and obtain an address
on its own from the network address (DHCP) server.


< End of report >

Thank you very much TomK…it's probably is nothing like you said; but, I want to make sure. Everything went fine; however, when Comobofix was creating the log My antivirus/internet security (Kaspersky Internet Security) database became corrupted. I tried to fix it clicking fix it now button in KIS; but didn't help and is disabled. What do we do next.

Here is the log


ComboFix 11-06-03.02 - Owner 06/03/2011 11:54:23.10.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2030.1395 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\OWNER~1.AMA\LOCALS~1\Temp\1.tmp\F_IN_BOX.dll
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\IUSR_NMPR\WINDOWS
c:\documents and settings\Owner.amarlowe\Application Data\MiniDm
c:\documents and settings\Owner.amarlowe\Application Data\MiniDm\conf.ini
c:\documents and settings\Owner.amarlowe\Local Settings\Temp\1.tmp\F_IN_BOX.dll
c:\documents and settings\Owner.amarlowe\System
c:\documents and settings\Owner.amarlowe\System\win_qs8.jqx
c:\documents and settings\Owner.amarlowe\WINDOWS
c:\documents and settings\TEMP\WINDOWS
c:\program files\WinPCap
c:\program files\WinPCap\daemon_mgm.exe
c:\program files\WinPCap\npf_mgm.exe
c:\program files\WinPCap\rpcapd.exe
c:\windows\system32\drivers\etc\lmhosts
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
c:\windows\Update.bat
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_NPF
——-\Service_NPF
.
.
((((((((((((((((((((((((( Files Created from 2011-05-03 to 2011-06-03 )))))))))))))))))))))))))))))))
.
.
2011-05-30 03:16 . 2011-05-30 03:16 ——– d—–w- c:\documents and settings\Owner.amarlowe\Application Data\Foxit Software
2011-05-30 03:15 . 2011-05-30 03:15 ——– d—–w- c:\program files\Foxit Software
2011-05-26 22:50 . 2011-05-26 22:50 ——– d—–w- c:\program files\CCleaner
2011-05-17 00:00 . 2011-05-17 00:00 ——– d—–w- c:\documents and settings\Owner.amarlowe\Application Data\SUPERAntiSpyware.com
2011-05-17 00:00 . 2011-05-17 00:00 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-05-17 00:00 . 2011-05-24 13:47 ——– d—–w- c:\program files\SUPERAntiSpyware
2011-05-16 02:42 . 2011-05-16 02:42 ——– d—–w- c:\documents and settings\Owner.amarlowe\Local Settings\Application Data\Secunia PSI
2011-05-16 02:42 . 2011-05-16 02:42 ——– d—–w- c:\program files\Secunia
2011-05-15 16:26 . 2011-05-15 16:26 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-12 21:08 . 2011-05-12 21:08 ——– d—–w- c:\program files\Auslogics
2011-05-07 13:58 . 2011-05-07 13:58 ——– d—–w- c:\program files\Common Files\Java
2011-05-07 13:57 . 2011-05-07 13:57 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-05-07 13:57 . 2011-05-07 13:57 ——– d—–w- c:\program files\Java
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-29 13:11 . 2009-03-28 21:04 39984 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 13:11 . 2009-03-28 21:04 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-05-07 13:57 . 2010-04-23 23:39 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-04-24 22:14 . 2011-04-29 14:04 225856 —-a-w- c:\windows\system32\drivers\keyscrambler.sys
2011-03-07 05:33 . 2006-06-17 09:38 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-04-29 13:17 . 2011-04-27 13:47 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OpenDNS Updater"="c:\program files\OpenDNS Updater\OpenDNSUpdater.exe" [2010-06-16 839680]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="mHotkey.exe" [2004-12-09 550912]
"ledpointer"="CNYHKey.exe" [2004-03-03 5576704]
"showwnd"="showwnd.exe" [2003-09-19 36864]
"readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-10 139264]
"IntelAudioStudio"="c:\program files\Intel Audio Studio\IntelAudioStudio.exe" [2006-07-13 9134080]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 77312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-05 7393280]
"InstaLAN"="c:\program files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2010-07-28 1485208]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-11-10 365336]
"ConnectionCenter"="c:\program files\Citrix\ICA Client\concentr.exe" [2010-05-12 300472]
"Conime"="c:\windows\system32\conime.exe" [2008-04-14 27648]
"EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2011-03-03 2510848]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KeyScrambler"="c:\program files\KeyScrambler\getting_started.html" [X]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2011-4-19 291896]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"=
"c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:UDP"= 5353:UDP:Bonjour Port 5353
"9322:TCP"= 9322:TCP:EKDiscovery
.
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [6/9/2010 5:43 PM 11352]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\EKAiOHostService.exe [3/9/2011 1:29 PM 366000]
R2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\psia.exe [4/19/2011 2:44 AM 993848]
R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [4/29/2011 10:04 AM 225856]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [5/7/2010 12:06 PM 32856]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [11/2/2009 8:27 PM 19472]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [9/1/2010 4:30 AM 15544]
S3 cpuz130;cpuz130;\??\c:\docume~1\OWNER~1.AMA\LOCALS~1\Temp\cpuz130\cpuz_x32.sys –> c:\docume~1\OWNER~1.AMA\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 rkhdrv40;Rootkit Unhooker Driver; [x]
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-03 c:\windows\Tasks\User_Feed_Synchronization-{406DD865-D8AB-4400-9774-7CDE1C72CD42}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/webhp?hl=en
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{BB122B61-EA9A-4AD1-994F-C5627F64764E}: NameServer = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\documents and settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\9g9qu4if.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-03 12:10
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-534591739-3740957444-4262820010-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{61A3D62A-E669-8B2B-95B7C505631D6590}\{1D71893B-0DD3-8FF9-31AA9E7B284EB027}\{CF9E2073-5E5A-1B13-96346A906352FBBE}*]
"S6KI1YERXJTIP3T5RVDI41UR2G1"=hex:01,00,01,00,00,00,00,00,26,ff,b1,c2,08,0b,50,
9e,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{62E758C6-EE56-67AB-7A3E2F088A108BC4}\{3E530B8E-E7D7-91CB-07329483978E2FFC}\{65FEF1D9-850D-2011-E21A2EE487AC8842}*]
"S6KI1YERXJTIP3T5RVDI41UR2G1"=hex:01,00,01,00,00,00,00,00,26,ff,b1,c2,08,0b,50,
9e,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7CACDF5A-0E2D-A998-38B4B1D490EAE887}\{83892839-8EE2-C547-3E6DBF0265E34072}\{B9A8F094-A05A-7BFC-2DD781993331EE07}*]
"S6KI1YERXJTIP3T5RVDI41UR2G1"=hex:01,00,01,00,00,00,00,00,26,ff,b1,c2,08,0b,50,
9e,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(880)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(568)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Belkin\Router Setup and Monitor\BelkinService.exe
c:\program files\Intel\IntelDH\CCU\AlertService.exe
c:\windows\arservice.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\mHotkey.exe
c:\windows\CNYHKey.exe
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\windows\ARPWRMSG.EXE
c:\program files\Belkin\Router Setup and Monitor\BelkinSetup.exe
c:\program files\Citrix\ICA Client\wfcrun32.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe
c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
c:\program files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\rsvp.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-06-03 12:15:27 - machine was rebooted
ComboFix-quarantined-files.txt 2011-06-03 16:15
.
Pre-Run: 286,187,188,224 bytes free
Post-Run: 286,141,284,352 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
.
- - End Of File - - CCA4D0937B65C430A61CDBD7B8FA48E7

Thank you

It work this time…here is the log, I would patiently wait for further instructions.

Angel of the Moon

ComboFix 11-06-03.04 - Owner 06/03/2011 14:14:51.12.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2030.1420 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
c:\docume~1\OWNER~1.AMA\LOCALS~1\Temp\1.tmp\F_IN_BOX.dll
c:\documents and settings\Owner.amarlowe\Local Settings\Temp\1.tmp\F_IN_BOX.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-05-03 to 2011-06-03 )))))))))))))))))))))))))))))))
.
.
2011-05-30 03:16 . 2011-05-30 03:16 ——– d—–w- c:\documents and settings\Owner.amarlowe\Application Data\Foxit Software
2011-05-30 03:15 . 2011-05-30 03:15 ——– d—–w- c:\program files\Foxit Software
2011-05-26 22:50 . 2011-05-26 22:50 ——– d—–w- c:\program files\CCleaner
2011-05-17 00:00 . 2011-05-17 00:00 ——– d—–w- c:\documents and settings\Owner.amarlowe\Application Data\SUPERAntiSpyware.com
2011-05-17 00:00 . 2011-05-17 00:00 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-05-17 00:00 . 2011-05-24 13:47 ——– d—–w- c:\program files\SUPERAntiSpyware
2011-05-16 02:42 . 2011-05-16 02:42 ——– d—–w- c:\documents and settings\Owner.amarlowe\Local Settings\Application Data\Secunia PSI
2011-05-16 02:42 . 2011-05-16 02:42 ——– d—–w- c:\program files\Secunia
2011-05-15 16:26 . 2011-05-15 16:26 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-12 21:08 . 2011-05-12 21:08 ——– d—–w- c:\program files\Auslogics
2011-05-07 13:58 . 2011-05-07 13:58 ——– d—–w- c:\program files\Common Files\Java
2011-05-07 13:57 . 2011-05-07 13:57 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-05-07 13:57 . 2011-05-07 13:57 ——– d—–w- c:\program files\Java
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-29 13:11 . 2009-03-28 21:04 39984 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 13:11 . 2009-03-28 21:04 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-05-07 13:57 . 2010-04-23 23:39 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-04-24 22:14 . 2011-04-29 14:04 225856 —-a-w- c:\windows\system32\drivers\keyscrambler.sys
2011-03-07 05:33 . 2006-06-17 09:38 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-04-29 13:17 . 2011-04-27 13:47 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OpenDNS Updater"="c:\program files\OpenDNS Updater\OpenDNSUpdater.exe" [2010-06-16 839680]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="mHotkey.exe" [2004-12-09 550912]
"ledpointer"="CNYHKey.exe" [2004-03-03 5576704]
"showwnd"="showwnd.exe" [2003-09-19 36864]
"readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-10 139264]
"IntelAudioStudio"="c:\program files\Intel Audio Studio\IntelAudioStudio.exe" [2006-07-13 9134080]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 77312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-05 7393280]
"InstaLAN"="c:\program files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2010-07-28 1485208]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-11-10 365336]
"ConnectionCenter"="c:\program files\Citrix\ICA Client\concentr.exe" [2010-05-12 300472]
"Conime"="c:\windows\system32\conime.exe" [2008-04-14 27648]
"EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2011-03-03 2510848]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KeyScrambler"="c:\program files\KeyScrambler\getting_started.html" [X]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2011-4-19 291896]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"=
"c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:UDP"= 5353:UDP:Bonjour Port 5353
"9322:TCP"= 9322:TCP:EKDiscovery
.
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [6/9/2010 5:43 PM 11352]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\EKAiOHostService.exe [3/9/2011 1:29 PM 366000]
R2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\psia.exe [4/19/2011 2:44 AM 993848]
R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [4/29/2011 10:04 AM 225856]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [5/7/2010 12:06 PM 32856]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [11/2/2009 8:27 PM 19472]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [9/1/2010 4:30 AM 15544]
S3 cpuz130;cpuz130;\??\c:\docume~1\OWNER~1.AMA\LOCALS~1\Temp\cpuz130\cpuz_x32.sys –> c:\docume~1\OWNER~1.AMA\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 rkhdrv40;Rootkit Unhooker Driver; [x]
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-03 c:\windows\Tasks\User_Feed_Synchronization-{406DD865-D8AB-4400-9774-7CDE1C72CD42}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/webhp?hl=en
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{BB122B61-EA9A-4AD1-994F-C5627F64764E}: NameServer = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\documents and settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\9g9qu4if.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-03 14:24
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-534591739-3740957444-4262820010-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(880)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(1812)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Belkin\Router Setup and Monitor\BelkinService.exe
c:\program files\Intel\IntelDH\CCU\AlertService.exe
c:\windows\arservice.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\windows\mHotkey.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\CNYHKey.exe
c:\windows\ARPWRMSG.EXE
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\program files\Belkin\Router Setup and Monitor\BelkinSetup.exe
c:\program files\Citrix\ICA Client\wfcrun32.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe
c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
c:\program files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\rsvp.exe
.
**************************************************************************
.
Completion time: 2011-06-03 14:29:11 - machine was rebooted
ComboFix-quarantined-files.txt 2011-06-03 18:29
ComboFix2.txt 2011-06-03 16:15
.
Pre-Run: 286,069,026,816 bytes free
Post-Run: 286,048,030,720 bytes free
.
- - End Of File - - 10EFF0DB5DEE14B91E3F62C038C72C4D