searchqu

Hello What The Tech!

Thank you for being out there helping!

I have ended up with the this searchqu.com as my default search engine with the download of Bandoo wich must have been within ILivid which I dowloaded. I did a system restore and now neither Bandoo or ILivid apear on my PC. I'm running Windown Vista. I read this post: hxxp://www.searchqu.com/406 and followed the 1st instructions. Can you please help?

here are the OTL reports:


OTL logfile created on: 2011-06-11 06:51:11 - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Mafalda\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000C0C | Country: Canada | Language: FRC | Date Format: yyyy-MM-dd

1013,31 Mb Total Physical Memory | 204,72 Mb Available Physical Memory | 20,20% Memory free
2,24 Gb Paging File | 0,87 Gb Available in Paging File | 38,67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 142,15 Gb Total Space | 46,90 Gb Free Space | 32,99% Space Free | Partition Type: NTFS
Drive D: | 6,89 Gb Total Space | 0,75 Gb Free Space | 10,94% Space Free | Partition Type: NTFS

Computer Name: MAFALDA-PC | User Name: Mafalda | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Mafalda\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Mafalda\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe (AnchorFree Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\vsnp2uvc.exe (Sonix)
PRC - C:\Program Files\Hp\QuickPlay\Kernel\TV\CLCapSvc.exe ()


========== Modules (SafeList) ==========

MOD - C:\Users\Mafalda\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)


========== Win32 Services (SafeList) ==========

SRV - (avg9emc) – C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (HssTrayService) – C:\Program Files\Hotspot Shield\bin\HssTrayService.exe ()
SRV - (HotspotShieldService) – C:\Program Files\Hotspot Shield\bin\openvpnas.exe ()
SRV - (HssSrv) – C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe (AnchorFree Inc.)
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Roxio UPnP Renderer 9) – C:\Program Files\Roxio\Roxio MyDVD Basic v9\Digital Home 9\RoxioUPnPRenderer9.exe (Sonic Solutions)
SRV - (Roxio Upnp Server 9) – C:\Program Files\Roxio\Roxio MyDVD Basic v9\Digital Home 9\RoxioUpnpService9.exe (Sonic Solutions)
SRV - (CLSched) CyberLink Task Scheduler (CTS) – C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe ()
SRV - (CLCapSvc) CyberLink Background Capture Service (CBCS) – C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe ()
SRV - (Com4Qlb) – C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe (Hewlett-Packard Development Company, L.P.)


========== Driver Services (SafeList) ==========

DRV - (AvgTdiX) – C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Netaapl) – C:\Windows\System32\drivers\netaapl.sys (Apple Inc.)
DRV - (HssDrv) – C:\Windows\System32\drivers\hssdrv.sys (AnchorFree Inc.)
DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) – C:\Windows\System32\drivers\snp2uvc.sys ()
DRV - (tapvpn) – C:\Windows\System32\drivers\tapvpn.sys (The OpenVPN Project)
DRV - (ssmdrv) – C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (HdAudAddService) – C:\Windows\System32\drivers\CHDART.sys (Conexant Systems Inc.)
DRV - (NETw3v32) Intel® – C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (eabfiltr) – C:\Windows\System32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (HBtnKey) – C:\Windows\System32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local



O1 HOSTS File: ([2009-03-28 22:08:11 | 000,304,607 | R— | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 127.0.0.1 www.163ns.com
O1 - Hosts: 10494 more lines…
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe (Sonix)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [keyman.exe] File not found
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\Mafalda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Mafalda\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Mafalda\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Mafalda\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008-03-07 23:37:06 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2005-09-11 11:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE – [ NTFS ]
O33 - MountPoints2\{61e30f70-131c-11de-a92d-001b246a6e5b}\Shell - "" = AutoRun
O33 - MountPoints2\{61e30f70-131c-11de-a92d-001b246a6e5b}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{9006c0fa-5a6c-11e0-8e43-001b246a6e5b}\Shell - "" = AutoRun
O33 - MountPoints2\{9006c0fa-5a6c-11e0-8e43-001b246a6e5b}\Shell\AutoRun\command - "" = G:\MI.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - File not found
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.ffds - C:\Program Files\Combined Community Codec Pack\Filters\FFDShow\ff_vfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011-06-11 06:35:24 | 000,580,096 | —- | C] (OldTimer Tools) – C:\Users\Mafalda\Desktop\OTL.exe
[2011-06-11 06:05:44 | 000,000,000 | —D | C] – C:\Users\Mafalda\AppData\Roaming\Malwarebytes
[2011-06-11 06:05:18 | 000,039,984 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011-06-11 06:05:18 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011-06-11 06:05:17 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011-06-11 06:05:12 | 000,022,712 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011-06-11 06:05:11 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011-06-11 06:02:51 | 009,435,312 | —- | C] (Malwarebytes Corporation ) – C:\Users\Mafalda\Desktop\mbam-setup-1.51.0.1200 (1).exe
[2011-06-11 04:56:58 | 000,000,000 | —D | C] – C:\Users\Mafalda\AppData\Roaming\Bandoo
[2011-06-11 04:55:48 | 000,000,000 | —D | C] – C:\ProgramData\boost_interprocess
[2011-06-10 19:11:30 | 000,000,000 | —D | C] – C:\Users\Mafalda\AppData\Roaming\vlc
[2011-06-10 19:10:17 | 000,000,000 | —D | C] – C:\ProgramData\Bandoo
[2011-06-10 19:10:02 | 000,000,000 | —D | C] – C:\Program Files\Bandoo
[2011-06-10 19:10:00 | 000,000,000 | —D | C] – C:\Users\Mafalda\AppData\Local\Ilivid Player
[2011-06-10 19:07:35 | 000,000,000 | -H-D | C] – C:\ProgramData\{4EF77D37-415C-4195-AE30-904ED23A3940}
[2011-06-10 19:07:09 | 000,000,000 | —D | C] – C:\Program Files\iLivid
[2011-06-10 19:06:06 | 000,000,000 | —D | C] – C:\Program Files\Windows iLivid Toolbar
[2011-06-10 19:05:32 | 000,000,000 | —D | C] – C:\Users\Mafalda\AppData\Local\PackageAware
[2011-06-06 07:46:36 | 000,000,000 | —D | C] – C:\Users\Mafalda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2011-06-05 18:36:04 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011-05-21 00:21:28 | 000,000,000 | —D | C] – C:\ProgramData\Skype Extras
[2011-05-21 00:18:49 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011-05-21 00:18:49 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2011-05-14 15:52:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Primal Pictures
[2011-05-14 15:52:33 | 000,000,000 | —D | C] – C:\Program Files\Primal Pictures
[2007-07-04 21:28:52 | 000,176,128 | —- | C] ( ) – C:\Windows\System32\csnp2uvc.dll
[2 C:\Users\Mafalda\Documents\*.tmp files -> C:\Users\Mafalda\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011-06-11 06:35:27 | 000,580,096 | —- | M] (OldTimer Tools) – C:\Users\Mafalda\Desktop\OTL.exe
[2011-06-11 06:31:07 | 000,001,056 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011-06-11 06:20:11 | 000,001,086 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3382992102-3375510615-3613349935-1000UA.job
[2011-06-11 06:05:19 | 000,000,906 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011-06-11 06:03:04 | 009,435,312 | —- | M] (Malwarebytes Corporation ) – C:\Users\Mafalda\Desktop\mbam-setup-1.51.0.1200 (1).exe
[2011-06-11 05:46:31 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2011-06-11 05:44:06 | 000,000,149 | —- | M] () – C:\Users\Public\Documents\hpqp.ini
[2011-06-11 05:39:32 | 000,001,052 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011-06-11 05:39:18 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011-06-11 05:39:18 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011-06-11 05:39:08 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011-06-08 21:51:23 | 000,595,996 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011-06-08 21:51:23 | 000,104,070 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011-06-08 18:23:05 | 000,002,014 | —- | M] () – C:\Users\Mafalda\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011-06-08 18:23:04 | 000,002,052 | —- | M] () – C:\Users\Mafalda\Desktop\Google Chrome.lnk
[2011-06-08 18:20:00 | 000,001,034 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3382992102-3375510615-3613349935-1000Core.job
[2011-06-05 18:36:05 | 000,002,073 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk
[2011-06-05 17:53:01 | 000,000,905 | —- | M] () – C:\Users\Mafalda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2011-05-29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011-05-29 09:11:20 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011-05-20 23:16:03 | 000,000,943 | —- | M] () – C:\Users\Mafalda\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011-05-17 07:47:54 | 000,005,000 | —- | M] () – C:\Users\Mafalda\AppData\Local\d3d9caps.dat
[2011-05-12 22:17:02 | 001,369,941 | —- | M] () – C:\Users\Mafalda\Desktop\scan0003.jpg
[2011-05-12 22:17:00 | 001,367,955 | —- | M] () – C:\Users\Mafalda\Desktop\scan0001.jpg
[2 C:\Users\Mafalda\Documents\*.tmp files -> C:\Users\Mafalda\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011-06-11 06:05:19 | 000,000,906 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011-06-06 07:46:57 | 000,002,052 | —- | C] () – C:\Users\Mafalda\Desktop\Google Chrome.lnk
[2011-06-06 07:46:57 | 000,002,014 | —- | C] () – C:\Users\Mafalda\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011-06-05 18:36:05 | 000,002,073 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2011-05-20 23:16:03 | 000,000,943 | —- | C] () – C:\Users\Mafalda\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011-05-17 07:46:18 | 000,000,868 | —- | C] () – C:\Windows\tasks\Google Software Updater.job
[2011-05-12 22:22:05 | 001,369,941 | —- | C] () – C:\Users\Mafalda\Desktop\scan0003.jpg
[2011-05-12 22:21:57 | 001,367,955 | —- | C] () – C:\Users\Mafalda\Desktop\scan0001.jpg
[2010-08-31 22:21:13 | 000,163,194 | —- | C] () – C:\Windows\hpoins28.dat.temp
[2010-08-31 22:21:13 | 000,000,796 | —- | C] () – C:\Windows\hpomdl28.dat.temp
[2010-08-31 21:39:01 | 000,163,194 | —- | C] () – C:\Windows\hpoins28.dat
[2010-08-31 21:39:00 | 000,000,796 | —- | C] () – C:\Windows\hpomdl28.dat
[2010-08-08 18:05:47 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2009-08-03 16:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009-08-03 16:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009-06-09 17:16:42 | 003,482,240 | —- | C] () – C:\Windows\System32\drivers\snp2uvc.sys
[2009-04-24 23:10:14 | 000,000,000 | —- | C] () – C:\Windows\System32\cd.dat
[2009-02-11 17:45:02 | 000,027,264 | —- | C] () – C:\Windows\System32\drivers\sncduvc.sys
[2009-02-10 09:32:16 | 000,005,000 | —- | C] () – C:\Users\Mafalda\AppData\Local\d3d9caps.dat
[2009-02-10 00:30:24 | 006,509,736 | —- | C] () – C:\Users\Mafalda\AppData\Roaming\UserTile.png
[2008-11-10 11:59:23 | 000,048,586 | —- | C] () – C:\ProgramData\xpif-v02030a.dtd
[2008-10-16 03:07:02 | 000,106,605 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2008-10-16 03:07:02 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008-03-14 20:04:28 | 000,214,528 | —- | C] () – C:\Users\Mafalda\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008-03-12 21:29:30 | 000,000,305 | —- | C] () – C:\ProgramData\addr_file.html
[2008-03-07 23:26:07 | 000,103,489 | —- | C] () – C:\Windows\hpqins13.dat
[2007-02-27 16:43:02 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2007-02-22 06:14:38 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1214.dll
[2007-02-22 04:50:42 | 000,245,760 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2006-12-14 03:01:36 | 000,520,192 | —- | C] () – C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006-12-14 03:01:36 | 000,204,800 | —- | C] () – C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006-11-02 08:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006-11-02 08:47:37 | 000,351,040 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006-11-02 08:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006-11-02 06:33:01 | 000,595,996 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006-11-02 06:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006-11-02 06:33:01 | 000,104,070 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006-11-02 06:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006-11-02 06:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006-11-02 04:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006-11-02 04:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006-11-02 03:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006-11-02 03:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006-10-23 09:04:28 | 000,075,133 | —- | C] () – C:\Windows\MultiKey.ini
[2006-05-19 15:39:58 | 000,015,497 | —- | C] () – C:\Windows\snp2uvc.ini
[2006-03-23 09:46:52 | 000,060,416 | —- | C] () – C:\Windows\MultiKyb.dll
[2006-03-23 09:46:46 | 000,057,856 | —- | C] () – C:\Windows\MultiKey.exe
[2006-03-09 20:58:00 | 001,060,424 | —- | C] () – C:\Windows\System32\WdfCoInstaller01000.dll
[2005-05-08 00:06:00 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
[2001-10-17 07:46:58 | 000,339,456 | —- | C] () – C:\Windows\System32\tx32.dll

========== Custom Scans ==========


< >

< %SYSTEMDRIVE%\*.* >
[2008-03-07 23:37:06 | 000,000,074 | —- | M] () – C:\autoexec.bat
[2008-01-19 03:45:45 | 000,333,203 | RHS- | M] () – C:\bootmgr
[2006-09-18 17:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2011-06-11 05:38:51 | 1377,107,968 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006-11-02 08:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006-11-02 08:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006-11-02 08:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006-11-02 08:37:12 | 000,030,808 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006-09-18 17:37:34 | 000,000,065 | -H– | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007-10-20 18:21:50 | 000,278,016 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpzpp5mu.dll
[2008-01-19 03:34:28 | 000,089,600 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006-11-02 08:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006-10-26 23:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008-10-15 01:15:29 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006-11-02 06:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006-11-02 06:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006-11-02 06:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006-11-02 06:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006-11-02 06:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011-05-20 23:16:03 | 000,000,732 | -HS- | M] () – C:\Users\Mafalda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011-06-11 06:03:04 | 009,435,312 | —- | M] (Malwarebytes Corporation ) – C:\Users\Mafalda\Desktop\mbam-setup-1.51.0.1200 (1).exe
[2011-06-11 06:35:27 | 000,580,096 | —- | M] (OldTimer Tools) – C:\Users\Mafalda\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >
[2006-05-19 15:53:02 | 000,013,022 | —- | M] () – C:\Windows\snp2uvc.src

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-21 05:02:13

< End of report >

And the Extras.Txt


OTL Extras logfile created on: 2011-06-11 06:51:11 - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Mafalda\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000C0C | Country: Canada | Language: FRC | Date Format: yyyy-MM-dd

1013,31 Mb Total Physical Memory | 204,72 Mb Available Physical Memory | 20,20% Memory free
2,24 Gb Paging File | 0,87 Gb Available in Paging File | 38,67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 142,15 Gb Total Space | 46,90 Gb Free Space | 32,99% Space Free | Partition Type: NTFS
Drive D: | 6,89 Gb Total Space | 0,75 Gb Free Space | 10,94% Space Free | Partition Type: NTFS

Computer Name: MAFALDA-PC | User Name: Mafalda | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{3BC68D1F-DC08-4FA5-8C73-81760991DC59}" = lport=2869 | protocol=6 | dir=in | app=system |
"{ADC97A99-F2C6-4DEF-8230-82D8EB2C8643}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{45E1CED8-6767-4B8B-9854-55255BF88167}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{4946BC36-A184-413F-9506-1E07D1DB3D23}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe |
"{53786E36-EF73-42EA-A7D9-C8900D593156}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{67EBE93E-9515-459F-A584-DF390BD2FC70}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{68C1F55F-8AEE-4E14-89AE-F1FD10318CFD}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7674F556-D64C-4A83-A16E-8A29C0DF9E56}" = dir=in | app=c:\program files\avg\avg9\avgemc.exe |
"{7CC8316B-5A63-40A2-AC86-B970E16F16D2}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{83E32117-C562-430B-B419-FBFA60B65D09}" = dir=in | app=c:\program files\hp\quickplay\qp.exe |
"{84B7E79E-1097-41DD-9CEF-1BA2E551E0A9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9B0A2203-13D5-4E95-B690-C1B36397B0EC}" = protocol=17 | dir=in | app=c:\users\mafalda\appdata\roaming\dropbox\bin\dropbox.exe |
"{BE50D85D-7726-4E2F-8012-333D4A9269B2}" = dir=in | app=c:\program files\avg\avg9\avgnsx.exe |
"{C4AED3EB-BEB9-4022-8FDC-76F933676954}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{C902A65B-9595-42DA-B0A7-4938362E847F}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{CD1B788B-BD4E-4EB1-ABF6-54441D0DAD0B}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{D3304308-56FC-4915-88B4-AE30DAB9A448}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{D6F08310-B206-4A1E-9B4F-349D16653549}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{DD7828C2-F9CD-4A45-AB12-8C6E5ED1C0DE}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{E7FCA5C0-6DB6-4009-AFCC-5181198D3A01}" = protocol=6 | dir=in | app=c:\users\mafalda\appdata\roaming\dropbox\bin\dropbox.exe |
"{F48B58FD-2F46-4A18-B6C8-CF6F8FDA147C}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{FC85DE43-373E-4E1D-A367-BED89A570548}" = dir=in | app=c:\program files\avg\avg9\avgupd.exe |
"TCP Query User{0FB93DD3-275F-461E-9898-1ABE65AD309A}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{494B2965-4CC4-4FEE-A5FB-67E33D90CB51}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"TCP Query User{625E3BE8-4F45-413D-99A0-F3EFA45613A5}C:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"TCP Query User{74D76AE4-4A6C-4414-BC6D-3161143C1D9F}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"TCP Query User{A1041BF5-9B45-426B-BE49-ED95CD16C800}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{E2946C95-5076-4B13-BDBE-11E7B85FBC92}C:\program files\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"TCP Query User{ED620AF2-6710-4D08-B078-C17A39EA65EE}C:\program files\orbitdownloader\orbitnet.exe" = protocol=6 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"TCP Query User{EFABE515-F443-46E7-B906-2F603248DCBB}C:\users\mafalda\appdata\local\google\chrome\application\chrome.exe" = protocol=6 | dir=in | app=c:\users\mafalda\appdata\local\google\chrome\application\chrome.exe |
"TCP Query User{FEE8C880-5D43-4AF7-8044-D9360DD7D14E}C:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"UDP Query User{2BF7384C-E6B0-444D-8113-D90EAF91344B}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{408D3F39-CB96-42C0-ADF4-70DFFDAF87E2}C:\users\mafalda\appdata\local\google\chrome\application\chrome.exe" = protocol=17 | dir=in | app=c:\users\mafalda\appdata\local\google\chrome\application\chrome.exe |
"UDP Query User{409BD623-61E4-48AD-A35C-61D0A0847F8B}C:\program files\orbitdownloader\orbitnet.exe" = protocol=17 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"UDP Query User{78581D07-DD5A-414B-B879-C3235E919E8E}C:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"UDP Query User{80B85F63-B8AE-4E81-9CC1-1FB3B8CDA627}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{AFC17DB5-09D3-4BB9-9B4B-A440EDC591A4}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{C7E2890D-6C33-4326-A8A0-855C888CAD1D}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"UDP Query User{EDA36FA9-2531-47B8-861E-C7FB0A7E6588}C:\program files\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"UDP Query User{F28EEFE1-CB78-4212-9053-8B1B7ED255B2}C:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{0BFC200F-C45D-4271-AF34-4CA969225DEB}" = muvee autoProducer 6.0
"{0CFD3BAF-9F4D-4D70-BD0B-638EA2504C25}" = PSSWCORE
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive
"{1E5E2F9A-17D3-45CA-8FF0-B0C2927D4B03}" = MobileMe Control Panel
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Outil de téléchargement Windows Live
"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 20
"{290B83AA-093A-45BF-A917-D1C4A1E8D917}" = HP Active Support Library
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java™ SE Runtime Environment 6
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.20 B1
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Roxio Activation Module
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.2
"{46ABBC54-1872-4AA3-95E2-F2C063A63F31}" = Installation Windows Live
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{5CA81D12-9EC2-4082-972B-43ECA63F41F2}" = HP Pavilion Webcam Driver for Vista v061.001.00005
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{770F1BEC-2871-4E70-B837-FB8525FFA3B1}" = Windows Live Messenger
"{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}" = Windows Live Call
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{88A548E6-4B09-43E7-AD55-3C7D1B37706D}" = ESU for Microsoft Vista
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{8CEA85DE-955B-4BF4-87F2-0BAA62821633}" = HP Photosmart Essential2.5
"{90120000-0015-040C-0000-0000000FF1CE}" = Microsoft Office Access MUI (French) 2007
"{90120000-0015-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007
"{90120000-0016-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007
"{90120000-0018-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-040C-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (French) 2007
"{90120000-0019-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-040C-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (French) 2007
"{90120000-001A-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007
"{90120000-001B-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007
"{90120000-001F-0401-0000-0000000FF1CE}_ENTERPRISE_{14809F99-C601-4D4A-9391-F1E8FAA964C5}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007
"{90120000-001F-0413-0000-0000000FF1CE}_ENTERPRISE_{D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-040C-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (French) 2007
"{90120000-0044-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007
"{90120000-006E-040C-0000-0000000FF1CE}_ENTERPRISE_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-040C-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (French) 2007
"{90120000-00A1-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-040C-0000-0000000FF1CE}" = Microsoft Office Groove MUI (French) 2007
"{90120000-00BA-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{9061CEF2-51F5-42C9-8A70-9ED351C6597A}" = HP Help and Support
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A87B11AC-4344-4E5D-8B12-8F471A87DAD9}" = LightScribe 1.4.136.1
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B28759B8-5FC6-4F56-9C6C-6EDAD36455A9}" = Roxio Media Manager
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{BE8A9C2C-8E41-445B-A746-BEB0B1F992F8}" = DJ_AIO_03_F4200_Software_Min
"{C3B6AEB1-390C-4792-8677-CD87F8B2C959}" = HP Deskjet F4200 All-In-One Driver 11.0 03
"{C89B5E3A-690F-4CEE-909A-BF869E198B0A}" = Scan
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE5E3F15-320A-4865-97D3-F07227C5BB2F}" = BlackBerry Desktop Software 4.5
"{CF0EDB56-BBF6-3C9F-9C50-2E3B3D444641}" = Google Talk Plugin
"{D32067CD-7409-4792-BFA0-1469BCD8F0C8}" = HP Wireless Assistant
"{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}" = Assistant de connexion Windows Live
"{E56D39F8-2A9F-44B4-B068-A72E45A073E6}" = Safari
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F7B0E599-C114-4493-BC4D-D8FC7CBBABBB}" = 32 Bit HP CIO Components Installer
"{F7F3B252-E772-48AA-93EB-7964BC326067}" = MSCU for Microsoft Vista
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = Utilitaire de configuration iPhone
"{FAB0C302-CB18-4A7A-BA03-C3DC23101A68}" = HP Active Support Library 32 bit components
"{FAE36873-1941-4076-A9A5-48812B5EA0B7}" = iTunes
"{FCCC555E-166C-426A-A98C-39C80AE7C081}" = HP User Guides 0082
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Anatomy Trains" = Anatomy Trains
"AVG9Uninstall" = AVG Free 9.0
"BlackBerry_{CE5E3F15-320A-4865-97D3-F07227C5BB2F}" = BlackBerry Desktop Software 4.5
"CNXT_HDAUDIO" = Conexant HD Audio
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_5045&SUBSYS_103C30B7" = HDAUDIO Soft Data Fax Modem with SmartCP
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2008-01-24
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EuroTalk Talk Now Plus!" = EuroTalk Talk Now Plus!
"Google Updater" = Google Updater
"HDMI" = Intel® Graphics Media Accelerator Driver
"HotspotShield" = Hotspot Shield 1.30
"HP Photosmart Essential" = HP Photosmart Essential 2.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.0.1200
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Rhapsody" = Rhapsody
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WildTangent hplaptop Master Uninstall" = My HP Games
"WinLiveSuite_Wave3" = Installation Windows Live
"WinRAR archiver" = WinRAR archiver
"XMind" = XMind

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2011-06-11 05:23:51 | Computer Name = Mafalda-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 2011-06-11 05:23:51 | Computer Name = Mafalda-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9625

Error - 2011-06-11 05:23:51 | Computer Name = Mafalda-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9625

Error - 2011-06-11 05:23:52 | Computer Name = Mafalda-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 2011-06-11 05:23:52 | Computer Name = Mafalda-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 10623

Error - 2011-06-11 05:23:52 | Computer Name = Mafalda-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 10623

Error - 2011-06-11 05:23:53 | Computer Name = Mafalda-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 2011-06-11 05:23:53 | Computer Name = Mafalda-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 11622

Error - 2011-06-11 05:23:53 | Computer Name = Mafalda-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 11622

Error - 2011-06-11 05:42:35 | Computer Name = Mafalda-PC | Source = Application Error | ID = 1000
Description = Faulting application AppleSyncNotifier.exe, version 1.5.0.0, time
stamp 0x4a5d2cf8, faulting module CoreFoundation.dll, version 6.0.6001.18538, time
stamp 0x4cb733dc, exception code 0xc0000135, fault offset 0x00009cfc, process id
0x5ac, application start time 0x01cc281bd5ef3208.

[ Media Center Events ]
Error - 2008-04-16 15:33:37 | Computer Name = Mafalda-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

[ OSession Events ]
Error - 2009-02-23 18:14:04 | Computer Name = Mafalda-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 24581
seconds with 2400 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 2011-06-11 05:33:13 | Computer Name = Mafalda-PC | Source = DCOM | ID = 10010
Description =

Error - 2011-06-11 05:39:15 | Computer Name = Mafalda-PC | Source = HTTP | ID = 15016
Description =

Error - 2011-06-11 05:40:07 | Computer Name = Mafalda-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 2011-06-11 05:40:07 | Computer Name = Mafalda-PC | Source = Service Control Manager | ID = 7003
Description =

Error - 2011-06-11 05:40:07 | Computer Name = Mafalda-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 2011-06-11 05:40:07 | Computer Name = Mafalda-PC | Source = Service Control Manager | ID = 7009
Description =

Error - 2011-06-11 05:41:33 | Computer Name = Mafalda-PC | Source = Service Control Manager | ID = 7022
Description =

Error - 2011-06-11 05:41:34 | Computer Name = Mafalda-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 2011-06-11 05:45:11 | Computer Name = Mafalda-PC | Source = Service Control Manager | ID = 7009
Description =

Error - 2011-06-11 05:45:11 | Computer Name = Mafalda-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >

I also downloaded Malware and got the following report:


Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6833

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

2011-06-11 07:32:19
mbam-log-2011-06-11 (07-32-18).txt

Scan type: Quick scan
Objects scanned: 164906
Time elapsed: 13 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Thank you so much!
rlightbown