This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Am I infected?

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hello I have had my computer shut down because of video card errors and some other blue screen I do not remember.


OTL logfile created on: 6/16/2011 1:09:38 PM - Run 1
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Users\Todd\Downloads
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.50 Gb Total Physical Memory | 2.38 Gb Available Physical Memory | 68.17% Memory free
7.18 Gb Paging File | 6.09 Gb Available in Paging File | 84.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 173.71 Gb Total Space | 65.27 Gb Free Space | 37.57% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 3.25 Gb Free Space | 32.50% Space Free | Partition Type: NTFS
Drive G: | 698.64 Gb Total Space | 394.08 Gb Free Space | 56.41% Space Free | Partition Type: NTFS

Computer Name: TODD-PC | User Name: Todd | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Todd\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Users\Todd\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
PRC - C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Fingerprint Reader Suite\upeksvr.exe (UPEK Inc.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
PRC - C:\Windows\System32\dlcjcoms.exe ( )
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - c:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)


========== Modules (SafeList) ==========

MOD - C:\Users\Todd\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\AVAST Software\Avast\snxhk.dll (AVAST Software)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter) – File not found
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (WAS) – C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (Microsoft SharePoint Workspace Audit Service) – C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (AppHostSvc) – C:\Windows\System32\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (Creative Labs Licensing Service) – C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (STacSV) – C:\Windows\System32\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) – C:\Windows\System32\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (AdobeActiveFileMonitor6.0) – C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (dlcj_device) – C:\Windows\System32\dlcjcoms.exe ( )


========== Driver Services (SafeList) ==========

DRV - (aswSnx) – C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRdr) – C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMonFlt) – C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) – C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (OEM02Dev) – C:\Windows\System32\drivers\OEM02Dev.sys (Creative Technology Ltd.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (iaNvStor) Intel® – C:\Windows\system32\drivers\ianvstor.sys (Intel Corporation)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (OEM02Vfx) – C:\Windows\System32\drivers\OEM02Vfx.sys (EyePower Games Pte. Ltd.)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.com"

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/05/10 20:41:08 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/29 19:08:46 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/05/07 13:49:40 | 000,000,000 | —D | M] (No name found) – C:\Users\Todd\AppData\Roaming\Mozilla\Extensions
[2011/06/16 09:57:59 | 000,000,000 | —D | M] (No name found) – C:\Users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\m9k96j9m.default\extensions
[2011/05/24 23:58:31 | 000,000,000 | —D | M] (Garmin Communicator) – C:\Users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\m9k96j9m.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011/06/15 09:45:02 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\m9k96j9m.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/06/16 09:57:59 | 000,000,000 | —D | M] (Cooliris) – C:\Users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\m9k96j9m.default\extensions\[removed]
[2011/05/29 19:08:46 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) –
[2011/05/10 20:41:08 | 000,000,000 | —D | M] (RealPlayer Browser Record Plugin) – C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
() (No name found) – C:\USERS\TODD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M9K96J9M.DEFAULT\EXTENSIONS\{EF4E370E-D9F0-4E00-B93E-A4F274CFDD5A}.XPI
() (No name found) – C:\USERS\TODD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M9K96J9M.DEFAULT\EXTENSIONS\[removed]
[2011/05/08 06:38:41 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/04/14 11:26:02 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 03:00:00 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [DLCJCATS] C:\Windows\System32\spool\DRIVERS\W32X86\3\DLCJtime.DLL ()
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [OfficeSyncProcess] C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE (Microsoft Corporation)
O4 - HKCU..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe ()
O4 - Startup: C:\Users\Todd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Todd\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Send image to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\Windows\System32\vrlogon.dll (UPEK Inc.)
O20 - Winlogon\Notify\psfus: DllName - C:\Windows\system32\psqlpwd.dll - C:\Windows\System32\psqlpwd.dll (UPEK Inc.)
O22 - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\System32\DreamScene.dll (Microsoft Corporation)
O24 - Desktop WallPaper: G:\Documents\mine\1136169721_800x600_snoopy-wallpaper-free-snoopy-wallpaper.jpg
O24 - Desktop BackupWallPaper: G:\Documents\mine\1136169721_800x600_snoopy-wallpaper-free-snoopy-wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2008/01/11 18:27:00 | 000,000,132 | —- | M] () - G:\autorun.inf – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/06/16 06:59:53 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{D16677B5-A0D4-4C62-96B7-3E9F92134205}
[2011/06/16 06:32:34 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{91A01E7F-1DF2-4811-B3D6-50CC8BE059BA}
[2011/06/16 03:57:17 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{4BD24D39-4FA5-4CBC-A3DD-463A1660F084}
[2011/06/15 23:55:38 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{E681AB3C-F6FC-4691-96C9-48E1D0B9B04D}
[2011/06/15 22:58:26 | 000,000,000 | —D | C] – C:\Users\Todd\Documents\Dell Webcam Center
[2011/06/15 20:36:44 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2011/06/15 20:34:52 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/06/15 20:34:51 | 001,797,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2011/06/15 20:34:51 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2011/06/15 20:34:51 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/06/15 20:31:12 | 000,000,000 | —D | C] – C:\Users\Todd\Documents\Outlook Files
[2011/06/15 09:27:38 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{797924AD-3C95-47C5-83A7-D7E23456E289}
[2011/06/15 02:25:46 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{7FB52A84-F200-4E20-A8BA-4E2A9F51D5EA}
[2011/06/14 10:55:21 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{E79BBFBA-A92D-455F-B804-F7FFB8EC17CE}
[2011/06/13 13:21:42 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{170433F5-1B27-4283-8982-974C06566495}
[2011/06/12 23:55:19 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{F6D09DAB-FCC7-4EB6-B90E-63E033E7ACCB}
[2011/06/12 07:27:14 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{CE63A178-41C2-42B4-99E0-CF8E3EDE04AA}
[2011/06/12 02:44:46 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2011/06/12 02:13:27 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\Reallusion
[2011/06/12 02:13:26 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\tmp
[2011/06/11 17:53:50 | 000,329,728 | —- | C] (Microsoft Corporation) – C:\Users\Todd\Documents\netsetup.exe
[2011/06/11 10:47:58 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{6B287D40-2980-4930-9690-EC8BE224AD33}
[2011/06/11 08:10:42 | 000,000,000 | —D | C] – C:\Users\Todd\Documents\Bluetooth Exchange Folder
[2011/06/11 03:04:06 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Cooliris
[2011/06/11 03:04:06 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\Cooliris
[2011/06/10 22:47:15 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{C295E4A2-2C84-4989-8287-75AAD32924A9}
[2011/06/10 09:39:46 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{E9D5C691-669C-4751-BDB5-D688E4F939CA}
[2011/06/10 06:21:29 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{9B7035A6-D721-4B40-B60F-449D1ADBBD0D}
[2011/06/10 05:18:47 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\Microsoft Games
[2011/06/10 02:01:04 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{42E5B258-0E16-4826-9E5A-EFB855DD3B29}
[2011/06/09 20:12:36 | 000,000,000 | —D | C] – C:\Users\Todd\Documents\MakeDiscVideo
[2011/06/09 20:12:32 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\CyberLink
[2011/06/09 19:26:41 | 000,000,000 | —D | C] – C:\Users\Todd\Documents\Todd's Music
[2011/06/09 18:47:37 | 000,000,000 | —D | C] – C:\Windows\System32\Adobe
[2011/06/09 18:41:15 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/06/09 18:40:46 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/06/09 09:51:24 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{4ADD3B0A-D37C-484E-82B0-ECA643121CC3}
[2011/06/08 14:02:12 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{21DE5A2A-194B-4A1A-91AB-5505C7DACE2A}
[2011/06/08 13:37:55 | 000,000,000 | —D | C] – C:\Program Files\MSXML 4.0
[2011/06/07 21:36:51 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\PCM4Everio
[2011/06/07 21:36:08 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msxml4r.dll
[2011/06/07 21:36:08 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msxml4a.dll
[2011/06/07 13:48:37 | 000,000,000 | —D | C] – C:\Users\Todd\.bitrock
[2011/06/07 13:47:38 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{07E62684-B29E-4E84-B7A7-4A6EDA561E5C}
[2011/06/06 07:41:51 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{8829C39D-2923-4B18-B671-D43CE71C60E7}
[2011/06/05 13:20:06 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{23F7F2EA-9AC8-4D22-811F-BDD68530D42B}
[2011/06/04 11:17:25 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{9006FD24-1B6A-401E-A646-140CF2860377}
[2011/06/04 11:10:36 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{1CC3833C-AEA4-4198-9BF4-D172412760F4}
[2011/06/01 08:41:51 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{9613DEC2-BCD4-4F53-8E62-383FCE51D2D1}
[2011/05/29 19:08:46 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2011/05/29 18:53:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011/05/29 18:24:12 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{E7F3B459-54B8-4385-81FF-270374B65E66}
[2011/05/29 06:15:27 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{CDEC5B41-4361-4F88-A96E-9B8F8C89AE40}
[2011/05/29 04:37:05 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{0816295A-A8A5-484E-B999-6191190A657A}
[2011/05/29 03:47:40 | 000,000,000 | —D | C] – C:\Program Files\WinPcap
[2011/05/29 03:19:30 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{0F396FDA-C4BE-4623-88D0-BAA5828D29AE}
[2011/05/28 19:28:05 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WM Recorder 11.0
[2011/05/28 19:28:00 | 000,000,000 | —D | C] – C:\Program Files\WMR11
[2011/05/28 15:32:52 | 000,000,000 | —D | C] – C:\ProgramData\Last.fm
[2011/05/28 15:31:50 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\Last.fm
[2011/05/28 15:31:49 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Last.fm
[2011/05/28 15:31:47 | 000,000,000 | —D | C] – C:\Program Files\Last.fm
[2011/05/28 15:03:40 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{20043235-4EC5-427E-8647-0F626B153FC7}
[2011/05/28 00:45:33 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{52754232-EA16-4008-BD64-7B38D68C9828}
[2011/05/27 18:48:42 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{63C1AD91-668E-4771-8EF9-953E3EFFFF01}
[2011/05/27 12:37:08 | 000,000,000 | —D | C] – C:\Users\Todd\Desktop\Music
[2011/05/27 06:29:28 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{E432CC7D-8E0F-4BBF-836C-64223999B733}
[2011/05/26 16:35:59 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{858D73BF-DA6B-47B3-82AF-589ED32151EA}
[2011/05/26 03:41:54 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{D2371CA3-6E6F-4BE5-B807-5BC940992CF2}
[2011/05/25 15:21:44 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{03251BF4-CAE1-4FC8-BFF4-400E9C7F506D}
[2011/05/25 14:18:38 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{D1EA8C20-6AA3-47BA-99F2-C5D4C300706C}
[2011/05/25 14:16:04 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\Dell
[2011/05/25 14:15:47 | 000,000,000 | R–D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell Support Center
[2011/05/25 14:14:50 | 000,000,000 | —D | C] – C:\Program Files\Dell Support Center
[2011/05/25 13:37:25 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{63BAEDB1-3F70-422C-9A9B-5321CF2D3BEB}
[2011/05/25 13:16:25 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{D9B78F50-29A3-4F00-A342-88F7DAAFC949}
[2011/05/25 11:50:54 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{1EEBA0E1-4F07-4FEC-A49A-772872E90FF2}
[2011/05/25 08:26:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid
[2011/05/25 08:26:21 | 000,000,000 | —D | C] – C:\Program Files\Xvid
[2011/05/25 05:47:27 | 000,000,000 | —D | C] – C:\Users\Public\Documents\microsoft
[2011/05/25 05:44:49 | 000,000,000 | —D | C] – C:\Program Files\MSECache
[2011/05/25 01:23:56 | 000,000,000 | —D | C] – C:\ProgramData\Garmin
[2011/05/25 01:09:00 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
[2011/05/25 01:08:54 | 000,000,000 | —D | C] – C:\Program Files\DIFX
[2011/05/25 01:08:35 | 000,000,000 | —D | C] – C:\Program Files\Garmin
[2011/05/25 00:41:12 | 004,157,760 | —- | C] (Garmin International) – C:\Users\Todd\Documents\GarminMapUpdater_v2.6.11.exe
[2011/05/25 00:40:58 | 005,178,688 | —- | C] (Igor Pavlov) – C:\Users\Todd\Documents\WebUpdater_242.exe
[2011/05/24 23:58:34 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\GARMIN
[2011/05/24 21:45:34 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{21E5BC7C-AD95-49FF-AA69-FB29B0C13A86}
[2011/05/24 21:06:26 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{856F57C0-8240-44EC-B903-7B8DC92C555E}
[2011/05/24 09:00:46 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{DA0DAF46-68E6-4826-875D-D3B016E461DA}
[2011/05/24 05:42:13 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{DA505049-9922-4A66-8EAC-B4127B120335}
[2011/05/23 22:56:26 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{F7A98C98-4B00-4523-8795-2292E6759433}
[2011/05/23 21:12:15 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{140C70F9-028C-4098-9E27-2E28205A95ED}
[2011/05/23 18:10:06 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{79950582-69F9-44FA-AFDB-2190217D6D00}
[2011/05/23 04:56:12 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{790B5C29-DC2B-44C9-B2ED-0E367D4280A9}
[2011/05/22 16:19:59 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{8119165A-6275-4AA9-850D-3DF407325A73}
[2011/05/22 13:47:55 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{B23FFCF7-F611-48F7-AB98-136013CACC3F}
[2011/05/21 23:17:06 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{F79B0CD8-AD33-4562-8DD1-8C9F3E8B8F07}
[2011/05/21 15:29:41 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/05/21 09:35:58 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{815C22CF-4144-4408-8846-7EBB05448EB7}
[2011/05/20 16:25:02 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{338FEF26-2075-412F-A053-BA5091228320}
[2011/05/20 03:47:46 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{B55FFD4C-B246-4751-8A6D-2FB257A6CE23}
[2011/05/19 22:09:48 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{85460FC5-4E98-4448-B26B-309ACB4E7D97}
[2011/05/19 09:12:19 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{41EA6CA1-673B-4BB7-8964-0150ED7B40EB}
[2011/05/18 20:45:47 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{9A4A858A-4BA7-4157-84AE-2820324E5E8D}
[2011/05/18 08:45:15 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{CE20D7A6-E5D4-4EDB-84DA-F1C3AA0399CF}
[2011/05/17 18:14:40 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{D66318AC-927C-435D-A914-6FE31EED2933}
[2006/11/17 15:54:36 | 000,385,928 | —- | C] ( ) – C:\Windows\System32\dlcjih.exe
[2006/11/17 15:54:34 | 000,537,480 | —- | C] ( ) – C:\Windows\System32\dlcjcoms.exe
[2006/11/17 15:54:32 | 000,381,832 | —- | C] ( ) – C:\Windows\System32\dlcjcfg.exe
[2006/11/06 16:37:46 | 000,643,072 | —- | C] ( ) – C:\Windows\System32\dlcjpmui.dll
[2006/11/06 16:35:50 | 001,224,704 | —- | C] ( ) – C:\Windows\System32\dlcjserv.dll
[2006/11/06 16:28:08 | 000,421,888 | —- | C] ( ) – C:\Windows\System32\dlcjcomm.dll
[2006/11/06 16:26:14 | 000,585,728 | —- | C] ( ) – C:\Windows\System32\dlcjlmpm.dll
[2006/11/06 16:24:44 | 000,397,312 | —- | C] ( ) – C:\Windows\System32\dlcjiesc.dll
[2006/11/06 16:21:48 | 000,094,208 | —- | C] ( ) – C:\Windows\System32\dlcjpplc.dll
[2006/11/06 16:20:48 | 000,684,032 | —- | C] ( ) – C:\Windows\System32\dlcjcomc.dll
[2006/11/06 16:20:14 | 000,163,840 | —- | C] ( ) – C:\Windows\System32\dlcjprox.dll
[2006/11/06 16:12:44 | 000,413,696 | —- | C] ( ) – C:\Windows\System32\dlcjinpa.dll
[2006/11/06 16:11:58 | 000,991,232 | —- | C] ( ) – C:\Windows\System32\dlcjusb1.dll
[2006/11/06 16:07:04 | 000,696,320 | —- | C] ( ) – C:\Windows\System32\dlcjhbn3.dll

========== Files - Modified Within 30 Days ==========

[2011/06/16 13:06:27 | 000,637,042 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/06/16 13:06:27 | 000,116,882 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/06/16 13:01:23 | 000,027,240 | —- | M] () – C:\Users\Todd\AppData\Roaming\nvModes.001
[2011/06/16 13:00:18 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/16 13:00:17 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/16 13:00:03 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/06/16 12:59:53 | 3756,064,768 | -HS- | M] () – C:\hiberfil.sys
[2011/06/16 12:26:52 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2011/06/16 09:00:30 | 000,000,506 | —- | M] () – C:\Windows\tasks\SystemToolsDailyTest.job
[2011/06/16 08:32:24 | 000,096,768 | —- | M] () – C:\Users\Todd\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/15 21:00:47 | 000,001,894 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/06/12 15:16:27 | 000,000,832 | —- | M] () – C:\Users\Todd\Desktop\AngryBirds.exe - Shortcut.lnk
[2011/06/11 15:47:48 | 000,000,861 | —- | M] () – C:\Users\Public\Desktop\VLC media player.lnk
[2011/06/11 15:46:25 | 021,022,914 | —- | M] () – C:\Users\Todd\Documents\vlc-1.1.10-win32.exe
[2011/06/11 08:14:22 | 000,002,558 | —- | M] () – C:\Users\Todd\Documents\yup.pfx
[2011/06/09 18:41:15 | 000,001,666 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/06/09 18:29:53 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/06/07 19:17:17 | 000,000,498 | —- | M] () – C:\Users\Todd\Desktop\mine - Shortcut.lnk
[2011/06/07 13:45:36 | 000,000,564 | —- | M] () – C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2011/06/05 15:58:55 | 000,027,240 | —- | M] () – C:\Users\Todd\AppData\Roaming\nvModes.dat
[2011/05/30 08:42:51 | 000,240,640 | —- | M] () – C:\Windows\System32\xvidvfw.dll
[2011/05/29 19:14:32 | 000,000,918 | —- | M] () – C:\Users\Todd\Desktop\Dropbox.lnk
[2011/05/29 19:14:32 | 000,000,898 | —- | M] () – C:\Users\Todd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2011/05/29 19:08:47 | 000,000,848 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/05/29 18:53:42 | 000,000,806 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/05/29 04:47:25 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/05/29 04:47:25 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/05/27 09:32:33 | 000,270,845 | —- | M] () – C:\Users\Todd\Documents\file.pdf
[2011/05/26 11:50:17 | 000,001,728 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/05/25 00:30:53 | 005,178,688 | —- | M] (Igor Pavlov) – C:\Users\Todd\Documents\WebUpdater_242.exe
[2011/05/25 00:30:36 | 000,602,942 | —- | M] () – C:\Users\Todd\Documents\DownloadableContent_UserGuide.pdf
[2011/05/24 23:58:58 | 004,157,760 | —- | M] (Garmin International) – C:\Users\Todd\Documents\GarminMapUpdater_v2.6.11.exe
[2011/05/23 18:20:42 | 000,620,268 | —- | M] () – C:\Users\Todd\Documents\wire.pdf
[2011/05/23 04:52:08 | 000,153,088 | —- | M] () – C:\Windows\System32\xvid.ax
[2011/05/23 02:46:31 | 000,645,632 | —- | M] () – C:\Windows\System32\xvidcore.dll
[2011/05/17 17:08:19 | 000,379,448 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2011/06/15 21:00:47 | 000,001,894 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/06/15 21:00:47 | 000,001,804 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011/06/12 15:16:27 | 000,000,832 | —- | C] () – C:\Users\Todd\Desktop\AngryBirds.exe - Shortcut.lnk
[2011/06/11 15:47:48 | 000,000,861 | —- | C] () – C:\Users\Public\Desktop\VLC media player.lnk
[2011/06/11 15:45:59 | 021,022,914 | —- | C] () – C:\Users\Todd\Documents\vlc-1.1.10-win32.exe
[2011/06/11 08:14:11 | 000,002,558 | —- | C] () – C:\Users\Todd\Documents\yup.pfx
[2011/06/09 18:41:15 | 000,001,666 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/06/07 13:52:55 | 000,645,632 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2011/06/07 13:52:55 | 000,153,088 | —- | C] () – C:\Windows\System32\xvid.ax
[2011/06/07 13:52:54 | 000,240,640 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2011/05/29 19:08:47 | 000,000,860 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/05/29 19:08:47 | 000,000,848 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/05/29 04:47:25 | 000,000,000 | RHS- | C] () – C:\MSDOS.SYS
[2011/05/29 04:47:25 | 000,000,000 | RHS- | C] () – C:\IO.SYS
[2011/05/27 09:32:33 | 000,270,845 | —- | C] () – C:\Users\Todd\Documents\file.pdf
[2011/05/25 14:16:07 | 000,000,564 | —- | C] () – C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2011/05/25 14:16:04 | 000,000,506 | —- | C] () – C:\Windows\tasks\SystemToolsDailyTest.job
[2011/05/25 08:04:46 | 000,000,498 | —- | C] () – C:\Users\Todd\Desktop\mine - Shortcut.lnk
[2011/05/25 00:30:36 | 000,602,942 | —- | C] () – C:\Users\Todd\Documents\DownloadableContent_UserGuide.pdf
[2011/05/23 18:20:41 | 000,620,268 | —- | C] () – C:\Users\Todd\Documents\wire.pdf
[2011/05/11 08:10:32 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2011/05/08 08:24:15 | 000,269,416 | —- | C] () – C:\Windows\System32\nvdrsdb1.bin
[2011/05/08 08:24:15 | 000,269,416 | —- | C] () – C:\Windows\System32\nvdrsdb0.bin
[2011/05/08 08:24:15 | 000,000,001 | —- | C] () – C:\Windows\System32\nvdrssel.bin
[2011/05/08 08:23:15 | 000,000,680 | —- | C] () – C:\Users\Todd\AppData\Local\d3d9caps.dat
[2011/05/07 22:43:25 | 000,062,976 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2011/05/07 22:43:18 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2011/05/07 22:42:48 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2011/05/07 22:42:48 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011/05/07 18:05:18 | 000,081,158 | —- | C] () – C:\Windows\System32\manage-bde.ini.en
[2011/05/07 13:49:34 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2011/05/07 13:48:07 | 000,027,240 | —- | C] () – C:\Users\Todd\AppData\Roaming\nvModes.001
[2011/05/07 13:42:50 | 000,096,768 | —- | C] () – C:\Users\Todd\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/07 13:41:59 | 000,027,240 | —- | C] () – C:\Users\Todd\AppData\Roaming\nvModes.dat
[2008/03/13 04:58:17 | 000,167,936 | —- | C] () – C:\Windows\System32\nvccoin.dll
[2008/03/13 04:58:16 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
[2008/03/12 21:29:48 | 000,000,209 | —- | C] () – C:\Windows\ODBCINST.INI
[2008/03/12 21:18:00 | 000,000,076 | RHS- | C] () – C:\Windows\CT4CET.bin
[2008/03/12 21:14:34 | 000,065,536 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2008/03/12 21:14:34 | 000,024,064 | —- | C] () – C:\Windows\System32\WLTRYSVC.EXE
[2008/03/12 21:13:43 | 000,101,376 | —- | C] () – C:\Windows\System32\APOMngr.dll
[2008/03/12 21:13:43 | 000,066,560 | —- | C] () – C:\Windows\System32\CmdRtr.dll
[2008/03/12 21:13:43 | 000,000,628 | —- | C] () – C:\Windows\System32\PCI_VEN_1102&DEV_FF05&SUBSYS_00001102.ini
[2008/03/12 21:04:42 | 000,000,012 | —- | C] () – C:\Windows\bthservsdp.dat
[2006/11/09 15:01:13 | 000,000,000 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2006/11/07 11:30:48 | 000,344,064 | —- | C] () – C:\Windows\System32\dlcjcoin.dll
[2006/11/03 17:25:56 | 000,389,120 | —- | C] () – C:\Windows\System32\btwhidcs.dll
[2006/11/02 07:55:52 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 07:46:27 | 000,379,448 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 07:34:20 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:33:01 | 000,637,042 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,116,882 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 05:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 05:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 03:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/10/20 04:04:52 | 000,106,496 | —- | C] () – C:\Windows\System32\dlcjinsr.dll
[2006/10/20 04:04:42 | 000,036,864 | —- | C] () – C:\Windows\System32\dlcjcur.dll
[2006/10/20 04:04:00 | 000,135,168 | —- | C] () – C:\Windows\System32\dlcjjswr.dll
[2006/10/20 03:58:06 | 000,176,128 | —- | C] () – C:\Windows\System32\dlcjinsb.dll
[2006/10/20 03:57:52 | 000,086,016 | —- | C] () – C:\Windows\System32\dlcjcub.dll
[2006/10/20 03:57:30 | 000,073,728 | —- | C] () – C:\Windows\System32\dlcjcu.dll
[2006/10/20 03:57:18 | 000,159,744 | —- | C] () – C:\Windows\System32\dlcjins.dll
[2006/10/20 03:55:02 | 000,434,176 | —- | C] () – C:\Windows\System32\dlcjutil.dll
[2006/09/06 05:26:28 | 000,069,632 | —- | C] () – C:\Windows\System32\dlcjcfg.dll
[2005/08/18 06:26:46 | 000,040,960 | —- | C] () – C:\Windows\System32\dlcjvs.dll
[2005/08/08 10:01:04 | 000,061,440 | —- | C] () – C:\Windows\System32\dlcjcnv4.dll
[2001/11/14 12:56:00 | 001,802,240 | —- | C] () – C:\Windows\System32\lcppn21.dll

========== LOP Check ==========

[2011/06/16 13:01:31 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Dropbox
[2011/05/25 13:41:04 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\GARMIN
[2011/05/07 16:41:22 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\PCDr
[2011/05/10 13:18:19 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Rovio
[2011/06/12 02:13:26 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\tmp
[2011/06/12 14:52:29 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\uTorrent
[2011/05/11 17:14:14 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Windows Live Writer
[2011/06/07 13:45:36 | 000,000,564 | —- | M] () – C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2011/06/16 12:26:54 | 000,016,646 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2011/06/16 09:00:30 | 000,000,506 | —- | M] () – C:\Windows\Tasks\SystemToolsDailyTest.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2006/09/18 16:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/10 23:36:38 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2006/09/18 16:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2008/03/13 04:58:26 | 000,004,885 | RH– | M] () – C:\dell.sdr
[2011/06/10 14:32:05 | 000,000,087 | —- | M] () – C:\dlcj.log
[2011/06/16 12:59:53 | 3756,064,768 | -HS- | M] () – C:\hiberfil.sys
[2011/05/29 04:47:25 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/05/29 04:47:25 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/06/16 12:59:51 | 4069,675,008 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/11/02 07:35:26 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 07:35:26 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 07:35:26 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2011/05/07 22:56:46 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 16:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/10/20 04:23:34 | 000,118,272 | —- | M] (Lexmark International, Inc.) – C:\Windows\System32\spool\prtprocs\w32x86\dlcjPP5C.DLL
[2006/11/02 07:34:09 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/10 07:10:59 | 000,040,112 | —- | M] (AVAST Software) – C:\Windows\avastSS.scr
[2010/11/10 02:28:46 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2011/05/07 20:57:03 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 05:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/05/08 11:06:34 | 000,000,356 | -HS- | M] () – C:\Users\Todd\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-16 01:40:04

< End of report >


OTL Extras logfile created on: 6/16/2011 1:09:38 PM - Run 1
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Users\Todd\Downloads
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.50 Gb Total Physical Memory | 2.38 Gb Available Physical Memory | 68.17% Memory free
7.18 Gb Paging File | 6.09 Gb Available in Paging File | 84.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 173.71 Gb Total Space | 65.27 Gb Free Space | 37.57% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 3.25 Gb Free Space | 32.50% Space Free | Partition Type: NTFS
Drive G: | 698.64 Gb Total Space | 394.08 Gb Free Space | 56.41% Space Free | Partition Type: NTFS

Computer Name: TODD-PC | User Name: Todd | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{A87153D0-3C9E-4014-839A-7E39ED221363}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe |
"{B0C5E0C2-B97B-4694-9B7B-46DB5DB2DEB5}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{C695285E-5AD6-472F-8A7B-89E9BA4C6BF6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{D0B4B807-23CA-44FF-A3A9-DFB658FDB9A8}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C89F88B-5E13-42B4-9B7E-24867B4C1D9B}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{20955C07-3B8C-4FE7-A129-6663FC1A4DDF}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{28D15898-9948-4B97-8EEC-65EC716B6A6E}" = protocol=6 | dir=in | app=c:\users\todd\appdata\roaming\dropbox\bin\dropbox.exe |
"{2FF484D4-8581-473D-ADFB-FC47B8303B84}" = protocol=6 | dir=in | app=c:\windows\system32\dlcjcoms.exe |
"{31717F5D-E366-421D-96B2-2049D5861506}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{36367E6E-9CA0-4502-93EF-42937B692162}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{3960E40A-97D6-4AEE-A76C-05A0D7C427EC}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{47AFDBE0-BFD2-41BD-92FB-4DF4BF16D085}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{7FA40A0A-70F9-4EF6-8625-C3C939837AC9}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{8E265904-CB17-4ED2-9591-F9C88D789596}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8EE015E1-8EF0-404C-9E88-B67F747FCD18}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{97088965-9A78-4F7A-ADE5-EFECE43127B9}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{9BA1DF5C-0395-4FF5-94D5-8DC00C05C049}" = protocol=17 | dir=in | app=c:\windows\system32\dlcjcoms.exe |
"{B4AF6D81-38D8-4755-B1BD-D2E3E49E7870}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{C47FE9E2-8107-4602-BBC5-487D7D8403C9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C7EBBA22-58C5-4AE8-8245-7F4C7CFC4893}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{DF32E39D-9211-4B70-A115-B2C042BA2184}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{E90261F2-5F99-42FF-A5AA-AB3CBC009EF4}" = dir=in | app=c:\program files\dell\mediadirect\pcmservice.exe |
"{F44892DD-D986-445F-8438-879DC35F5B7C}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{F7AB97B8-047C-4097-85A4-0159086499D1}" = protocol=17 | dir=in | app=c:\users\todd\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{3B5C5243-5968-431C-8E13-137FAD8DC710}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"TCP Query User{4EB58C26-A0C0-4084-BC14-50DFE788C51B}C:\users\todd\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\todd\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{89E0C4E7-C159-4A9F-AFC0-D843D5A265DA}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"TCP Query User{D4C3D156-9724-4144-B02D-D4D2061FA154}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe |
"UDP Query User{2C188223-AB03-4578-8C59-31BE3A3DEBA1}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"UDP Query User{4B6644EC-B390-428F-AA9C-76FB2AD14FC4}C:\users\todd\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\todd\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{80FFA18D-5CF1-4C10-9239-B8D5AA9B01C9}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"UDP Query User{FF01C755-B3AA-4166-8580-00A9B9277F11}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0090A87C-3E0E-43D4-AA71-A71B06563A4A}" = Dell Support Center
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = QualxServ Service Agreement
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}" = Live! Cam Avatar v1.0
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java™ 6 Update 25
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{294BF709-D758-4363-8D75-01479AD20927}" = Windows Live Family Safety
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E2C691B-B7E6-4053-B5C3-94B8BC407E7A}" = Adobe Premiere Elements 4.0
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{48D66137-C7A6-4890-8316-534CFF3688EA}" = Garmin City Navigator North America NT 2012.10 Update
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED}" = Dell DataSafe Online
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{53C6D09E-EAB6-49E5-BA4C-BA7FF13830FB}" = Sound Blaster Audigy ADVANCED MB
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-007F-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A13E07E1-A423-44FB-9DEE-B24C75C1BAF2}" = WIDCOMM Bluetooth Software 6.0.1.3100
"{A2289997-10A3-48F2-AA03-99180D761661}" = Fingerprint Reader Suite 5.6
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.0)
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C4972073-2BFE-475D-8441-564EA97DA161}" = QuickSet
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C897FCB3-2F8B-4185-8035-79E2AF3A92A4}" = iTunes
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D17111CB-C992-42A9-9D56-C19395102AAA}" = Garmin WebUpdater
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D7769185-9A7C-48D4-8874-5388743A1DE2}" = Music, Photos & Videos Launcher
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{F54AC413-D2C6-4A24-B324-370C223C6250}" = Adobe Photoshop Elements 6.0
"{F85C7118-F3DC-4ED9-AB27-3E7931EA3D88}" = Adobe Premiere Elements 4.0 Templates
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 6" = Adobe Photoshop Elements 6.0
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Advanced Video FX Engine" = Advanced Video FX Engine
"avast" = avast! Free Antivirus
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"CCleaner" = CCleaner
"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)
"Dell Support Center" = Dell Support Center
"Dell Webcam Center" = Dell Webcam Center
"Dell Webcam Manager" = Dell Webcam Manager
"LastFM_is1" = Last.fm 1.5.4.27091
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 4.0.1 (x86 en-US)" = Mozilla Firefox 4.0.1 (x86 en-US)
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"PremElem40" = Adobe Premiere Elements 4.0
"PremElem40Templates" = Adobe Premiere Elements 4.0 Templates
"RealPlayer 12.0" = RealPlayer
"UltSounds" = Windows Sound Schemes
"UltSounds2" = Ultimate Extras sounds from Microsoft® Tinker™
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.10
"Winamp" = Winamp
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.00 (32-bit)
"Xvid Video Codec 1.3.1" = Xvid Video Codec
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Winamp Detect" = Winamp Detector Plug-in

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/11/2011 8:59:55 AM | Computer Name = Todd-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 6/11/2011 9:03:39 AM | Computer Name = Todd-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 6/11/2011 9:03:40 AM | Computer Name = Todd-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 6/11/2011 9:03:40 AM | Computer Name = Todd-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 6/11/2011 9:03:40 AM | Computer Name = Todd-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 6/11/2011 9:03:40 AM | Computer Name = Todd-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 6/11/2011 9:03:40 AM | Computer Name = Todd-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 6/11/2011 9:03:40 AM | Computer Name = Todd-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 6/11/2011 9:07:54 AM | Computer Name = Todd-PC | Source = EventSystem | ID = 4621
Description =

Error - 6/11/2011 9:08:01 AM | Computer Name = Todd-PC | Source = Windows Search Service | ID = 3024
Description =

[ Broadcom Wireless LAN Events ]
Error - 5/8/2011 8:42:15 AM | Computer Name = Todd-PC | Source = WLAN-Tray | ID = 0
Description = 07:42:14, Sun, May 08, 11 Error - Unable to gain access to user store


Error - 5/27/2011 1:12:02 AM | Computer Name = Todd-PC | Source = WLAN-Tray | ID = 0
Description = 00:12:00, Fri, May 27, 11 Error - Unable to gain access to user store


[ System Events ]
Error - 6/12/2011 3:45:23 AM | Computer Name = Todd-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/15/2011 9:44:08 PM | Computer Name = Todd-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/15/2011 9:44:08 PM | Computer Name = Todd-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/15/2011 9:54:45 PM | Computer Name = Todd-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/15/2011 9:54:45 PM | Computer Name = Todd-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/15/2011 10:00:27 PM | Computer Name = Todd-PC | Source = DCOM | ID = 10005
Description =

Error - 6/15/2011 10:00:27 PM | Computer Name = Todd-PC | Source = Service Control Manager | ID = 7009
Description =

Error - 6/15/2011 10:00:27 PM | Computer Name = Todd-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/16/2011 2:01:04 PM | Computer Name = Todd-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/16/2011 2:01:04 PM | Computer Name = Todd-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >
Hi

Please do the following:

Scan With RootKitUnHooker

  • Please Download Rootkit Unhooker and save it to your desktop.
  • Now double-click on RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers and Stealth
  • Uncheck the rest. then click OK
  • When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  • Wait till the scanner has finished and then click File > Save Report.
  • Save the report somewhere where you can find it. Click Close.
  • Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"
Hello, Thanks for your help. Here is the log RkU Version: 3.8.389.593, Type LE (SR2) ============================================== OS Name: Windows Vista Version 6.0.6002 (Service Pack 2) Number of processors #2 ============================================== >Drivers ============================================== 0x8FE0F000 C:\Windows\system32\DRIVERS\nvlddmkm.sys 7622656 bytes (NVIDIA Corporation, NVIDIA Compatible Windows Vista Kernel Mode Driver, Version 156.63 ) 0x82618000 C:\Windows\system32\ntkrnlpa.exe 3907584 bytes (Microsoft Corporation, NT Kernel & System) 0x82618000 PnpManager 3907584 bytes 0x82618000 RAW 3907584 bytes 0x82618000 WMIxWDM 3907584 bytes 0x9B880000 Win32k 2113536 bytes 0x9B880000 C:\Windows\System32\win32k.sys 2113536 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0x8C209000 C:\Windows\System32\Drivers\Ntfs.sys 1114112 bytes (Microsoft Corporation, NT File System Driver) 0x8BE7D000 C:\Windows\system32\drivers\ndis.sys 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver) 0x8C001000 C:\Windows\System32\drivers\tcpip.sys 970752 bytes (Microsoft Corporation, TCP/IP Driver) 0x806D3000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Code Integrity Module) 0xAC02C000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver) 0x916CB000 C:\Windows\System32\Drivers\dump_iaStor.sys 815104 bytes 0x8BCA1000 C:\Windows\system32\drivers\iastor.sys 815104 bytes (Intel Corporation, Intel Matrix Storage Manager driver - ia32) 0xA220E000 C:\Windows\system32\drivers\spsys.sys 720896 bytes (Microsoft Corporation, security processor) 0x90554000 C:\Windows\System32\drivers\dxgkrnl.sys 655360 bytes (Microsoft Corporation, DirectX Graphics Kernel) 0x8BC01000 C:\Windows\system32\drivers\iastorv.sys 655360 bytes (Intel Corporation, Intel Matrix Storage Manager driver (base)) 0x90802000 C:\Windows\system32\DRIVERS\HDAudBus.sys 577536 bytes (Microsoft Corporation, High Definition Audio Bus Driver) 0x90E02000 C:\Windows\system32\DRIVERS\rdpdr.sys 561152 bytes (Microsoft Corporation, Microsoft RDP Device redirector) 0x908DB000 C:\Windows\system32\DRIVERS\bcmwl6.sys 548864 bytes (Broadcom Corporation, Broadcom 802.11 Network Adapter wireless driver) 0x8C109000 C:\Windows\System32\Drivers\bthport.sys 524288 bytes (Microsoft Corporation, Bluetooth Bus Driver) 0x8BA02000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic) 0x9EE6C000 C:\Windows\system32\drivers\btwaudio.sys 503808 bytes (Broadcom Corporation., Bluetooth Audio Device) 0x8BE0C000 C:\Windows\System32\Drivers\ksecdd.sys 462848 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0x91006000 C:\Windows\System32\Drivers\aswSnx.SYS 458752 bytes (AVAST Software, avast! Virtualization Driver) 0x80609000 C:\Windows\system32\mcupdate_GenuineIntel.dll 458752 bytes (Microsoft Corporation, Intel Microcode Update Library) 0xA2315000 C:\Windows\system32\drivers\HTTP.sys 446464 bytes (Microsoft Corporation, HTTP Protocol Stack) 0x9EE06000 C:\Windows\system32\drivers\btwavdt.sys 417792 bytes (Broadcom Corporation., Broadcom Bluetooth AVDT Service) 0x91602000 C:\Windows\system32\drivers\csc.sys 372736 bytes (Microsoft Corporation, Windows Client Side Caching Driver) 0x90F24000 C:\Windows\system32\drivers\stwrt.sys 348160 bytes (IDT, Inc., NDHF) 0x90A06000 C:\Windows\system32\DRIVERS\rixdptsk.sys 331776 bytes (REDC, RICOH XD SM Driver) 0x8C189000 C:\Windows\System32\DRIVERS\srv.sys 323584 bytes (Microsoft Corporation, Server driver) 0x9088F000 C:\Windows\system32\DRIVERS\yk60x86.sys 311296 bytes (Marvell, Miniport Driver for Marvell Yukon Ethernet Controller.) 0x91674000 C:\Windows\System32\Drivers\aswSP.SYS 303104 bytes (AVAST Software, avast! self protection module) 0x8BB34000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver) 0x91185000 C:\Windows\system32\drivers\afd.sys 294912 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0x8BA8B000 C:\Windows\system32\drivers\acpi.sys 286720 bytes (Microsoft Corporation, ACPI Driver for NT) 0x80692000 C:\Windows\system32\CLFS.SYS 266240 bytes (Microsoft Corporation, Common Log File System Driver) 0x90B06000 C:\Windows\system32\DRIVERS\storport.sys 266240 bytes (Microsoft Corporation, Microsoft Storage Port Driver) 0x8BBAA000 C:\Windows\system32\DRIVERS\USBPORT.SYS 253952 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0x807B3000 C:\Windows\system32\DRIVERS\rdbss.sys 245760 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0x8BFB3000 C:\Windows\system32\drivers\NETIO.SYS 241664 bytes (Microsoft Corporation, Network I/O Subsystem) 0x9112B000 C:\Windows\system32\DRIVERS\OEM02Dev.sys 237568 bytes (Creative Technology Ltd., Video Capture Device Driver) 0x9EF7F000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr) 0x8C319000 C:\Windows\system32\drivers\volsnap.sys 233472 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0x9EF1D000 C:\Windows\system32\drivers\aswMonFlt.sys 229376 bytes (AVAST Software, avast! File System Minifilter for Windows 2003/Vista) 0x90EDE000 C:\Windows\system32\DRIVERS\usbhub.sys 217088 bytes (Microsoft Corporation, Default Hub Driver for USB) 0x829D2000 ACPI_HAL 208896 bytes 0x829D2000 C:\Windows\system32\hal.dll 208896 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0x8BD8E000 C:\Windows\system32\drivers\fltmgr.sys 204800 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0x90FCB000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver) 0x90AD7000 C:\Windows\system32\DRIVERS\msiscsi.sys 192512 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver) 0x90F79000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0x90A6A000 C:\Windows\system32\DRIVERS\Apfiltr.sys 180224 bytes (Alps Electric Co., Ltd., Alps Touch Pad Driver) 0x8BF88000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider) 0x90E9D000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library) 0xA22CE000 C:\Windows\system32\DRIVERS\nwifi.sys 172032 bytes (Microsoft Corporation, NativeWiFi Miniport Driver) 0x917CC000 C:\Windows\system32\DRIVERS\rfcomm.sys 167936 bytes (Microsoft Corporation, Bluetooth RFCOMM Driver) 0xAC004000 C:\Windows\System32\Drivers\fastfat.SYS 163840 bytes (Microsoft Corporation, Fast FAT File System Driver) 0x9EFD0000 C:\Windows\System32\DRIVERS\srv2.sys 163840 bytes (Microsoft Corporation, Smb 2.0 Server driver) 0x8C369000 C:\Windows\System32\drivers\ecache.sys 159744 bytes (Microsoft Corporation, Special Memory Device Cache) 0x8BAE2000 C:\Windows\system32\drivers\pci.sys 159744 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0x90FA6000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0x8C390000 C:\Windows\System32\DRIVERS\fvevol.sys 147456 bytes (Microsoft Corporation, BitLocker Drive Encryption Driver) 0x90B74000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0x8C3C5000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll) 0xA23CD000 C:\Windows\system32\drivers\mrxdav.sys 135168 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0x910A9000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver) 0x9EF60000 C:\Windows\system32\DRIVERS\mrxsmb.sys 126976 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0x8BD70000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension) 0xA2382000 C:\Windows\System32\DRIVERS\srvnet.sys 118784 bytes (Microsoft Corporation, Server Network driver) 0x8C0EE000 C:\Windows\System32\drivers\fwpkclnt.sys 110592 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API) 0x9EF02000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver) 0x909DD000 C:\Windows\system32\DRIVERS\bthpan.sys 106496 bytes (Microsoft Corporation, Bluetooth Personal Area Networking) 0x9097F000 C:\Windows\system32\DRIVERS\sdbus.sys 106496 bytes (Microsoft Corporation, SecureDigital Bus Driver) 0xA239F000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver) 0x90AAC000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0x9EFB8000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 98304 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector) 0x9165D000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Namespace Client Driver) 0x90B52000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0x910FC000 C:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver) 0xAC147000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver) 0x90BCF000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS Packet Scheduler) 0x91115000 C:\Windows\system32\DRIVERS\tdx.sys 90112 bytes (Microsoft Corporation, TDI Translation Driver) 0xA23B8000 C:\Windows\System32\drivers\mpsdrv.sys 86016 bytes (Microsoft Corporation, Microsoft Protection Service Driver) 0x90BBA000 C:\Windows\system32\DRIVERS\rassstp.sys 86016 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager) 0x911E9000 C:\Windows\system32\DRIVERS\USBSTOR.SYS 86016 bytes (Microsoft Corporation, USB Mass Storage Class Driver) 0xAC120000 C:\Windows\system32\DRIVERS\WUDFRd.sys 86016 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Reflector) 0x90BA6000 C:\Windows\system32\DRIVERS\raspptp.sys 81920 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0x909A8000 C:\Windows\system32\DRIVERS\rimsptsk.sys 81920 bytes (REDC, RICOH MS Driver) 0x91171000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver) 0x90A57000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042 Port Driver) 0xA2302000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6) 0x909CA000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0xAC135000 C:\Windows\system32\DRIVERS\WUDFPf.sys 73728 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver) 0x8C3B4000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver) 0x91792000 C:\Windows\System32\Drivers\dump_dumpfve.sys 69632 bytes 0x90F13000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy) 0x80679000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver) 0x8BDC0000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver) 0x90BE5000 C:\Windows\system32\DRIVERS\HIDCLASS.SYS 65536 bytes (Microsoft Corporation, Hid Class Library) 0xA22BE000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver) 0x8BB9A000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager) 0x90961000 C:\Windows\system32\DRIVERS\ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver) 0x90E8B000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Terminal Server Driver) 0x8C1EC000 C:\Windows\system32\DRIVERS\intelppm.sys 61440 bytes (Microsoft Corporation, Processor Device Driver) 0x9EEF3000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver) 0x8C35A000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0x8BB09000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver) 0x90B97000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0x90999000 C:\Windows\system32\DRIVERS\rimmptsk.sys 61440 bytes (REDC, RICOH SD Driver) 0x8BFEE000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0x8BB25000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver) 0x90971000 C:\Windows\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver) 0x9BAC0000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver) 0x909BC000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver) 0x910E5000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver) 0x8BB85000 C:\Windows\system32\DRIVERS\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0x917BF000 C:\Windows\System32\Drivers\BTHUSB.sys 53248 bytes (Microsoft Corporation, Bluetooth Miniport Driver) 0x916BE000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver) 0x90ED1000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator) 0x911CD000 C:\Windows\system32\DRIVERS\usbscan.sys 53248 bytes (Microsoft Corporation, USB Scanner Driver) 0x8BA7E000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR) 0xAC114000 C:\Windows\System32\drivers\tcpipreg.sys 49152 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver) 0x9109D000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0x905F4000 C:\Windows\System32\drivers\watchdog.sys 49152 bytes (Microsoft Corporation, Watchdog Driver) 0x90AA1000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Keyboard Class Driver) 0x90A96000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mouse Class Driver) 0x910DA000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver) 0x90B69000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0x90B47000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper) 0x8C1E1000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver) 0x8FE00000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0x91165000 C:\Windows\System32\Drivers\aswTdi.SYS 40960 bytes (AVAST Software, avast! TDI Filter Driver) 0x8BB1B000 C:\Windows\system32\DRIVERS\BATTC.SYS 40960 bytes (Microsoft Corporation, Battery Class Driver) 0x917F5000 C:\Windows\system32\DRIVERS\BthEnum.sys 40960 bytes (Microsoft Corporation, Bluetooth Bus Extender) 0x917B5000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver) 0x90EC7000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver) 0xA22F8000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver) 0x90BF5000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy) 0x8BDD0000 C:\Windows\System32\Drivers\PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP) 0xAC10A000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver) 0x917AB000 C:\Windows\System32\Drivers\tcusb.sys 40960 bytes (UPEK Inc., TouchChip USB Kernel Driver) 0x911DF000 C:\Windows\system32\DRIVERS\usbprint.sys 40960 bytes (Microsoft Corporation, USB Printer driver) 0xAC15F000 C:\Windows\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver) 0x8C3E6000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver) 0x91076000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver) 0x9108D000 C:\Windows\system32\DRIVERS\hidusb.sys 36864 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices) 0x9EEEA000 C:\Windows\system32\DRIVERS\kbdhid.sys 36864 bytes (Microsoft Corporation, HID Keyboard Filter Driver) 0x910F3000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0x9BAA0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver) 0x8C200000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver) 0x90ACE000 C:\Windows\system32\DRIVERS\wmiacpi.sys 36864 bytes (Microsoft Corporation, Windows Management Interface for ACPI) 0x8BAD1000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0x8BD68000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver) 0x8068A000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver) 0x917A3000 C:\Windows\system32\DRIVERS\mouhid.sys 32768 bytes (Microsoft Corporation, HID Mouse Filter Driver) 0x8BADA000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver) 0x910CA000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport) 0x910D2000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport) 0x8C352000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor) 0x91086000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver) 0x91096000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library) 0x8BB7E000 C:\Windows\system32\DRIVERS\intelide.sys 28672 bytes (Microsoft Corporation, Intel PCI IDE Driver) 0x80602000 C:\Windows\system32\kdcom.dll 28672 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0x9107F000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver) 0x8BB93000 C:\Windows\system32\drivers\pciide.sys 28672 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver) 0x90AC4000 C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter) 0x911DA000 C:\Windows\System32\Drivers\aswRdr.SYS 20480 bytes (AVAST Software, avast! TDI RDR Driver) 0x90ACA000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver) 0x9EF55000 C:\Windows\System32\Drivers\aswFsBlk.SYS 12288 bytes (AVAST Software, avast! File System Access Blocking Driver) 0x9EEE7000 C:\Windows\system32\DRIVERS\btwrchid.sys 12288 bytes (Broadcom Corporation., Bluetooth Remote Control HID Minidriver) 0x8BB18000 C:\Windows\system32\DRIVERS\compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver) 0x9116F000 C:\Windows\system32\DRIVERS\OEM02Vfx.sys 8192 bytes (EyePower Games Pte. Ltd., Advanced Video FX Filter Driver (Win2K based)) 0x90E9B000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0x91113000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) ============================================== >Stealth ==============================================
Hi,

Please do the following

Refer to the ComboFix User's Guide

  • Download ComboFix from one of these locations:

    Link 1
    Link 2

    * IMPORTANT !!! Place ComboFix.exe on your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.


    You can get help on disabling your protection programs here
  • Double click on ComboFix.exe & follow the prompts.
  • Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  • When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


    ———————————————————————————————
  • Ensure your AntiVirus and AntiSpyware applications are re-enabled.

    ———————————————————————————————
ComboFix log

I did not remove combo fix yet…should I now??

ComboFix 11-06-17.04 - Todd 06/18/2011 17:17:31.1.2 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.1.1033.18.3581.2299 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\PCDr\5830\Downloads\3972fea3-214c-4935-a7d1-96bf66115683.dll
c:\programdata\PCDr\5830\Downloads\493f295d-1a46-46f6-926c-63b474cedab4.dll
c:\programdata\PCDr\5830\Downloads\6cf47205-6796-460b-806d-8f5f1a1f6b2e.dll
c:\programdata\PCDr\5830\Downloads\b2ed8d53-41ce-48e6-b4ac-8b8e5e1a4fdf.dll
c:\programdata\PCDr\5830\Downloads\fa623e3f-2030-4fff-ab0e-99695f323f7f.dll
G:\Autorun.inf
.
.
((((((((((((((((((((((((( Files Created from 2011-05-18 to 2011-06-18 )))))))))))))))))))))))))))))))
.
.
2011-06-18 22:24 . 2011-06-18 22:27 ——– d—–w- c:\users\Todd\AppData\Local\temp
2011-06-18 22:24 . 2011-06-18 22:24 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-06-18 17:35 . 2011-06-18 17:36 ——– d—–w- c:\users\Todd\AppData\Local\{ADC54361-6674-4AEF-B0C1-C0B5E24B5099}
2011-06-18 04:51 . 2011-06-18 04:52 ——– d—–w- c:\users\Todd\AppData\Local\{1BDF01FE-1E10-4157-B1F0-369156123BB1}
2011-06-17 23:57 . 2010-04-05 20:00 221568 —-a-w- c:\windows\system32\drivers\netio.sys
2011-06-17 23:46 . 2011-06-17 23:46 ——– d—–w- c:\users\Todd\AppData\Local\Microsoft Corporation
2011-06-17 17:09 . 2011-06-17 17:09 ——– d—–w- c:\program files\Common Files\Java
2011-06-17 16:50 . 2011-06-17 16:51 ——– d—–w- c:\users\Todd\AppData\Local\{726C85C3-848A-4A4F-8A6D-715FB8995191}
2011-06-17 16:06 . 2011-06-17 16:06 ——– d—–w- c:\users\Todd\AppData\Local\{828F2DD2-7D23-4B82-B09C-2C6A08E83C20}
2011-06-17 15:14 . 2011-06-17 15:14 ——– d—–w- c:\users\Todd\AppData\Local\{8C474B25-92CE-45BB-9C5D-AE2B2F05EB70}
2011-06-17 07:20 . 2011-05-09 20:46 6962000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{15542A3F-14C7-486C-A7BB-C1D33E7E3D91}\mpengine.dll
2011-06-17 02:22 . 2011-06-17 02:22 ——– d—–w- c:\users\Todd\AppData\Local\{8F7FAA29-DD8B-4DE9-AE26-B756E7F05868}
2011-06-17 01:34 . 2011-06-17 01:34 ——– d—–w- c:\users\Todd\AppData\Local\{601093D7-E095-4565-BB41-0A61935AF404}
2011-06-17 00:53 . 2011-06-17 00:53 ——– d—–w- c:\users\Todd\AppData\Local\{450C97F6-9E12-4142-ACAC-A4F3770919DC}
2011-06-16 11:59 . 2011-06-16 12:00 ——– d—–w- c:\users\Todd\AppData\Local\{D16677B5-A0D4-4C62-96B7-3E9F92134205}
2011-06-16 11:32 . 2011-06-16 11:32 ——– d—–w- c:\users\Todd\AppData\Local\{91A01E7F-1DF2-4811-B3D6-50CC8BE059BA}
2011-06-16 08:57 . 2011-06-16 08:57 ——– d—–w- c:\users\Todd\AppData\Local\{4BD24D39-4FA5-4CBC-A3DD-463A1660F084}
2011-06-16 04:55 . 2011-06-16 04:55 ——– d—–w- c:\users\Todd\AppData\Local\{E681AB3C-F6FC-4691-96C9-48E1D0B9B04D}
2011-06-16 01:34 . 2011-04-25 15:29 141104 —-a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-06-16 01:34 . 2011-04-22 23:25 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2011-06-16 01:34 . 2011-04-22 23:35 1797632 —-a-w- c:\windows\system32\jscript9.dll
2011-06-16 00:37 . 2011-04-14 14:59 75264 —-a-w- c:\windows\system32\drivers\dfsc.sys
2011-06-16 00:37 . 2011-04-21 13:58 273408 —-a-w- c:\windows\system32\drivers\afd.sys
2011-06-16 00:37 . 2011-04-29 13:25 146432 —-a-w- c:\windows\system32\drivers\srv2.sys
2011-06-16 00:37 . 2011-04-29 13:25 102400 —-a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-16 00:37 . 2010-12-20 16:35 563712 —-a-w- c:\windows\system32\oleaut32.dll
2011-06-16 00:37 . 2011-05-02 17:16 739328 —-a-w- c:\windows\system32\inetcomm.dll
2011-06-16 00:37 . 2011-05-02 12:02 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-06-16 00:37 . 2011-04-29 13:24 214016 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-16 00:37 . 2011-04-29 13:24 79872 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-16 00:37 . 2011-04-29 13:24 106496 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-15 14:27 . 2011-06-15 14:28 ——– d—–w- c:\users\Todd\AppData\Local\{797924AD-3C95-47C5-83A7-D7E23456E289}
2011-06-15 07:25 . 2011-06-15 07:25 ——– d—–w- c:\users\Todd\AppData\Local\{7FB52A84-F200-4E20-A8BA-4E2A9F51D5EA}
2011-06-14 15:55 . 2011-06-14 15:55 ——– d—–w- c:\users\Todd\AppData\Local\{E79BBFBA-A92D-455F-B804-F7FFB8EC17CE}
2011-06-13 18:21 . 2011-06-13 18:22 ——– d—–w- c:\users\Todd\AppData\Local\{170433F5-1B27-4283-8982-974C06566495}
2011-06-13 04:55 . 2011-06-13 04:55 ——– d—–w- c:\users\Todd\AppData\Local\{F6D09DAB-FCC7-4EB6-B90E-63E033E7ACCB}
2011-06-12 12:27 . 2011-06-12 12:27 ——– d—–w- c:\users\Todd\AppData\Local\{CE63A178-41C2-42B4-99E0-CF8E3EDE04AA}
2011-06-12 07:13 . 2011-06-12 07:13 ——– d—–w- c:\users\Todd\AppData\Roaming\Reallusion
2011-06-12 07:13 . 2011-06-12 07:13 ——– d—–w- c:\users\Todd\AppData\Roaming\tmp
2011-06-11 15:47 . 2011-06-11 15:48 ——– d—–w- c:\users\Todd\AppData\Local\{6B287D40-2980-4930-9690-EC8BE224AD33}
2011-06-11 08:04 . 2011-06-11 08:04 ——– d—–w- c:\users\Todd\AppData\Local\Cooliris
2011-06-11 03:47 . 2011-06-11 03:47 ——– d—–w- c:\users\Todd\AppData\Local\{C295E4A2-2C84-4989-8287-75AAD32924A9}
2011-06-10 14:39 . 2011-06-10 14:40 ——– d—–w- c:\users\Todd\AppData\Local\{E9D5C691-669C-4751-BDB5-D688E4F939CA}
2011-06-10 11:21 . 2011-06-10 11:21 ——– d—–w- c:\users\Todd\AppData\Local\{9B7035A6-D721-4B40-B60F-449D1ADBBD0D}
2011-06-10 10:18 . 2011-06-18 10:26 ——– d—–w- c:\users\Todd\AppData\Local\Microsoft Games
2011-06-10 07:01 . 2011-06-10 07:01 ——– d—–w- c:\users\Todd\AppData\Local\{42E5B258-0E16-4826-9E5A-EFB855DD3B29}
2011-06-10 01:12 . 2011-06-10 01:15 ——– d—–w- c:\users\Todd\AppData\Roaming\CyberLink
2011-06-09 23:47 . 2011-06-09 23:47 ——– d—–w- c:\windows\system32\Adobe
2011-06-09 23:40 . 2011-06-09 23:40 ——– d—–w- c:\program files\iPod
2011-06-09 14:51 . 2011-06-09 14:51 ——– d—–w- c:\users\Todd\AppData\Local\{4ADD3B0A-D37C-484E-82B0-ECA643121CC3}
2011-06-08 19:02 . 2011-06-08 19:02 ——– d—–w- c:\users\Todd\AppData\Local\{21DE5A2A-194B-4A1A-91AB-5505C7DACE2A}
2011-06-08 18:37 . 2011-06-08 18:37 ——– d—–w- c:\program files\MSXML 4.0
2011-06-08 02:36 . 2011-06-11 13:11 ——– d—–w- c:\users\Todd\AppData\Local\PCM4Everio
2011-06-08 02:36 . 2006-06-04 20:48 82432 —-a-w- c:\windows\system32\msxml4r.dll
2011-06-08 02:36 . 2006-06-04 20:48 44544 —-a-w- c:\windows\system32\msxml4a.dll
2011-06-07 18:52 . 2011-05-23 09:52 153088 —-a-w- c:\windows\system32\xvid.ax
2011-06-07 18:52 . 2011-05-23 07:46 645632 —-a-w- c:\windows\system32\xvidcore.dll
2011-06-07 18:52 . 2011-05-30 13:42 240640 —-a-w- c:\windows\system32\xvidvfw.dll
2011-06-07 18:48 . 2011-06-07 18:48 ——– d—–w- c:\users\Todd\.bitrock
2011-06-07 18:47 . 2011-06-07 18:48 ——– d—–w- c:\users\Todd\AppData\Local\{07E62684-B29E-4E84-B7A7-4A6EDA561E5C}
2011-06-06 17:55 . 2011-06-06 17:55 183696 —-a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2011-06-06 12:41 . 2011-06-06 12:42 ——– d—–w- c:\users\Todd\AppData\Local\{8829C39D-2923-4B18-B671-D43CE71C60E7}
2011-06-05 18:20 . 2011-06-05 18:20 ——– d—–w- c:\users\Todd\AppData\Local\{23F7F2EA-9AC8-4D22-811F-BDD68530D42B}
2011-06-04 16:17 . 2011-06-04 16:17 ——– d—–w- c:\users\Todd\AppData\Local\{9006FD24-1B6A-401E-A646-140CF2860377}
2011-06-04 16:10 . 2011-06-04 16:10 ——– d—–w- c:\users\Todd\AppData\Local\{1CC3833C-AEA4-4198-9BF4-D172412760F4}
2011-06-01 13:41 . 2011-06-01 13:42 ——– d—–w- c:\users\Todd\AppData\Local\{9613DEC2-BCD4-4F53-8E62-383FCE51D2D1}
2011-05-29 23:24 . 2011-05-29 23:24 ——– d—–w- c:\users\Todd\AppData\Local\{E7F3B459-54B8-4385-81FF-270374B65E66}
2011-05-29 11:15 . 2011-05-29 11:15 ——– d—–w- c:\users\Todd\AppData\Local\{CDEC5B41-4361-4F88-A96E-9B8F8C89AE40}
2011-05-29 09:37 . 2011-05-29 09:37 ——– d—–w- c:\users\Todd\AppData\Local\{0816295A-A8A5-484E-B999-6191190A657A}
2011-05-29 08:19 . 2011-05-29 08:19 ——– d—–w- c:\users\Todd\AppData\Local\{0F396FDA-C4BE-4623-88D0-BAA5828D29AE}
2011-05-28 23:14 . 2008-05-13 22:23 417792 —-a-w- c:\program files\Windows Media Player\Plugins\wmp_scrobbler.dll
2011-05-28 20:32 . 2011-05-28 20:32 ——– d—–w- c:\programdata\Last.fm
2011-05-28 20:31 . 2011-06-11 00:39 ——– d—–w- c:\users\Todd\AppData\Local\Last.fm
2011-05-28 20:31 . 2011-05-28 20:31 ——– d—–w- c:\program files\Last.fm
2011-05-28 20:03 . 2011-05-28 20:04 ——– d—–w- c:\users\Todd\AppData\Local\{20043235-4EC5-427E-8647-0F626B153FC7}
2011-05-28 05:45 . 2011-05-28 05:46 ——– d—–w- c:\users\Todd\AppData\Local\{52754232-EA16-4008-BD64-7B38D68C9828}
2011-05-27 23:48 . 2011-05-27 23:48 ——– d—–w- c:\users\Todd\AppData\Local\{63C1AD91-668E-4771-8EF9-953E3EFFFF01}
2011-05-27 11:29 . 2011-05-27 11:29 ——– d—–w- c:\users\Todd\AppData\Local\{E432CC7D-8E0F-4BBF-836C-64223999B733}
2011-05-26 21:35 . 2011-05-26 21:36 ——– d—–w- c:\users\Todd\AppData\Local\{858D73BF-DA6B-47B3-82AF-589ED32151EA}
2011-05-26 08:41 . 2011-05-26 08:42 ——– d—–w- c:\users\Todd\AppData\Local\{D2371CA3-6E6F-4BE5-B807-5BC940992CF2}
2011-05-25 20:21 . 2011-05-25 20:22 ——– d—–w- c:\users\Todd\AppData\Local\{03251BF4-CAE1-4FC8-BFF4-400E9C7F506D}
2011-05-25 19:18 . 2011-05-25 19:18 ——– d—–w- c:\users\Todd\AppData\Local\{D1EA8C20-6AA3-47BA-99F2-C5D4C300706C}
2011-05-25 19:16 . 2011-05-25 19:16 ——– d—–w- c:\users\Todd\AppData\Roaming\Dell
2011-05-25 19:14 . 2011-06-09 14:00 ——– d—–w- c:\program files\Dell Support Center
2011-05-25 18:37 . 2011-05-25 18:37 ——– d—–w- c:\users\Todd\AppData\Local\{63BAEDB1-3F70-422C-9A9B-5321CF2D3BEB}
2011-05-25 18:16 . 2011-05-25 18:16 ——– d—–w- c:\users\Todd\AppData\Local\{D9B78F50-29A3-4F00-A342-88F7DAAFC949}
2011-05-25 16:50 . 2011-05-25 16:50 ——– d—–w- c:\users\Todd\AppData\Local\{1EEBA0E1-4F07-4FEC-A49A-772872E90FF2}
2011-05-25 13:26 . 2011-06-07 18:52 ——– d—–w- c:\program files\Xvid
2011-05-25 10:44 . 2011-05-25 10:44 ——– d—–w- c:\program files\MSECache
2011-05-25 06:23 . 2011-05-25 06:23 ——– d—–w- c:\programdata\Garmin
2011-05-25 06:08 . 2011-05-25 06:08 ——– d—–w- c:\program files\DIFX
2011-05-25 06:08 . 2011-05-25 06:26 ——– d—–w- c:\program files\Garmin
2011-05-25 04:58 . 2011-05-25 18:41 ——– d—–w- c:\users\Todd\AppData\Roaming\GARMIN
2011-05-25 02:45 . 2011-05-25 02:46 ——– d—–w- c:\users\Todd\AppData\Local\{21E5BC7C-AD95-49FF-AA69-FB29B0C13A86}
2011-05-25 02:06 . 2011-05-25 02:06 ——– d—–w- c:\users\Todd\AppData\Local\{856F57C0-8240-44EC-B903-7B8DC92C555E}
2011-05-24 14:00 . 2011-05-24 14:01 ——– d—–w- c:\users\Todd\AppData\Local\{DA0DAF46-68E6-4826-875D-D3B016E461DA}
2011-05-24 10:42 . 2011-05-24 10:42 ——– d—–w- c:\users\Todd\AppData\Local\{DA505049-9922-4A66-8EAC-B4127B120335}
2011-05-24 03:56 . 2011-05-24 03:56 ——– d—–w- c:\users\Todd\AppData\Local\{F7A98C98-4B00-4523-8795-2292E6759433}
2011-05-24 02:12 . 2011-05-24 02:12 ——– d—–w- c:\users\Todd\AppData\Local\{140C70F9-028C-4098-9E27-2E28205A95ED}
2011-05-23 23:10 . 2011-05-23 23:10 ——– d—–w- c:\users\Todd\AppData\Local\{79950582-69F9-44FA-AFDB-2190217D6D00}
2011-05-23 09:56 . 2011-05-23 09:56 ——– d—–w- c:\users\Todd\AppData\Local\{790B5C29-DC2B-44C9-B2ED-0E367D4280A9}
2011-05-22 21:19 . 2011-05-22 21:20 ——– d—–w- c:\users\Todd\AppData\Local\{8119165A-6275-4AA9-850D-3DF407325A73}
2011-05-22 18:47 . 2011-05-22 18:47 ——– d—–w- c:\users\Todd\AppData\Local\{B23FFCF7-F611-48F7-AB98-136013CACC3F}
2011-05-22 04:17 . 2011-05-22 04:17 ——– d—–w- c:\users\Todd\AppData\Local\{F79B0CD8-AD33-4562-8DD1-8C9F3E8B8F07}
2011-05-21 20:29 . 2011-06-18 17:21 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-21 14:35 . 2011-05-21 14:36 ——– d—–w- c:\users\Todd\AppData\Local\{815C22CF-4144-4408-8846-7EBB05448EB7}
2011-05-20 21:25 . 2011-05-20 21:25 ——– d—–w- c:\users\Todd\AppData\Local\{338FEF26-2075-412F-A053-BA5091228320}
2011-05-20 08:47 . 2011-05-20 08:48 ——– d—–w- c:\users\Todd\AppData\Local\{B55FFD4C-B246-4751-8A6D-2FB257A6CE23}
2011-05-20 03:09 . 2011-05-20 03:09 ——– d—–w- c:\users\Todd\AppData\Local\{85460FC5-4E98-4448-B26B-309ACB4E7D97}
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-12 17:29 . 2011-05-12 17:29 652296 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsTemplate\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2011-05-12 17:29 . 2011-05-12 17:29 749832 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-05-12 17:28 . 2011-05-12 17:28 416128 —-a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll
2011-05-10 12:10 . 2011-05-07 19:06 40112 —-a-w- c:\windows\avastSS.scr
2011-05-10 12:10 . 2011-05-07 19:06 199304 —-a-w- c:\windows\system32\aswBoot.exe
2011-05-10 12:03 . 2011-05-07 19:06 441176 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-10 12:03 . 2011-05-07 19:06 307928 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-10 12:02 . 2011-05-07 19:06 49240 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-10 11:59 . 2011-05-07 19:06 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-10 11:59 . 2011-05-07 19:06 53592 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-05-10 11:59 . 2011-05-07 19:06 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-05-08 13:44 . 2010-06-24 16:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-05-08 12:26 . 2011-05-08 12:26 86528 —-a-w- c:\windows\system32\iesysprep.dll
2011-05-08 12:26 . 2011-05-08 12:26 76800 —-a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-05-08 12:26 . 2011-05-08 12:26 74752 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-05-08 12:26 . 2011-05-08 12:26 63488 —-a-w- c:\windows\system32\tdc.ocx
2011-05-08 12:26 . 2011-05-08 12:26 48640 —-a-w- c:\windows\system32\mshtmler.dll
2011-05-08 12:26 . 2011-05-08 12:26 161792 —-a-w- c:\windows\system32\msls31.dll
2011-05-08 12:26 . 2011-05-08 12:26 1126912 —-a-w- c:\windows\system32\wininet.dll
2011-05-08 12:26 . 2011-05-08 12:26 74752 —-a-w- c:\windows\system32\iesetup.dll
2011-05-08 12:26 . 2011-05-08 12:26 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-05-08 12:26 . 2011-05-08 12:26 367104 —-a-w- c:\windows\system32\html.iec
2011-05-08 12:26 . 2011-05-08 12:26 23552 —-a-w- c:\windows\system32\licmgr10.dll
2011-05-08 12:26 . 2011-05-08 12:26 152064 —-a-w- c:\windows\system32\wextract.exe
2011-05-08 12:26 . 2011-05-08 12:26 150528 —-a-w- c:\windows\system32\iexpress.exe
2011-05-08 12:26 . 2011-05-08 12:26 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2011-05-08 12:26 . 2011-05-08 12:26 1427456 —-a-w- c:\windows\system32\inetcpl.cpl
2011-05-08 12:26 . 2011-05-08 12:26 35840 —-a-w- c:\windows\system32\imgutil.dll
2011-05-08 12:26 . 2011-05-08 12:26 11776 —-a-w- c:\windows\system32\mshta.exe
2011-05-08 12:26 . 2011-05-08 12:26 110592 —-a-w- c:\windows\system32\IEAdvpack.dll
2011-05-08 12:26 . 2011-05-08 12:26 101888 —-a-w- c:\windows\system32\admparse.dll
2011-05-07 23:33 . 2006-11-02 10:32 101888 —-a-w- c:\windows\system32\ifxcardm.dll
2011-05-07 23:33 . 2006-11-02 10:32 82432 —-a-w- c:\windows\system32\axaltocm.dll
2011-05-07 21:57 . 2011-05-07 21:57 377344 —-a-w- c:\windows\system32\winhttp.dll
2011-05-07 21:55 . 2011-05-07 21:55 6656 —-a-w- c:\windows\system32\kbd106n.dll
2011-05-07 21:54 . 2011-05-07 21:54 36864 —-a-w- c:\windows\system32\drivers\en-US\http.sys.mui
2011-05-07 21:11 . 2011-05-07 21:11 69632 —-a-w- c:\windows\system32\Mpeg2Data.ax
2011-05-07 21:09 . 2011-05-07 21:09 623616 —-a-w- c:\windows\system32\localspl.dll
2011-05-07 21:07 . 2011-05-07 21:07 1808896 —-a-w- c:\windows\system32\NlsLexicons0046.dll
2011-05-07 21:07 . 2011-05-07 21:07 1793536 —-a-w- c:\windows\system32\NlsLexicons0045.dll
2011-05-07 21:07 . 2011-05-07 21:07 1558016 —-a-w- c:\windows\system32\NlsLexicons0049.dll
2011-05-07 21:07 . 2011-05-07 21:07 1411072 —-a-w- c:\windows\system32\NlsLexicons0047.dll
2011-05-07 21:07 . 2011-05-07 21:07 1236992 —-a-w- c:\windows\system32\NlsLexicons0020.dll
2011-05-07 21:07 . 2011-05-07 21:07 1782272 —-a-w- c:\windows\system32\NlsLexicons0039.dll
2011-05-07 21:07 . 2011-05-07 21:07 5499904 —-a-w- c:\windows\system32\NlsLexicons0022.dll
2011-05-07 21:07 . 2011-05-07 21:07 2136064 —-a-w- c:\windows\system32\NlsLexicons0021.dll
2011-05-07 21:07 . 2011-05-07 21:07 7964672 —-a-w- c:\windows\system32\NlsLexicons0024.dll
2011-05-07 21:07 . 2011-05-07 21:07 5791232 —-a-w- c:\windows\system32\NlsLexicons0026.dll
2011-05-07 21:07 . 2011-05-07 21:07 6224896 —-a-w- c:\windows\system32\NlsLexicons0027.dll
2011-05-07 21:07 . 2011-05-07 21:07 4175872 —-a-w- c:\windows\system32\NlsLexicons0010.dll
2011-05-07 21:07 . 2011-05-07 21:07 2466816 —-a-w- c:\windows\system32\NlsLexicons0011.dll
2011-05-07 21:07 . 2011-05-07 21:07 4981248 —-a-w- c:\windows\system32\NlsLexicons0013.dll
2011-05-07 21:07 . 2011-05-07 21:07 3331072 —-a-w- c:\windows\system32\NlsLexicons0018.dll
2011-05-07 21:07 . 2011-05-07 21:07 6781440 —-a-w- c:\windows\system32\NlsLexicons0019.dll
2011-05-07 21:07 . 2011-05-07 21:07 4164096 —-a-w- c:\windows\system32\NlsLexicons0002.dll
2011-05-07 21:07 . 2011-05-07 21:07 1452544 —-a-w- c:\windows\system32\NlsLexicons0003.dll
2011-05-07 21:07 . 2011-05-07 21:07 11722752 —-a-w- c:\windows\system32\NlsLexicons0001.dll
2011-05-07 21:07 . 2011-05-07 21:07 3419136 —-a-w- c:\windows\system32\NlsLexicons004a.dll
2011-05-07 21:07 . 2011-05-07 21:07 4093440 —-a-w- c:\windows\system32\NlsLexicons004c.dll
2011-05-07 21:07 . 2011-05-07 21:07 1972736 —-a-w- c:\windows\system32\NlsLexicons004e.dll
2011-05-07 21:07 . 2011-05-07 21:07 1702912 —-a-w- c:\windows\system32\NlsLexicons004b.dll
2011-05-07 21:07 . 2011-05-07 21:07 4045824 —-a-w- c:\windows\system32\NlsLexicons003e.dll
2011-05-07 21:07 . 2011-05-07 21:07 6585856 —-a-w- c:\windows\system32\NlsLexicons001b.dll
2011-05-07 21:07 . 2011-05-07 21:07 6346240 —-a-w- c:\windows\system32\NlsLexicons001d.dll
2011-05-07 21:07 . 2011-05-07 21:07 6014976 —-a-w- c:\windows\system32\NlsLexicons001a.dll
2011-05-07 21:07 . 2011-05-07 21:07 4096 —-a-w- c:\windows\system32\NlsLexicons002a.dll
2011-05-07 21:07 . 2011-05-07 21:07 9892864 —-a-w- c:\windows\system32\NlsLexicons000a.dll
2011-05-07 21:07 . 2011-05-07 21:07 6237696 —-a-w- c:\windows\system32\NlsLexicons000c.dll
2011-05-07 21:07 . 2011-05-07 21:07 1722368 —-a-w- c:\windows\system32\NlsLexicons000d.dll
2011-05-07 21:07 . 2011-05-07 21:07 5654528 —-a-w- c:\windows\system32\NlsLexicons000f.dll
2011-05-07 21:07 . 2011-05-07 21:07 5090816 —-a-w- c:\windows\system32\NlsLexicons0416.dll
2011-05-07 21:07 . 2011-05-07 21:07 5031936 —-a-w- c:\windows\system32\NlsLexicons0816.dll
2011-05-07 21:07 . 2011-05-07 21:07 4616192 —-a-w- c:\windows\system32\NlsLexicons0414.dll
2011-05-07 21:07 . 2011-05-07 21:07 7042560 —-a-w- c:\windows\system32\NlsLexicons081a.dll
2011-05-07 21:07 . 2011-05-07 21:07 5071872 —-a-w- c:\windows\system32\NlsModels0011.dll
2011-05-07 21:07 . 2011-05-07 21:07 3104768 —-a-w- c:\windows\system32\NlsData0045.dll
2011-05-07 21:07 . 2011-05-07 21:07 3104768 —-a-w- c:\windows\system32\NlsData0046.dll
2011-05-07 21:07 . 2011-05-07 21:07 3104768 —-a-w- c:\windows\system32\NlsData0049.dll
2011-05-07 21:07 . 2011-05-07 21:07 3104768 —-a-w- c:\windows\system32\NlsData0047.dll
2011-05-07 21:07 . 2011-05-07 21:07 3104768 —-a-w- c:\windows\system32\NlsData0039.dll
2011-05-07 21:07 . 2011-05-07 21:07 3104768 —-a-w- c:\windows\system32\NlsData0020.dll
2011-05-07 21:07 . 2011-05-07 21:07 1801216 —-a-w- c:\windows\system32\NlsData0021.dll
2011-05-07 21:07 . 2011-05-07 21:07 4495360 —-a-w- c:\windows\system32\NlsData0010.dll
2011-05-07 21:07 . 2011-05-07 21:07 1966592 —-a-w- c:\windows\system32\NlsData0027.dll
2011-05-07 21:07 . 2011-05-07 21:07 1965056 —-a-w- c:\windows\system32\NlsData0026.dll
2011-05-07 21:07 . 2011-05-07 21:07 1965056 —-a-w- c:\windows\system32\NlsData0024.dll
2011-05-07 21:07 . 2011-05-07 21:07 1801216 —-a-w- c:\windows\system32\NlsData0022.dll
2011-05-07 21:07 . 2011-05-07 21:07 2657280 —-a-w- c:\windows\system32\NlsData0011.dll
2011-05-07 21:07 . 2011-05-07 21:07 4497408 —-a-w- c:\windows\system32\NlsData0019.dll
2011-05-07 21:07 . 2011-05-07 21:07 3466752 —-a-w- c:\windows\system32\NlsData0013.dll
2011-05-07 21:07 . 2011-05-07 21:07 1965056 —-a-w- c:\windows\system32\NlsData0018.dll
2011-05-07 21:07 . 2011-05-07 21:07 1523712 —-a-w- c:\windows\system32\NlsData0000.dll
2011-05-07 21:07 . 2011-05-07 21:07 2599936 —-a-w- c:\windows\system32\NlsData0001.dll
2011-05-07 21:07 . 2011-05-07 21:07 2243072 —-a-w- c:\windows\system32\NlsData0007.dll
2011-05-07 21:07 . 2011-05-07 21:07 1965056 —-a-w- c:\windows\system32\NlsData0003.dll
2011-05-07 21:07 . 2011-05-07 21:07 1965056 —-a-w- c:\windows\system32\NlsData0002.dll
2011-05-07 21:07 . 2011-05-07 21:07 4875776 —-a-w- c:\windows\system32\NlsData0009.dll
2011-05-07 21:07 . 2011-05-07 21:07 3104768 —-a-w- c:\windows\system32\NlsData004e.dll
2011-05-07 21:07 . 2011-05-07 21:07 3104768 —-a-w- c:\windows\system32\NlsData004c.dll
2011-05-07 21:07 . 2011-05-07 21:07 3104768 —-a-w- c:\windows\system32\NlsData004b.dll
2011-04-14 16:26 . 2011-05-30 00:08 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 12:10 122512 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Todd\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Todd\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Todd\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-04-17 04:13 721408 —-a-w- c:\program files\Fingerprint Reader Suite\farchns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-04-17 04:13 721408 —-a-w- c:\program files\Fingerprint Reader Suite\farchns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"OfficeSyncProcess"="c:\program files\Microsoft Office\Office14\MSOSYNC.EXE" [2010-03-16 718208]
"Xvid"="c:\program files\Xvid\CheckUpdate.exe" [2011-01-17 8192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-09-07 159744]
"VolPanel"="c:\program files\Creative\SBAudigy\Volume Panel\VolPanlu.exe" [2006-11-27 180224]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-21 1548288]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-12-03 405504]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-09-28 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-28 8497696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-28 81920]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2007-09-28 81920]
"DLCJCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\DLCJtime.dll" [2006-10-20 73728]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-08-28 36864]
.
c:\users\Todd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Todd\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-3 703280]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2007-9-7 1180952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-04-17 04:04 86528 —-a-w- c:\windows\System32\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 17:55 937920 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DELL Webcam Manager]
2007-07-27 21:43 118784 —-a-w- c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-06-07 22:51 421160 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
2007-11-01 20:39 189736 —-a-w- c:\program files\Dell\MediaDirect\PCMService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSQLLauncher]
2007-04-17 03:50 49168 —-a-w- c:\program files\Fingerprint Reader Suite\launcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-05-11 01:40 273544 —-a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 04:38 1008184 —-a-w- c:\program files\Windows Defender\MSASCui.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4640000]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 iaNvStor;Intel® Turbo Memory Controller;c:\windows\system32\drivers\ianvstor.sys [2007-09-07 209408]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-12-03 73728]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-05-10 53592]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
2008-04-11 22:23 38400 —-a-w- c:\windows\System32\SoundSchemes.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
2008-08-28 15:50 30720 —-a-w- c:\windows\System32\soundschemes2.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-18 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-05-16 22:16]
.
2011-06-18 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1143999259-2469995957-2725660785-1000.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 15:47]
.
2011-06-18 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-05-16 22:16]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = [removed] [removed]
FF - ProfilePath - c:\users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\m9k96j9m.default\
FF - prefs.js: browser.startup.homepage - www.google.com
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-18 17:27
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCJCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\DLCJtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'Explorer.exe'(3928)
c:\users\Todd\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
c:\windows\system32\btncopy.dll
.
———————— Other Running Processes ————————
.
c:\program files\Fingerprint Reader Suite\upeksvr.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
c:\windows\system32\CTsvcCDA.exe
c:\windows\system32\dlcjcoms.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\windows\system32\STacSV.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\WUDFHost.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Completion time: 2011-06-18 17:34:18 - machine was rebooted
ComboFix-quarantined-files.txt 2011-06-18 22:34
.
Pre-Run: 75,719,196,672 bytes free
Post-Run: 75,333,640,192 bytes free
.
- - End Of File - - 28479413C76E89223D2169CFC4E5D846

I did not remove combo fix yet…should I now??

No not yet, there is a special clean up routine we perform at the end once you are totally clean.

Please do the following:

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.
  • Note: You will need to use Internet explorer for this scan
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish
Hello, Malwarebytes did not find anything Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Database version: 6892 Windows 6.0.6002 Service Pack 2 Internet Explorer 9.0.8112.16421 6/18/2011 8:28:01 PM mbam-log-2011-06-18 (20-28-01).txt Scan type: Quick scan Objects scanned: 159117 Time elapsed: 2 minute(s), 48 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Here is a trojan eset found G:\Lappy\Downloads\LGDrivers.exe Win32/Toolbar.Zugo application deleted - quarantined
Hello,
I used my laptop a lot last night and everything seemed OK. It is running faster and the cooling fan has not been running like crazy like it was before.
Everything is working good for me so far. The scan only made one log and it did not make an extra log

OTL logfile created on: 6/19/2011 8:59:54 AM - Run 2
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Users\Todd\Downloads
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.50 Gb Total Physical Memory | 2.26 Gb Available Physical Memory | 64.70% Memory free
7.19 Gb Paging File | 5.92 Gb Available in Paging File | 82.43% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 173.71 Gb Total Space | 69.69 Gb Free Space | 40.12% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 3.25 Gb Free Space | 32.50% Space Free | Partition Type: NTFS
Drive G: | 698.64 Gb Total Space | 394.08 Gb Free Space | 56.41% Space Free | Partition Type: NTFS

Computer Name: TODD-PC | User Name: Todd | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Todd\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Users\Todd\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
PRC - C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)
PRC - C:\Program Files\Fingerprint Reader Suite\upeksvr.exe (UPEK Inc.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
PRC - C:\Windows\System32\dlcjcoms.exe ( )
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - c:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)


========== Modules (SafeList) ==========

MOD - C:\Users\Todd\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\AVAST Software\Avast\snxhk.dll (AVAST Software)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter) – File not found
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (WAS) – C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (Microsoft SharePoint Workspace Audit Service) – C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (AppHostSvc) – C:\Windows\System32\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (Creative Labs Licensing Service) – C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (STacSV) – C:\Windows\System32\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) – C:\Windows\System32\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (AdobeActiveFileMonitor6.0) – C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (dlcj_device) – C:\Windows\System32\dlcjcoms.exe ( )


========== Driver Services (SafeList) ==========

DRV - (MBAMProtector) – C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (PCDSRVC{E9D79540-57D5953E-06020101}_0) – c:\Program Files\Dell Support Center\pcdsrvc.pkms (PC-Doctor, Inc.)
DRV - (aswSnx) – C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRdr) – C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMonFlt) – C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) – C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (OEM02Dev) – C:\Windows\System32\drivers\OEM02Dev.sys (Creative Technology Ltd.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (iaNvStor) Intel® – C:\Windows\system32\drivers\ianvstor.sys (Intel Corporation)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (OEM02Vfx) – C:\Windows\System32\drivers\OEM02Vfx.sys (EyePower Games Pte. Ltd.)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.com"

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/05/10 20:41:08 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/29 19:08:46 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/05/07 13:49:40 | 000,000,000 | —D | M] (No name found) – C:\Users\Todd\AppData\Roaming\Mozilla\Extensions
[2011/06/17 11:07:21 | 000,000,000 | —D | M] (No name found) – C:\Users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\m9k96j9m.default\extensions
[2011/05/24 23:58:31 | 000,000,000 | —D | M] (Garmin Communicator) – C:\Users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\m9k96j9m.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011/06/17 11:07:21 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\m9k96j9m.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/06/16 09:57:59 | 000,000,000 | —D | M] (Cooliris) – C:\Users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\m9k96j9m.default\extensions\[removed]
[2011/06/17 12:08:37 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/06/17 12:08:37 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
File not found (No name found) –
[2011/05/10 20:41:08 | 000,000,000 | —D | M] (RealPlayer Browser Record Plugin) – C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
() (No name found) – C:\USERS\TODD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M9K96J9M.DEFAULT\EXTENSIONS\{EF4E370E-D9F0-4E00-B93E-A4F274CFDD5A}.XPI
() (No name found) – C:\USERS\TODD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M9K96J9M.DEFAULT\EXTENSIONS\[removed]
[2011/05/08 06:38:41 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/04/14 11:26:02 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 03:00:00 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/06/18 17:26:52 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [DLCJCATS] C:\Windows\System32\spool\DRIVERS\W32X86\3\DLCJtime.DLL ()
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [OfficeSyncProcess] C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE (Microsoft Corporation)
O4 - HKCU..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe ()
O4 - Startup: C:\Users\Todd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Todd\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Send image to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\Windows\System32\vrlogon.dll (UPEK Inc.)
O20 - Winlogon\Notify\psfus: DllName - C:\Windows\system32\psqlpwd.dll - C:\Windows\System32\psqlpwd.dll (UPEK Inc.)
O22 - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\System32\DreamScene.dll (Microsoft Corporation)
O24 - Desktop WallPaper: G:\Documents\mine\1136169721_800x600_snoopy-wallpaper-free-snoopy-wallpaper.jpg
O24 - Desktop BackupWallPaper: G:\Documents\mine\1136169721_800x600_snoopy-wallpaper-free-snoopy-wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/06/19 01:36:04 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{A83318EF-8FF3-4E45-890D-72D6E9FE8956}
[2011/06/18 20:33:23 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/06/18 20:23:58 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\Malwarebytes
[2011/06/18 20:23:46 | 000,039,984 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/06/18 20:23:45 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/06/18 20:23:42 | 000,022,712 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/06/18 20:23:42 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/06/18 20:21:04 | 009,435,312 | —- | C] (Malwarebytes Corporation ) – C:\Users\Todd\Desktop\mbam-setup.exe
[2011/06/18 17:33:38 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/06/18 17:24:28 | 000,000,000 | —D | C] – C:\Windows\temp
[2011/06/18 17:24:28 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\temp
[2011/06/18 17:16:14 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/06/18 17:16:14 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/06/18 17:16:14 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/06/18 17:16:09 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/06/18 17:16:06 | 000,000,000 | —D | C] – C:\Qoobox
[2011/06/18 17:12:49 | 004,130,419 | R— | C] (Swearware) – C:\Users\Todd\Desktop\ComboFix.exe
[2011/06/18 12:35:43 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{ADC54361-6674-4AEF-B0C1-C0B5E24B5099}
[2011/06/17 23:51:31 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{1BDF01FE-1E10-4157-B1F0-369156123BB1}
[2011/06/17 18:57:20 | 000,221,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\netio.sys
[2011/06/17 18:46:05 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\Microsoft Corporation
[2011/06/17 12:09:12 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2011/06/17 12:08:34 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2011/06/17 12:08:34 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2011/06/17 12:08:34 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2011/06/17 11:50:48 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{726C85C3-848A-4A4F-8A6D-715FB8995191}
[2011/06/17 11:06:49 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{828F2DD2-7D23-4B82-B09C-2C6A08E83C20}
[2011/06/17 10:14:17 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{8C474B25-92CE-45BB-9C5D-AE2B2F05EB70}
[2011/06/16 21:22:06 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{8F7FAA29-DD8B-4DE9-AE26-B756E7F05868}
[2011/06/16 20:34:52 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{601093D7-E095-4565-BB41-0A61935AF404}
[2011/06/16 19:53:12 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{450C97F6-9E12-4142-ACAC-A4F3770919DC}
[2011/06/16 06:59:53 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{D16677B5-A0D4-4C62-96B7-3E9F92134205}
[2011/06/16 06:32:34 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{91A01E7F-1DF2-4811-B3D6-50CC8BE059BA}
[2011/06/16 03:57:17 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{4BD24D39-4FA5-4CBC-A3DD-463A1660F084}
[2011/06/15 23:55:38 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{E681AB3C-F6FC-4691-96C9-48E1D0B9B04D}
[2011/06/15 22:58:26 | 000,000,000 | —D | C] – C:\Users\Todd\Documents\Dell Webcam Center
[2011/06/15 20:34:52 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/06/15 20:34:51 | 001,797,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2011/06/15 20:34:51 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2011/06/15 20:34:51 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/06/15 20:31:12 | 000,000,000 | —D | C] – C:\Users\Todd\Documents\Outlook Files
[2011/06/15 09:27:38 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{797924AD-3C95-47C5-83A7-D7E23456E289}
[2011/06/15 02:25:46 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{7FB52A84-F200-4E20-A8BA-4E2A9F51D5EA}
[2011/06/14 10:55:21 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{E79BBFBA-A92D-455F-B804-F7FFB8EC17CE}
[2011/06/13 13:21:42 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{170433F5-1B27-4283-8982-974C06566495}
[2011/06/12 23:55:19 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{F6D09DAB-FCC7-4EB6-B90E-63E033E7ACCB}
[2011/06/12 07:27:14 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{CE63A178-41C2-42B4-99E0-CF8E3EDE04AA}
[2011/06/12 02:44:46 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2011/06/12 02:13:27 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\Reallusion
[2011/06/12 02:13:26 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\tmp
[2011/06/11 17:53:50 | 000,329,728 | —- | C] (Microsoft Corporation) – C:\Users\Todd\Documents\netsetup.exe
[2011/06/11 10:47:58 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{6B287D40-2980-4930-9690-EC8BE224AD33}
[2011/06/11 08:10:42 | 000,000,000 | —D | C] – C:\Users\Todd\Documents\Bluetooth Exchange Folder
[2011/06/11 03:04:06 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\Cooliris
[2011/06/10 22:47:15 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{C295E4A2-2C84-4989-8287-75AAD32924A9}
[2011/06/10 09:39:46 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{E9D5C691-669C-4751-BDB5-D688E4F939CA}
[2011/06/10 06:21:29 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{9B7035A6-D721-4B40-B60F-449D1ADBBD0D}
[2011/06/10 05:18:47 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\Microsoft Games
[2011/06/10 02:01:04 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{42E5B258-0E16-4826-9E5A-EFB855DD3B29}
[2011/06/09 20:12:36 | 000,000,000 | —D | C] – C:\Users\Todd\Documents\MakeDiscVideo
[2011/06/09 20:12:32 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\CyberLink
[2011/06/09 19:26:41 | 000,000,000 | —D | C] – C:\Users\Todd\Documents\Todd's Music
[2011/06/09 18:47:37 | 000,000,000 | —D | C] – C:\Windows\System32\Adobe
[2011/06/09 18:41:15 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/06/09 18:40:46 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/06/09 09:51:24 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{4ADD3B0A-D37C-484E-82B0-ECA643121CC3}
[2011/06/08 14:02:12 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{21DE5A2A-194B-4A1A-91AB-5505C7DACE2A}
[2011/06/08 13:37:55 | 000,000,000 | —D | C] – C:\Program Files\MSXML 4.0
[2011/06/07 21:36:51 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\PCM4Everio
[2011/06/07 21:36:08 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msxml4r.dll
[2011/06/07 21:36:08 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msxml4a.dll
[2011/06/07 13:48:37 | 000,000,000 | —D | C] – C:\Users\Todd\.bitrock
[2011/06/07 13:47:38 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{07E62684-B29E-4E84-B7A7-4A6EDA561E5C}
[2011/06/06 07:41:51 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{8829C39D-2923-4B18-B671-D43CE71C60E7}
[2011/06/05 13:20:06 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{23F7F2EA-9AC8-4D22-811F-BDD68530D42B}
[2011/06/04 11:17:25 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{9006FD24-1B6A-401E-A646-140CF2860377}
[2011/06/04 11:10:36 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{1CC3833C-AEA4-4198-9BF4-D172412760F4}
[2011/06/01 08:41:51 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{9613DEC2-BCD4-4F53-8E62-383FCE51D2D1}
[2011/05/29 19:08:46 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2011/05/29 18:53:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011/05/29 18:24:12 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{E7F3B459-54B8-4385-81FF-270374B65E66}
[2011/05/29 06:15:27 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{CDEC5B41-4361-4F88-A96E-9B8F8C89AE40}
[2011/05/29 04:37:05 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{0816295A-A8A5-484E-B999-6191190A657A}
[2011/05/29 03:19:30 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{0F396FDA-C4BE-4623-88D0-BAA5828D29AE}
[2011/05/28 15:32:52 | 000,000,000 | —D | C] – C:\ProgramData\Last.fm
[2011/05/28 15:31:50 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\Last.fm
[2011/05/28 15:31:49 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Last.fm
[2011/05/28 15:31:47 | 000,000,000 | —D | C] – C:\Program Files\Last.fm
[2011/05/28 15:03:40 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{20043235-4EC5-427E-8647-0F626B153FC7}
[2011/05/28 00:45:33 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{52754232-EA16-4008-BD64-7B38D68C9828}
[2011/05/27 18:48:42 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{63C1AD91-668E-4771-8EF9-953E3EFFFF01}
[2011/05/27 12:37:08 | 000,000,000 | —D | C] – C:\Users\Todd\Desktop\Music
[2011/05/27 06:29:28 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{E432CC7D-8E0F-4BBF-836C-64223999B733}
[2011/05/26 16:35:59 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{858D73BF-DA6B-47B3-82AF-589ED32151EA}
[2011/05/26 03:41:54 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{D2371CA3-6E6F-4BE5-B807-5BC940992CF2}
[2011/05/25 15:21:44 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{03251BF4-CAE1-4FC8-BFF4-400E9C7F506D}
[2011/05/25 14:18:38 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{D1EA8C20-6AA3-47BA-99F2-C5D4C300706C}
[2011/05/25 14:16:04 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\Dell
[2011/05/25 14:15:47 | 000,000,000 | R–D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell Support Center
[2011/05/25 14:14:50 | 000,000,000 | —D | C] – C:\Program Files\Dell Support Center
[2011/05/25 13:37:25 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{63BAEDB1-3F70-422C-9A9B-5321CF2D3BEB}
[2011/05/25 13:16:25 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{D9B78F50-29A3-4F00-A342-88F7DAAFC949}
[2011/05/25 11:50:54 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{1EEBA0E1-4F07-4FEC-A49A-772872E90FF2}
[2011/05/25 08:26:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid
[2011/05/25 08:26:21 | 000,000,000 | —D | C] – C:\Program Files\Xvid
[2011/05/25 05:47:27 | 000,000,000 | —D | C] – C:\Users\Public\Documents\microsoft
[2011/05/25 05:44:49 | 000,000,000 | —D | C] – C:\Program Files\MSECache
[2011/05/25 01:23:56 | 000,000,000 | —D | C] – C:\ProgramData\Garmin
[2011/05/25 01:09:00 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
[2011/05/25 01:08:54 | 000,000,000 | —D | C] – C:\Program Files\DIFX
[2011/05/25 01:08:35 | 000,000,000 | —D | C] – C:\Program Files\Garmin
[2011/05/25 00:41:12 | 004,157,760 | —- | C] (Garmin International) – C:\Users\Todd\Documents\GarminMapUpdater_v2.6.11.exe
[2011/05/25 00:40:58 | 005,178,688 | —- | C] (Igor Pavlov) – C:\Users\Todd\Documents\WebUpdater_242.exe
[2011/05/24 23:58:34 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\GARMIN
[2011/05/24 21:45:34 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{21E5BC7C-AD95-49FF-AA69-FB29B0C13A86}
[2011/05/24 21:06:26 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{856F57C0-8240-44EC-B903-7B8DC92C555E}
[2011/05/24 09:00:46 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{DA0DAF46-68E6-4826-875D-D3B016E461DA}
[2011/05/24 05:42:13 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{DA505049-9922-4A66-8EAC-B4127B120335}
[2011/05/23 22:56:26 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{F7A98C98-4B00-4523-8795-2292E6759433}
[2011/05/23 21:12:15 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{140C70F9-028C-4098-9E27-2E28205A95ED}
[2011/05/23 18:10:06 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{79950582-69F9-44FA-AFDB-2190217D6D00}
[2011/05/23 04:56:12 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{790B5C29-DC2B-44C9-B2ED-0E367D4280A9}
[2011/05/22 16:19:59 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{8119165A-6275-4AA9-850D-3DF407325A73}
[2011/05/22 13:47:55 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{B23FFCF7-F611-48F7-AB98-136013CACC3F}
[2011/05/21 23:17:06 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{F79B0CD8-AD33-4562-8DD1-8C9F3E8B8F07}
[2011/05/21 15:29:41 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/05/21 09:35:58 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{815C22CF-4144-4408-8846-7EBB05448EB7}
[2011/05/20 16:25:02 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\{338FEF26-2075-412F-A053-BA5091228320}
[2006/11/17 15:54:36 | 000,385,928 | —- | C] ( ) – C:\Windows\System32\dlcjih.exe
[2006/11/17 15:54:34 | 000,537,480 | —- | C] ( ) – C:\Windows\System32\dlcjcoms.exe
[2006/11/17 15:54:32 | 000,381,832 | —- | C] ( ) – C:\Windows\System32\dlcjcfg.exe
[2006/11/06 16:37:46 | 000,643,072 | —- | C] ( ) – C:\Windows\System32\dlcjpmui.dll
[2006/11/06 16:35:50 | 001,224,704 | —- | C] ( ) – C:\Windows\System32\dlcjserv.dll
[2006/11/06 16:28:08 | 000,421,888 | —- | C] ( ) – C:\Windows\System32\dlcjcomm.dll
[2006/11/06 16:26:14 | 000,585,728 | —- | C] ( ) – C:\Windows\System32\dlcjlmpm.dll
[2006/11/06 16:24:44 | 000,397,312 | —- | C] ( ) – C:\Windows\System32\dlcjiesc.dll
[2006/11/06 16:21:48 | 000,094,208 | —- | C] ( ) – C:\Windows\System32\dlcjpplc.dll
[2006/11/06 16:20:48 | 000,684,032 | —- | C] ( ) – C:\Windows\System32\dlcjcomc.dll
[2006/11/06 16:20:14 | 000,163,840 | —- | C] ( ) – C:\Windows\System32\dlcjprox.dll
[2006/11/06 16:12:44 | 000,413,696 | —- | C] ( ) – C:\Windows\System32\dlcjinpa.dll
[2006/11/06 16:11:58 | 000,991,232 | —- | C] ( ) – C:\Windows\System32\dlcjusb1.dll
[2006/11/06 16:07:04 | 000,696,320 | —- | C] ( ) – C:\Windows\System32\dlcjhbn3.dll

========== Files - Modified Within 30 Days ==========

[2011/06/19 09:00:08 | 000,000,506 | —- | M] () – C:\Windows\tasks\SystemToolsDailyTest.job
[2011/06/19 08:47:51 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/19 08:47:51 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/19 02:53:31 | 000,637,042 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/06/19 02:53:31 | 000,116,882 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/06/19 02:52:31 | 000,027,240 | —- | M] () – C:\Users\Todd\AppData\Roaming\nvModes.001
[2011/06/19 02:47:50 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/06/19 02:47:45 | 3756,064,768 | -HS- | M] () – C:\hiberfil.sys
[2011/06/19 02:46:46 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2011/06/19 02:11:11 | 011,432,363 | —- | M] () – C:\Users\Todd\Documents\Arianna Shower Teaser.avi
[2011/06/18 20:23:46 | 000,000,908 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/18 20:21:10 | 009,435,312 | —- | M] (Malwarebytes Corporation ) – C:\Users\Todd\Desktop\mbam-setup.exe
[2011/06/18 17:26:52 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2011/06/18 17:12:54 | 004,130,419 | R— | M] (Swearware) – C:\Users\Todd\Desktop\ComboFix.exe
[2011/06/18 16:53:37 | 000,139,264 | —- | M] () – C:\Users\Todd\Desktop\RKUnhookerLE.EXE
[2011/06/18 14:01:49 | 000,098,816 | —- | M] () – C:\Users\Todd\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/18 12:21:03 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/06/18 12:02:10 | 000,001,945 | —- | M] () – C:\Windows\epplauncher.mif
[2011/06/17 19:29:01 | 000,379,448 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/06/17 19:16:58 | 000,000,284 | —- | M] () – C:\Windows\tasks\RealUpgradeScheduledTaskS-1-5-21-1143999259-2469995957-2725660785-1000.job
[2011/06/17 19:16:44 | 000,000,680 | —- | M] () – C:\Users\Todd\AppData\Local\d3d9caps.dat
[2011/06/17 19:01:18 | 000,000,564 | —- | M] () – C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2011/06/17 18:40:45 | 000,000,000 | -H– | M] () – C:\Users\Todd\Documents\Default.rdp
[2011/06/15 21:00:47 | 000,001,894 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/06/12 15:16:27 | 000,000,832 | —- | M] () – C:\Users\Todd\Desktop\AngryBirds.exe - Shortcut.lnk
[2011/06/11 15:47:48 | 000,000,861 | —- | M] () – C:\Users\Public\Desktop\VLC media player.lnk
[2011/06/11 15:46:25 | 021,022,914 | —- | M] () – C:\Users\Todd\Documents\vlc-1.1.10-win32.exe
[2011/06/11 08:14:22 | 000,002,558 | —- | M] () – C:\Users\Todd\Documents\yup.pfx
[2011/06/09 18:41:15 | 000,001,666 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/06/07 19:17:17 | 000,000,498 | —- | M] () – C:\Users\Todd\Desktop\mine - Shortcut.lnk
[2011/06/05 15:58:55 | 000,027,240 | —- | M] () – C:\Users\Todd\AppData\Roaming\nvModes.dat
[2011/05/30 08:42:51 | 000,240,640 | —- | M] () – C:\Windows\System32\xvidvfw.dll
[2011/05/29 19:14:32 | 000,000,918 | —- | M] () – C:\Users\Todd\Desktop\Dropbox.lnk
[2011/05/29 19:14:32 | 000,000,898 | —- | M] () – C:\Users\Todd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2011/05/29 19:08:47 | 000,000,848 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/05/29 18:53:42 | 000,000,806 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/05/29 04:47:25 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/05/29 04:47:25 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/05/27 09:32:33 | 000,270,845 | —- | M] () – C:\Users\Todd\Documents\file.pdf
[2011/05/26 11:50:17 | 000,001,728 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/05/25 00:30:53 | 005,178,688 | —- | M] (Igor Pavlov) – C:\Users\Todd\Documents\WebUpdater_242.exe
[2011/05/25 00:30:36 | 000,602,942 | —- | M] () – C:\Users\Todd\Documents\DownloadableContent_UserGuide.pdf
[2011/05/24 23:58:58 | 004,157,760 | —- | M] (Garmin International) – C:\Users\Todd\Documents\GarminMapUpdater_v2.6.11.exe
[2011/05/23 18:20:42 | 000,620,268 | —- | M] () – C:\Users\Todd\Documents\wire.pdf
[2011/05/23 04:52:08 | 000,153,088 | —- | M] () – C:\Windows\System32\xvid.ax
[2011/05/23 02:46:31 | 000,645,632 | —- | M] () – C:\Windows\System32\xvidcore.dll

========== Files Created - No Company Name ==========

[2011/06/19 02:53:05 | 011,432,363 | —- | C] () – C:\Users\Todd\Documents\Arianna Shower Teaser.avi
[2011/06/18 20:23:46 | 000,000,908 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/18 17:16:14 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2011/06/18 17:16:14 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/06/18 17:16:14 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/06/18 17:16:14 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/06/18 17:16:14 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/06/18 16:53:30 | 000,139,264 | —- | C] () – C:\Users\Todd\Desktop\RKUnhookerLE.EXE
[2011/06/17 19:18:53 | 3756,064,768 | -HS- | C] () – C:\hiberfil.sys
[2011/06/17 19:16:58 | 000,000,284 | —- | C] () – C:\Windows\tasks\RealUpgradeScheduledTaskS-1-5-21-1143999259-2469995957-2725660785-1000.job
[2011/06/17 18:59:10 | 000,001,945 | —- | C] () – C:\Windows\epplauncher.mif
[2011/06/17 18:40:45 | 000,000,000 | -H– | C] () – C:\Users\Todd\Documents\Default.rdp
[2011/06/15 21:00:47 | 000,001,894 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/06/15 21:00:47 | 000,001,804 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011/06/12 15:16:27 | 000,000,832 | —- | C] () – C:\Users\Todd\Desktop\AngryBirds.exe - Shortcut.lnk
[2011/06/11 15:47:48 | 000,000,861 | —- | C] () – C:\Users\Public\Desktop\VLC media player.lnk
[2011/06/11 15:45:59 | 021,022,914 | —- | C] () – C:\Users\Todd\Documents\vlc-1.1.10-win32.exe
[2011/06/11 08:14:11 | 000,002,558 | —- | C] () – C:\Users\Todd\Documents\yup.pfx
[2011/06/09 18:41:15 | 000,001,666 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/06/07 13:52:55 | 000,645,632 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2011/06/07 13:52:55 | 000,153,088 | —- | C] () – C:\Windows\System32\xvid.ax
[2011/06/07 13:52:54 | 000,240,640 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2011/05/29 19:08:47 | 000,000,860 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/05/29 19:08:47 | 000,000,848 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/05/29 04:47:25 | 000,000,000 | RHS- | C] () – C:\MSDOS.SYS
[2011/05/29 04:47:25 | 000,000,000 | RHS- | C] () – C:\IO.SYS
[2011/05/27 09:32:33 | 000,270,845 | —- | C] () – C:\Users\Todd\Documents\file.pdf
[2011/05/25 14:16:07 | 000,000,564 | —- | C] () – C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2011/05/25 14:16:04 | 000,000,506 | —- | C] () – C:\Windows\tasks\SystemToolsDailyTest.job
[2011/05/25 08:04:46 | 000,000,498 | —- | C] () – C:\Users\Todd\Desktop\mine - Shortcut.lnk
[2011/05/25 00:30:36 | 000,602,942 | —- | C] () – C:\Users\Todd\Documents\DownloadableContent_UserGuide.pdf
[2011/05/23 18:20:41 | 000,620,268 | —- | C] () – C:\Users\Todd\Documents\wire.pdf
[2011/05/11 08:10:32 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2011/05/08 08:24:15 | 000,269,416 | —- | C] () – C:\Windows\System32\nvdrsdb1.bin
[2011/05/08 08:24:15 | 000,269,416 | —- | C] () – C:\Windows\System32\nvdrsdb0.bin
[2011/05/08 08:24:15 | 000,000,001 | —- | C] () – C:\Windows\System32\nvdrssel.bin
[2011/05/08 08:23:15 | 000,000,680 | —- | C] () – C:\Users\Todd\AppData\Local\d3d9caps.dat
[2011/05/07 22:43:25 | 000,062,976 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2011/05/07 22:43:18 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2011/05/07 22:42:48 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2011/05/07 22:42:48 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011/05/07 18:05:18 | 000,081,158 | —- | C] () – C:\Windows\System32\manage-bde.ini.en
[2011/05/07 13:49:34 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2011/05/07 13:48:07 | 000,027,240 | —- | C] () – C:\Users\Todd\AppData\Roaming\nvModes.001
[2011/05/07 13:42:50 | 000,098,816 | —- | C] () – C:\Users\Todd\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/07 13:41:59 | 000,027,240 | —- | C] () – C:\Users\Todd\AppData\Roaming\nvModes.dat
[2008/03/13 04:58:17 | 000,167,936 | —- | C] () – C:\Windows\System32\nvccoin.dll
[2008/03/13 04:58:16 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
[2008/03/12 21:29:48 | 000,000,209 | —- | C] () – C:\Windows\ODBCINST.INI
[2008/03/12 21:18:00 | 000,000,076 | RHS- | C] () – C:\Windows\CT4CET.bin
[2008/03/12 21:14:34 | 000,065,536 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2008/03/12 21:14:34 | 000,024,064 | —- | C] () – C:\Windows\System32\WLTRYSVC.EXE
[2008/03/12 21:13:43 | 000,101,376 | —- | C] () – C:\Windows\System32\APOMngr.dll
[2008/03/12 21:13:43 | 000,066,560 | —- | C] () – C:\Windows\System32\CmdRtr.dll
[2008/03/12 21:13:43 | 000,000,628 | —- | C] () – C:\Windows\System32\PCI_VEN_1102&DEV_FF05&SUBSYS_00001102.ini
[2008/03/12 21:04:42 | 000,000,012 | —- | C] () – C:\Windows\bthservsdp.dat
[2006/11/09 15:01:13 | 000,000,000 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2006/11/07 11:30:48 | 000,344,064 | —- | C] () – C:\Windows\System32\dlcjcoin.dll
[2006/11/03 17:25:56 | 000,389,120 | —- | C] () – C:\Windows\System32\btwhidcs.dll
[2006/11/02 07:55:52 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 07:46:27 | 000,379,448 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 07:34:20 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:33:01 | 000,637,042 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,116,882 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 05:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 05:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 03:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/10/20 04:04:52 | 000,106,496 | —- | C] () – C:\Windows\System32\dlcjinsr.dll
[2006/10/20 04:04:42 | 000,036,864 | —- | C] () – C:\Windows\System32\dlcjcur.dll
[2006/10/20 04:04:00 | 000,135,168 | —- | C] () – C:\Windows\System32\dlcjjswr.dll
[2006/10/20 03:58:06 | 000,176,128 | —- | C] () – C:\Windows\System32\dlcjinsb.dll
[2006/10/20 03:57:52 | 000,086,016 | —- | C] () – C:\Windows\System32\dlcjcub.dll
[2006/10/20 03:57:30 | 000,073,728 | —- | C] () – C:\Windows\System32\dlcjcu.dll
[2006/10/20 03:57:18 | 000,159,744 | —- | C] () – C:\Windows\System32\dlcjins.dll
[2006/10/20 03:55:02 | 000,434,176 | —- | C] () – C:\Windows\System32\dlcjutil.dll
[2006/09/06 05:26:28 | 000,069,632 | —- | C] () – C:\Windows\System32\dlcjcfg.dll
[2005/08/18 06:26:46 | 000,040,960 | —- | C] () – C:\Windows\System32\dlcjvs.dll
[2005/08/08 10:01:04 | 000,061,440 | —- | C] () – C:\Windows\System32\dlcjcnv4.dll
[2001/11/14 12:56:00 | 001,802,240 | —- | C] () – C:\Windows\System32\lcppn21.dll

========== LOP Check ==========

[2011/06/19 02:48:46 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Dropbox
[2011/05/25 13:41:04 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\GARMIN
[2011/05/07 16:41:22 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\PCDr
[2011/05/10 13:18:19 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Rovio
[2011/06/12 02:13:26 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\tmp
[2011/06/12 14:52:29 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\uTorrent
[2011/05/11 17:14:14 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Windows Live Writer
[2011/06/17 19:01:18 | 000,000,564 | —- | M] () – C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2011/06/19 02:46:47 | 000,019,680 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2011/06/19 09:00:08 | 000,000,506 | —- | M] () – C:\Windows\Tasks\SystemToolsDailyTest.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2006/09/18 16:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/10 23:36:38 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2011/06/18 17:34:21 | 000,033,879 | —- | M] () – C:\ComboFix.txt
[2006/09/18 16:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2008/03/13 04:58:26 | 000,004,885 | RH– | M] () – C:\dell.sdr
[2011/06/10 14:32:05 | 000,000,087 | —- | M] () – C:\dlcj.log
[2011/06/19 02:47:45 | 3756,064,768 | -HS- | M] () – C:\hiberfil.sys
[2011/05/29 04:47:25 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/05/29 04:47:25 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/06/19 02:47:44 | 4069,675,008 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/11/02 07:35:26 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 07:35:26 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 07:35:26 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2011/05/07 22:56:46 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 16:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/10/20 04:23:34 | 000,118,272 | —- | M] (Lexmark International, Inc.) – C:\Windows\System32\spool\prtprocs\w32x86\dlcjPP5C.DLL
[2006/11/02 07:34:09 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/10 07:10:59 | 000,040,112 | —- | M] (AVAST Software) – C:\Windows\avastSS.scr
[2010/11/10 02:28:46 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2011/05/07 20:57:03 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 05:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/05/08 11:06:34 | 000,000,356 | -HS- | M] () – C:\Users\Todd\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/06/18 17:12:54 | 004,130,419 | R— | M] (Swearware) – C:\Users\Todd\Desktop\ComboFix.exe
[2011/06/18 20:21:10 | 009,435,312 | —- | M] (Malwarebytes Corporation ) – C:\Users\Todd\Desktop\mbam-setup.exe
[2011/06/18 16:53:37 | 000,139,264 | —- | M] () – C:\Users\Todd\Desktop\RKUnhookerLE.EXE

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-16 01:40:04

< End of report >
Hi

Just some housekeeping to do now,

Please do the following:



Follow these steps to uninstall Combofix

  • Make sure your security programs are totally disabled.
  • Click START then RUN
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


NEXT


Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.



If there are any logs/tools remaining on your desktop > right click and delete them.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

  • Download TFC to your desktop
    • Close any open windows.
    • Double click the TFC icon to run the program
    • TFC will close all open programs itself in order to run,
    • Click the Start button to begin the process.
    • Allow TFC to run uninterrupted.
    • The program should not take long to finish it's job
    • Once its finished it should automatically reboot your machine,
    • if it doesn't, manually reboot to ensure a complete clean
    It's normal after running TFC cleaner that the PC will be slower to boot the first time.

  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE

  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at this well written article:
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Thank you very much for your help CatByte! :woot: I did all steps you asked me to do from your last reply. You provide a great service to all. I would be glad to donate when I get paid this week! :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI