Spyware / Malware / Virus Removal

Trojan Horse Cryptic.CYK

7 min read

Looking for the outcome? Ask AI

hsvtiger Topic Starter

Post #1June 18, 2011, 4:51 PM UTC

I have downloaded ComboFix and I am looking for guidance on how to eliminate the virus permanently.
I ran OTL, as directed in the site instructions.
Below are the OTL.Txt and Extras.Txt output:

OTL logfile created on: 6/18/2011 11:31:13 AM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.19 Gb Total Physical Memory | 0.35 Gb Available Physical Memory | 29.31% Memory free
2.84 Gb Paging File | 1.66 Gb Available in Paging File | 58.51% Paging File free
Paging file location(s): C:\pagefile.sys 1824 3648 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 107.36 Gb Total Space | 30.77 Gb Free Space | 28.66% Space Free | Partition Type: NTFS
Drive D: | 4.43 Gb Total Space | 0.67 Gb Free Space | 15.15% Space Free | Partition Type: FAT32

Computer Name: MORTON | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Real\RealOne Player\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\SelectRebates\SelectRebates.exe ()
PRC - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Lexmark Pro800-Pro900 Series\ezprint.exe ()
PRC - C:\Program Files\Lexmark Pro800-Pro900 Series\lxecmon.exe ()
PRC - C:\WINDOWS\system32\lxeccoms.exe ( )
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Garmin\gStart.exe (GARMIN Corp.)
PRC - C:\Program Files\Softex\OmniPass\omniServ.exe ()
PRC - C:\Program Files\Softex\OmniPass\OPXPApp.exe ()
PRC - C:\WINDOWS\wt\updater\wcmdmgr.exe (WildTangent, Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\ddraw.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\dciman32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\nview.dll (NVIDIA Corporation)

========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – File not found
SRV - (AVG Security Toolbar Service) – C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe ()
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (IntuitUpdateService) – C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (lxec_device) – C:\WINDOWS\System32\lxeccoms.exe ( )
SRV - (lxecCATSCustConnectService) – C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxecserv.exe ()
SRV - (omniserv) – C:\Program Files\Softex\OmniPass\omniServ.exe ()
SRV - (Pml Driver HPH11) – C:\WINDOWS\system32\hphipm11.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (MBAMSwissArmy) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)
DRV - (S3Psddr) – C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (MxlW2k) – C:\WINDOWS\System32\drivers\MxlW2k.sys (MusicMatch, Inc.)
DRV - (ltmodem5) – C:\WINDOWS\system32\drivers\ltmdmnt.sys (LT)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (fasttx2k) – C:\WINDOWS\System32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.)
DRV - (viaagp1) – C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (SISAGP) – C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (NVENET) – C:\WINDOWS\system32\drivers\NVENET.sys (NVIDIA Corporation)
DRV - (nv_agp) – C:\WINDOWS\System32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (AN983) – C:\WINDOWS\system32\drivers\an983.sys (ADMtek Incorporated.)
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us8.hpwis.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us8.hpwis.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com/
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1;localhost;*.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/02/06 14:49:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/06/09 21:26:21 | 000,000,000 | —D | M]

O1 HOSTS File: ([2010/01/24 19:23:49 | 000,373,653 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 12878 more lines…
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (Lexmark Printable Web) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll ()
O2 - BHO: (ShopAtHomeIEHelper Class) - {E8DAAA30-6CAA-4b58-9603-8E54238219E2} - C:\Program Files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll (ShopAtHome.com)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Client\YontooIEClient.dll (Yontoo Technology, Inc.)
O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (ShopAtHome.com Toolbar) - {98279C38-DE4B-4bcf-93C9-8EC26069D6F4} - C:\Program Files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll (ShopAtHome.com)
O3 - HKLM\..\Toolbar: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKLM\..\Toolbar: (hp toolkit) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\hp\EXPLOREBAR\HPTOOLKT.DLL (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\ShellBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKCU\..\Toolbar\ShellBrowser: (hp toolkit) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\hp\EXPLOREBAR\HPTOOLKT.DLL (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (ShopAtHome.com Toolbar) - {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - C:\Program Files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll (ShopAtHome.com)
O3 - HKCU\..\Toolbar\WebBrowser: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (hp toolkit) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\hp\EXPLOREBAR\HPTOOLKT.DLL (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark Pro800-Pro900 Series\ezprint.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [lxecmon.exe] C:\Program Files\Lexmark Pro800-Pro900 Series\lxecmon.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [PS2] C:\WINDOWS\system32\ps2.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [SelectRebates] C:\Program Files\SelectRebates\SelectRebates.exe ()
O4 - HKLM..\Run: [StorageGuard] C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realone player\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe (WildTangent, Inc.)
O4 - HKCU..\Run: [gStart] C:\Garmin\gStart.exe (GARMIN Corp.)
O4 - HKCU..\Run: [NVIEW] C:\WINDOWS\System32\nview.dll (NVIDIA Corporation)
O4 - HKCU..\Run: [NvMediaCenter] C:\WINDOWS\System32\NVMCTRAY.DLL (NVIDIA Corporation)
O4 - HKCU..\RunOnce: [Shockwave Updater] File not found
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O15 - HKCU\..Trusted Domains: gateway.madisoncity.k12.al.us ([]* in Local intranet)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKCU\..Trusted Domains: listen.com ([www] http in Trusted sites)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} http://www.musicnotes.com/download/mnviewer.cab (Musicnotes Viewer)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} http://webiq005.webiqonline.com/WebIQ/Data…6-6D5536C585C9} (WebIQ Engine Application Object)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1223753926062 (WUWebControl Class)
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} http://www.facebook.com/controls/contactx.dll (ContactExtractor Class)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab (GMNRev Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} http://ak.imgag.com/imgag/cp/install/Crusher.cab (Creative Toolbox Plug-in)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab (PopCapLoader Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.3.0…inAxControl.CAB (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: PackageCab http://ak.imgag.com/imgag/cp/install/AxCtp2.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\OPXPGina: DllName - C:\Program Files\Softex\OmniPass\opxpgina.dll - C:\Program Files\Softex\OmniPass\OPXPGina.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/04/10 00:19:17 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 07:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2002/09/11 04:02:32 | 000,000,045 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O33 - MountPoints2\{d858f97b-fdc4-11df-8be0-000c6e5182ba}\Shell - "" = AutoRun
O33 - MountPoints2\{d858f97b-fdc4-11df-8be0-000c6e5182ba}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{d858f97b-fdc4-11df-8be0-000c6e5182ba}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL http://www.garmin.com/agent
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\System32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902053519425536)

========== Files/Folders - Created Within 30 Days ==========

[2011/06/18 11:23:21 | 000,579,072 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/06/16 22:33:29 | 004,129,649 | —- | C] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe.exe
[2011/06/09 23:59:33 | 000,000,000 | -H-D | C] – C:\$AVG
[2011/06/09 21:31:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\AVG10
[2011/06/09 21:27:38 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/06/09 21:26:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2011/06/09 21:26:27 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\AVG 2011
[2011/06/09 21:23:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/06/09 21:23:37 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\AVG
[2011/06/09 21:21:52 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2011/06/09 21:09:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/06/08 23:51:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\eN28321MbDgN28321
[2011/06/06 20:59:49 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2011/06/03 16:55:11 | 000,000,000 | R–D | C] – C:\Documents and Settings\Owner\Recent
[2011/06/03 16:13:47 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Start Menu\Programs\Windows XP Recovery
[2011/06/02 22:02:18 | 009,435,312 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup-1.51.0.1200.exe
[2011/05/30 08:00:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Earth
[2011/05/29 22:03:01 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2010/03/07 16:47:49 | 000,438,272 | —- | C] ( ) – C:\WINDOWS\System32\lxeccoin.dll
[2010/03/07 16:42:15 | 001,048,576 | —- | C] ( ) – C:\WINDOWS\System32\lxecserv.dll
[2010/03/07 16:42:15 | 000,847,872 | —- | C] ( ) – C:\WINDOWS\System32\lxecusb1.dll
[2010/03/07 16:42:15 | 000,643,072 | —- | C] ( ) – C:\WINDOWS\System32\lxecpmui.dll
[2010/03/07 16:42:15 | 000,364,544 | —- | C] ( ) – C:\WINDOWS\System32\lxecinpa.dll
[2010/03/07 16:42:15 | 000,356,352 | —- | C] ( ) – C:\WINDOWS\System32\LXEChcp.dll
[2010/03/07 16:42:15 | 000,344,064 | —- | C] ( ) – C:\WINDOWS\System32\lxeciesc.dll
[2010/03/07 16:42:14 | 000,802,816 | —- | C] ( ) – C:\WINDOWS\System32\lxeccomc.dll
[2010/03/07 16:42:14 | 000,688,128 | —- | C] ( ) – C:\WINDOWS\System32\lxechbn3.dll
[2010/03/07 16:42:14 | 000,598,696 | —- | C] ( ) – C:\WINDOWS\System32\lxeccoms.exe
[2010/03/07 16:42:14 | 000,577,536 | —- | C] ( ) – C:\WINDOWS\System32\lxeclmpm.dll
[2010/03/07 16:42:14 | 000,373,416 | —- | C] ( ) – C:\WINDOWS\System32\lxeccfg.exe
[2010/03/07 16:42:14 | 000,372,736 | —- | C] ( ) – C:\WINDOWS\System32\lxeccomm.dll
[2010/03/07 16:42:14 | 000,324,264 | —- | C] ( ) – C:\WINDOWS\System32\lxecih.exe
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/18 11:24:48 | 000,000,278 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2646380841-1092760190-1851676499-1003.job
[2011/06/18 11:24:44 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2646380841-1092760190-1851676499-1003.job
[2011/06/18 11:22:07 | 000,579,072 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/06/18 11:04:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/18 09:32:22 | 118,977,085 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/06/17 19:31:29 | 000,019,968 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/17 19:00:00 | 000,000,254 | —- | M] () – C:\WINDOWS\tasks\RMSchedule.job
[2011/06/17 17:04:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/17 07:43:19 | 000,000,248 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2011/06/17 07:43:17 | 000,000,396 | —- | M] () – C:\WINDOWS\tasks\DriverCure Startup.job
[2011/06/17 07:42:21 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/17 07:42:19 | 1274,466,304 | -HS- | M] () – C:\hiberfil.sys
[2011/06/17 03:27:02 | 000,000,380 | —- | M] () – C:\WINDOWS\tasks\DriverCure.job
[2011/06/17 02:46:25 | 000,001,308 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik
[2011/06/17 02:46:24 | 000,001,308 | -HS- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik
[2011/06/16 22:33:39 | 004,129,649 | —- | M] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe.exe
[2011/06/16 22:26:30 | 001,314,301 | —- | M] () – C:\Documents and Settings\Owner\Desktop\bleepingcomputer_combofix_how-to-use-combofix.pdf
[2011/06/11 22:11:03 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/06/11 15:38:08 | 000,002,427 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Paint Shop Pro 7.lnk
[2011/06/09 22:52:47 | 000,312,630 | —- | M] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER_RevA.jpg
[2011/06/09 22:36:48 | 000,686,378 | —- | M] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER.psp
[2011/06/09 21:26:28 | 000,000,701 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/06/09 19:54:47 | 001,253,318 | —- | M] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER.jpg
[2011/06/09 13:32:25 | 001,228,854 | —- | M] () – C:\fsqwr.bmp
[2011/06/08 19:08:05 | 000,016,502 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Madison PHX_BUSA-3v3_Roster_RevA.pdf
[2011/06/06 21:45:50 | 000,016,729 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Warriors Tournament Stats.html
[2011/06/05 19:50:22 | 000,016,750 | -HS- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\8f2gvu11wnj076224dw377dm
[2011/06/05 19:50:22 | 000,016,750 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\8f2gvu11wnj076224dw377dm
[2011/06/04 20:53:52 | 000,075,680 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Rhyan_Comprehensive Progress Report_20110604.pdf
[2011/06/04 20:35:15 | 000,071,355 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Jared_Comprehensive Progress Report_20110604.pdf
[2011/06/03 21:43:48 | 000,606,105 | —- | M] () – C:\Program Files\unhide.exe
[2011/06/03 06:50:52 | 000,001,740 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/06/02 22:41:42 | 000,000,795 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/02 22:18:54 | 001,007,108 | —- | M] () – C:\Documents and Settings\Owner\Desktop\rkill.exe
[2011/06/02 22:18:31 | 000,015,540 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\u1uyqq1ej78o513ut27
[2011/06/02 22:18:30 | 000,015,540 | -HS- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\u1uyqq1ej78o513ut27
[2011/06/02 21:49:44 | 009,435,312 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup-1.51.0.1200.exe
[2011/06/02 11:43:50 | 000,002,187 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/05/31 21:35:39 | 000,091,259 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Conexis Payment Receipt_20110531.pdf
[2011/05/29 22:03:01 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/18 09:32:22 | 118,977,085 | —- | C] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/06/17 02:46:15 | 000,001,308 | -HS- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik
[2011/06/17 02:46:15 | 000,001,308 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik
[2011/06/16 22:26:27 | 001,314,301 | —- | C] () – C:\Documents and Settings\Owner\Desktop\bleepingcomputer_combofix_how-to-use-combofix.pdf
[2011/06/15 17:57:56 | 1274,466,304 | -HS- | C] () – C:\hiberfil.sys
[2011/06/09 22:52:46 | 000,312,630 | —- | C] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER_RevA.jpg
[2011/06/09 22:00:13 | 000,686,378 | —- | C] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER.psp
[2011/06/09 21:26:28 | 000,000,701 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/06/09 19:54:47 | 001,253,318 | —- | C] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER.jpg
[2011/06/09 00:27:24 | 001,228,854 | —- | C] () – C:\fsqwr.bmp
[2011/06/08 19:08:05 | 000,016,502 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Madison PHX_BUSA-3v3_Roster_RevA.pdf
[2011/06/06 21:45:50 | 000,016,729 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Warriors Tournament Stats.html
[2011/06/05 14:46:58 | 000,016,750 | -HS- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\8f2gvu11wnj076224dw377dm
[2011/06/05 14:46:58 | 000,016,750 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\8f2gvu11wnj076224dw377dm
[2011/06/04 20:53:52 | 000,075,680 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Rhyan_Comprehensive Progress Report_20110604.pdf
[2011/06/04 20:35:15 | 000,071,355 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Jared_Comprehensive Progress Report_20110604.pdf
[2011/06/03 22:11:43 | 000,002,393 | —- | C] () – C:\Documents and Settings\All Users\Desktop\TurboTax 2010.lnk
[2011/06/03 22:11:43 | 000,002,393 | —- | C] () – C:\Documents and Settings\All Users\Desktop\TurboTax 2008.lnk
[2011/06/03 22:11:43 | 000,002,187 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/06/03 22:11:43 | 000,002,069 | —- | C] () – C:\Documents and Settings\All Users\Desktop\WordPerfect Task Manager.lnk
[2011/06/03 22:11:43 | 000,001,854 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/06/03 22:11:43 | 000,001,845 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Re-enable Updates from HP.lnk
[2011/06/03 22:11:43 | 000,001,286 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Visit Lexmark SmartSolutions.LNK
[2011/06/03 22:11:43 | 000,000,826 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/06/03 22:11:43 | 000,000,811 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/06/03 22:11:43 | 000,000,767 | —- | C] () – C:\Documents and Settings\All Users\Desktop\RealPlayer.lnk
[2011/06/03 22:11:43 | 000,000,717 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Register with HP.lnk
[2011/06/03 22:11:43 | 000,000,659 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Rhapsody.lnk
[2011/06/03 22:11:43 | 000,000,641 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Rhapsody.lnk
[2011/06/03 22:11:43 | 000,000,079 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/06/03 22:11:43 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Software Offers.hp9
[2011/06/03 22:11:42 | 000,002,427 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Paint Shop Pro 7.lnk
[2011/06/03 22:11:42 | 000,001,906 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Play Manager Soccer Professional Edition.lnk
[2011/06/03 22:11:42 | 000,001,858 | —- | C] () – C:\Documents and Settings\All Users\Desktop\MSN Explorer.lnk
[2011/06/03 22:11:42 | 000,001,751 | —- | C] () – C:\Documents and Settings\All Users\Desktop\musicmatch JUKEBOX.lnk
[2011/06/03 22:11:42 | 000,001,651 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Quicken 2003 New User Edition.lnk
[2011/06/03 22:11:42 | 000,001,615 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2011/06/03 22:11:42 | 000,001,553 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/06/03 22:11:42 | 000,001,466 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Tour Guide.lnk
[2011/06/03 22:11:42 | 000,001,439 | —- | C] () – C:\Documents and Settings\All Users\Desktop\MapInstall.lnk
[2011/06/03 22:11:42 | 000,000,905 | —- | C] () – C:\Documents and Settings\All Users\Desktop\OpenOffice.lnk
[2011/06/03 22:11:42 | 000,000,825 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Launch Lexmark Printer Home.LNK
[2011/06/03 22:11:42 | 000,000,795 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/03 22:11:42 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Desktop\My HP Club.hp11
[2011/06/03 22:11:42 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Music and Games for My PC.hp2
[2011/06/03 22:11:41 | 000,001,740 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/06/03 22:11:41 | 000,001,602 | —- | C] () – C:\Documents and Settings\All Users\Desktop\EMusic Downloads.lnk
[2011/06/03 22:11:41 | 000,001,561 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Picture Toolkit.lnk
[2011/06/03 22:11:41 | 000,001,552 | —- | C] () – C:\Documents and Settings\All Users\Desktop\About my HP PC.lnk
[2011/06/03 22:11:41 | 000,001,501 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Recovery.lnk
[2011/06/03 22:11:41 | 000,001,055 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Create & Print Home.url
[2011/06/03 22:11:41 | 000,000,925 | —- | C] () – C:\Documents and Settings\All Users\Desktop\gm_cakesbarscookies.lnk
[2011/06/03 22:11:41 | 000,000,862 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Photo & Imaging.lnk
[2011/06/03 22:11:41 | 000,000,862 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Director.lnk
[2011/06/03 22:11:41 | 000,000,745 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Acrobat.com.lnk
[2011/06/03 22:11:41 | 000,000,700 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CamStudio.lnk
[2011/06/03 22:11:41 | 000,000,104 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Help and Support.lnk
[2011/06/03 21:55:02 | 000,606,105 | —- | C] () – C:\Program Files\unhide.exe
[2011/06/02 22:36:20 | 001,007,108 | —- | C] () – C:\Documents and Settings\Owner\Desktop\rkill.exe
[2011/06/02 11:41:59 | 000,015,540 | -HS- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\u1uyqq1ej78o513ut27
[2011/06/02 11:41:59 | 000,015,540 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\u1uyqq1ej78o513ut27
[2011/05/31 21:35:38 | 000,091,259 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Conexis Payment Receipt_20110531.pdf
[2011/02/07 16:21:25 | 000,179,512 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/12/09 12:47:34 | 000,177,798 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2010/08/15 09:54:34 | 000,005,308 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/08/05 14:07:25 | 000,009,136 | —- | C] () – C:\WINDOWS\System32\Inetwh16.dll
[2010/03/07 16:47:53 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxecvs.dll
[2010/03/07 16:47:37 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\lxecgcfg.dll
[2010/03/07 16:47:36 | 000,294,912 | —- | C] () – C:\WINDOWS\System32\lxeccui.dll
[2010/03/07 16:47:36 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\lxeccuir.dll
[2010/03/07 16:42:33 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\lxecrwrd.ini
[2010/03/07 16:42:15 | 000,385,024 | —- | C] () – C:\WINDOWS\System32\LXECinst.dll
[2010/03/07 16:42:14 | 000,323,584 | —- | C] () – C:\WINDOWS\System32\lxecins.dll
[2010/03/07 16:42:14 | 000,262,144 | —- | C] () – C:\WINDOWS\System32\lxecinsb.dll
[2010/03/07 16:42:14 | 000,253,952 | —- | C] () – C:\WINDOWS\System32\lxeccu.dll
[2010/03/07 16:42:14 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lxecgrd.dll
[2010/03/07 16:42:14 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\lxecinsr.dll
[2010/03/07 16:42:14 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\lxeccub.dll
[2010/03/07 16:42:14 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\lxecjswr.dll
[2010/03/07 16:42:14 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\lxeccur.dll
[2010/03/07 16:35:03 | 000,023,552 | —- | C] () – C:\WINDOWS\System32\LXECsmr.dll
[2010/03/07 16:35:02 | 000,299,008 | —- | C] () – C:\WINDOWS\System32\LXECsm.dll
[2009/12/26 00:36:04 | 000,043,948 | —- | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/12/04 16:33:31 | 000,000,359 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2009/09/26 19:28:41 | 000,000,318 | —- | C] () – C:\Documents and Settings\Owner\Application Data\1c64-ec47-1438-983d_6279rc
[2009/03/20 10:56:27 | 000,091,520 | —- | C] () – C:\WINDOWS\System32\WebIQEngineSetup.exe
[2009/02/21 07:13:43 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2008/12/13 11:21:59 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2008/10/14 23:32:58 | 000,019,968 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/10/13 23:14:21 | 000,000,022 | —- | C] () – C:\WINDOWS\exchng.ini
[2008/10/13 22:42:36 | 000,000,611 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/10/13 22:06:22 | 000,019,558 | —- | C] () – C:\WINDOWS\hpoins01.dat
[2008/10/13 22:06:22 | 000,016,606 | —- | C] () – C:\WINDOWS\hpomdl01.dat
[2008/10/13 22:02:01 | 000,061,678 | —- | C] () – C:\Documents and Settings\Owner\Application Data\PFP100JPR.{PB
[2008/10/13 22:02:01 | 000,012,358 | —- | C] () – C:\Documents and Settings\Owner\Application Data\PFP100JCM.{PB
[2008/10/11 18:35:20 | 000,006,550 | —- | C] () – C:\WINDOWS\jautoexp.dat
[2008/10/11 14:56:02 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2008/10/11 14:30:19 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2008/02/04 19:23:10 | 000,693,792 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2003/04/10 06:35:00 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/04/10 06:34:24 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\iAlmcoin.dll
[2003/04/10 06:21:36 | 000,000,051 | —- | C] () – C:\WINDOWS\System32\mshrml.ini
[2003/04/10 03:51:07 | 000,000,438 | —- | C] () – C:\WINDOWS\System32\1_ssetup.ini
[2003/04/10 03:51:07 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\sunistlog.ini
[2003/04/10 02:32:34 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2003/04/10 02:32:34 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2003/04/10 02:06:10 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2003/04/10 02:04:00 | 000,090,112 | R— | C] () – C:\WINDOWS\bwUnin-6.2.3.66.exe
[2003/04/10 02:03:38 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2003/04/10 02:03:38 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\syscontr.dll
[2003/04/10 01:57:15 | 000,000,052 | —- | C] () – C:\WINDOWS\intuprof.ini
[2003/04/10 01:57:04 | 000,000,626 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2003/04/10 01:16:44 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/04/10 01:06:59 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\sis740.bin
[2003/04/10 01:06:59 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\sis650.bin
[2003/04/10 00:59:54 | 000,001,024 | —- | C] () – C:\WINDOWS\System32\drivers\jedih2rx.bin
[2003/04/10 00:59:54 | 000,000,122 | —- | C] () – C:\WINDOWS\System32\drivers\ramsed.bin
[2003/04/10 00:55:02 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/04/10 00:44:58 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2003/04/10 00:44:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2003/04/10 00:44:29 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2003/04/10 00:23:21 | 000,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/04/10 00:21:27 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2003/04/10 00:16:07 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2003/04/10 00:05:45 | 000,000,659 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/04/10 00:05:26 | 000,474,322 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2003/04/10 00:05:26 | 000,076,172 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2003/04/09 17:10:31 | 000,004,346 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/04/09 17:09:25 | 000,211,288 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2003/03/19 18:50:18 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2002/11/14 10:09:12 | 000,036,864 | —- | C] () – C:\WINDOWS\hpfsched.exe
[2002/11/14 10:08:26 | 000,004,760 | —- | C] () – C:\WINDOWS\hphmdl11.dat
[2002/05/24 10:00:00 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lockout.dll
[2002/05/24 10:00:00 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\lockres.dll
[2001/08/14 20:47:08 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\vxpsapi.dll
[2001/07/13 08:04:00 | 000,373,248 | —- | C] () – C:\WINDOWS\EyeCand3.INI
[2001/01/03 08:38:54 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2001/01/03 08:38:53 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2001/01/03 08:38:32 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2001/01/03 08:38:28 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2001/01/03 08:11:26 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2001/01/03 08:11:26 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2001/01/03 08:11:23 | 000,004,490 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2001/01/03 08:11:19 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2001/01/03 08:11:14 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[1996/11/17 01:00:00 | 000,047,104 | —- | C] () – C:\WINDOWS\System32\WRKGADM.EXE
[1996/11/17 01:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\ODBCSTF.DLL
[1996/11/17 01:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\DOCOBJ.DLL
[1996/11/17 01:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL

========== LOP Check ==========

[2011/06/09 21:31:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2011/06/09 21:28:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/06/09 21:27:38 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2010/09/08 21:44:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DriverCure
[2011/06/09 19:24:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\eN28321MbDgN28321
[2008/10/19 17:55:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Jes-Soft
[2010/08/10 22:37:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Lexmark Pro800-Pro900 Series
[2011/06/09 21:31:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2009/05/24 20:42:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Musicnotes
[2008/10/25 16:44:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2011/01/20 15:58:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2011/06/07 07:03:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/07/04 16:07:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/12/25 13:38:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/05/24 09:54:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/06/09 21:31:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVG10
[2010/09/08 20:52:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\DriverCure
[2010/12/03 21:39:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\GARMIN
[2011/06/17 20:45:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\interMute
[2003/04/10 01:52:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InterTrust
[2008/11/10 20:06:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InterVideo
[2009/09/26 19:28:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\My Sam's Club Digital Photo Center
[2008/10/18 13:08:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\OpenOffice.org
[2003/04/10 02:04:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SampleView
[2010/05/20 21:22:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Unity
[2008/10/14 22:14:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\VERITAS
[2009/08/19 20:11:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\W Photo Studio Viewer
[2011/06/17 07:43:17 | 000,000,396 | —- | M] () – C:\WINDOWS\Tasks\DriverCure Startup.job
[2011/06/17 03:27:02 | 000,000,380 | —- | M] () – C:\WINDOWS\Tasks\DriverCure.job
[2011/06/17 19:00:00 | 000,000,254 | —- | M] () – C:\WINDOWS\Tasks\RMSchedule.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2003/04/10 00:19:17 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2008/10/11 14:28:03 | 000,000,196 | RHS- | M] () – C:\BOOT.BAK
[2008/10/11 15:07:56 | 000,000,283 | RHS- | M] () – C:\boot.ini
[2002/08/29 07:00:00 | 000,245,920 | RHS- | M] () – C:\cmldr
[2003/04/10 00:19:17 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2009/06/06 22:55:10 | 000,001,567 | —- | M] () – C:\EyeCandyLog.txt
[2011/06/09 13:32:25 | 001,228,854 | —- | M] () – C:\fsqwr.bmp
[2011/06/17 07:42:19 | 1274,466,304 | -HS- | M] () – C:\hiberfil.sys
[2010/02/20 14:25:44 | 000,000,525 | —- | M] () – C:\hpfr3420.xml
[2010/02/20 14:25:44 | 000,188,479 | —- | M] () – C:\hpfr3425.log
[2003/04/10 00:19:17 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/06/16 10:53:18 | 000,000,695 | —- | M] () – C:\IPH.PH
[2003/04/10 00:19:17 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008/10/11 15:03:01 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/10/11 19:19:51 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/06/17 07:42:17 | 1912,602,624 | -HS- | M] () – C:\pagefile.sys
[2009/01/28 15:44:52 | 000,022,016 | —- | M] () – C:\Release_2009.doc
[2008/10/11 14:34:24 | 000,000,556 | —- | M] () – C:\remind.log
[2011/06/17 16:55:38 | 000,000,514 | —- | M] () – C:\rkill.log

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2003/04/10 00:18:28 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2009/11/04 09:14:19 | 000,157,696 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\lxecdrpp.dll
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2001/07/13 08:04:00 | 000,253,952 | —- | M] () – C:\WINDOWS\Jasc Media Center Plus.scr
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >
[2008/10/11 20:20:25 | 000,000,122 | -HS- | M] () – C:\Documents and Settings\All Users\Favorites\Desktop.ini
[2003/04/10 00:19:26 | 000,000,119 | —- | M] () – C:\Documents and Settings\All Users\Favorites\MSN.com.url
[2003/04/10 00:19:26 | 000,000,197 | —- | M] () – C:\Documents and Settings\All Users\Favorites\Radio Station Guide.url

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2011/06/03 21:43:48 | 000,606,105 | —- | M] () – C:\Program Files\unhide.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2003/04/09 17:08:43 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2003/04/09 17:08:43 | 000,602,112 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2003/04/09 17:08:42 | 000,385,024 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2003/04/10 00:23:06 | 000,000,079 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/06/16 22:33:39 | 004,129,649 | —- | M] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe.exe
[2011/06/02 21:49:44 | 009,435,312 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup-1.51.0.1200.exe
[2011/06/18 11:22:07 | 000,579,072 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/08/05 14:04:07 | 011,140,684 | —- | M] (CT Technologies Inc.) – C:\Documents and Settings\Owner\Desktop\PMSoccer40.exe
[2011/06/02 22:18:54 | 001,007,108 | —- | M] () – C:\Documents and Settings\Owner\Desktop\rkill.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-12 11:53:03

========== Alternate Data Streams ==========

@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1

< End of report >

OTL Extras logfile created on: 6/18/2011 11:31:13 AM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.19 Gb Total Physical Memory | 0.35 Gb Available Physical Memory | 29.31% Memory free
2.84 Gb Paging File | 1.66 Gb Available in Paging File | 58.51% Paging File free
Paging file location(s): C:\pagefile.sys 1824 3648 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 107.36 Gb Total Space | 30.77 Gb Free Space | 28.66% Space Free | Partition Type: NTFS
Drive D: | 4.43 Gb Total Space | 0.67 Gb Free Space | 15.15% Space Free | Partition Type: FAT32

Computer Name: MORTON | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe shdocvw.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
InternetShortcut [open] – rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe" = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe:*:Enabled:BackWeb-137903 – ()
"C:\WINDOWS\system32\lxeccoms.exe" = C:\WINDOWS\system32\lxeccoms.exe:*:Enabled:Pro800-Pro900 Series Server – ( )
"C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe" = C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:*:Enabled:ABBYY FineReader – (ABBYY (BIT Software))
"C:\Program Files\QuickTime\QuickTimePlayer.exe" = C:\Program Files\QuickTime\QuickTimePlayer.exe:*:Enabled:QuickTime Player – (Apple Inc.)
"C:\WINDOWS\system32\fxsclnt.exe" = C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console – (Microsoft Corporation)
"C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe" = C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe:LocalSubNet:Disabled:Intuit Update Shared Downloads Server – (Intuit Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05BDC796-3451-4F81-B91D-E98F7ADA76C2}" = TurboTax 2010 WinPerTaxSupport
"{0613467F-A45E-4CB1-9ECE-1F3DD79FB927}" = easy Internet sign-up
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Toolbar
"{14589F05-C658-4594-9429-D437BA688686}" = IntelliMover Data Transfer Demo
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1B343C8C-F170-4829-8481-E163317C5830}" = iTunes
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F7CCFA3-D926-4882-B2A5-A0217ED25597}" = PC-Doctor for Windows
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23DA4222-E517-42B3-8F97-9CFD49E2A732}" = AVG 2011
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{29521505-F489-4822-ADFA-32C6DEE4F114}" = TurboTax 2008 WinPerUserEducation
"{29D88826-2AB9-11D5-8854-00902761A46D}" = WordPerfect Productivity Pack
"{2A267BC6-F77F-4DD4-825F-7AEB1F68B4B1}" = HpSdpAppCoreApp
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35599970-EAA2-012B-ACE9-000000000000}" = TurboTax 2009 waliper
"{3782EC09-4000-475E-8A59-9CABD6F03B4C}" = TurboTax 2010 WinPerFedFormset
"{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset
"{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine
"{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper
"{45EBDA59-D33B-433A-956E-B2F236468B56}" = MUSICMATCH® Jukebox
"{47D4AF7B-EDE6-4ADB-8D2F-0BDA25C7321F}" = HP Digital Imaging Album Printing 1.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F2FCCCF-29F3-44B9-886F-6D16F8417522}" = TurboTax 2010 wrapper
"{4FCC384C-18EA-4E25-9281-A06AE006D219}" = Weblink
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{60E80B13-8649-4A69-85E2-1AE99E061F43}" = ShowBiz DVD
"{60E971B7-51A0-48CA-8687-C6B8F094A409}" = Simple Backup for My Pictures
"{6259F28B-6C4A-4259-8A1D-F44794DF73E2}" = Garmin StreetPilot i2/i3 North America
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69A83D99-D41B-4396-BCC4-3DCB77DFFED0}" = WebIQ Technology Engine
"{6B9B0C6F-E5FA-4633-A640-AB98A272ECCA}" = Safari
"{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}" = HP Photo and Imaging 2.0 - All-in-One Drivers
"{7570F1CA-016D-46AC-B586-CD74645EFB52}" = TurboTax 2008 WinPerFedFormset
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7C5B4583-7CBF-4289-B195-03B553959DEA}" = VoiceOver Kit
"{8214CC02-6271-4DC8-B8DD-779933450264}" = RecordNow
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{88214092-836F-4E22-A5AC-569AC9EE6A0F}" = TurboTax 2008 WinPerReleaseEngine
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo Layers Client 1.10.01
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics Driver
"{91D2C605-AD2B-44C8-A0A1-9B116B3C91CB}" = AVG 2011
"{9867A917-5D17-40DE-83BA-BEA5293194B1}" = HP Photo and Imaging 2.0 - All-in-One
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = InterVideo WinDVD Player
"{9D459B94-7E90-46A5-B76B-5A712E7A3529}" = TurboTax 2010 waliper
"{9E5A03E3-6246-4920-9630-0527D5DA9B07}" = AnswerWorks 5.0 English Runtime
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A525E00B-6609-442E-9DCD-64453C233E8D}" = TurboTax 2010 WinPerReleaseEngine
"{A5945AEE-A78A-47B1-A321-F41F424FDEC7}" = Play Manager Soccer Professional Edition
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9F6CFB0-806D-11E0-8EA1-B8AC6F97B88E}" = Google Earth Plug-in
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.4
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B1DB1AD8-C07E-4052-81A1-D2930232BA70}" = TurboTax 2008 wrapper
"{B23726CF-68BF-41A6-A4EB-72F12F87FE05}" = TurboTax 2008 WinPerTaxSupport
"{B43357AA-3A6D-4D94-B56E-43C44D09E548}" = Microsoft .NET Framework (English)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C5EF7396-54AB-4D78-B83D-B211D977BB74}" = TurboTax 2008 waliper
"{C900EF06-2E76-49C7-8DB0-41F629B21DC5}" = hp psc 1200 series
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2C5E510-BE6D-42CC-9F61-E4F939078474}" = Lexmark Printable Web
"{D6DE02C7-1F47-11D4-9515-00105AE4B89A}" = Paint Shop Pro 7 Anniversary Edition
"{E6D9BC25-0DBC-4368-8E4A-7DEE80661CD9}" = TurboTax 2008 WinPerProgramHelp
"{EEF397AC-DAEF-4C04-90A9-5B2BD31875DC}" = Simple Installer - Multilanguage Version
"{F44DA61E-720D-4E79-871F-F6E628B33242}" = OpenOffice.org 3.0
"{F4E57F49-84B4-4CF2-B0A1-8CA1752BDF7E}" = OmniPass
"{F61F2821-694C-475F-99AB-6AF2EFDF40FD}" = Quicken 2003 New User Edition
"{F9AD06D7-55F5-EB9B-6FD9-3FEE745B4E01}" = Cakes, Bars & Cookies
"148830032a5f9d57a66451e2d5e595fb.8A83BD0BE459142F50C111755484E359D8DBFFF2.1" = Cakes, Bars & Cookies
"Acoustica MP3 Audio Mixer" = Acoustica MP3 Audio Mixer
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"ArcSoft Software Suite" = ArcSoft Picture Software
"AVG" = AVG 2011
"BackWeb-137903 Uninstaller" = Updates from HP
"CamStudio" = CamStudio
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Coupon Printer for Windows4.0" = Coupon Printer for Windows
"doPDF 6 printer_is1" = doPDF 6.2 printer
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.1
"hp instant support" = HP Instant Support
"HP PSC 1200 Series" = HP Photo and Imaging 2.0 - hp psc 1200 series
"HPTOOLKIT" = toolkit
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{0613467F-A45E-4CB1-9ECE-1F3DD79FB927}" = easy Internet sign-up
"InstallShield_{F61F2821-694C-475F-99AB-6AF2EFDF40FD}" = Quicken 2003 New User Edition
"Lexmark Pro800-Pro900 Series" = Lexmark Pro800-Pro900 Series
"LiveReg" = LiveReg (Symantec Corporation)
"LiveUpdate" = LiveUpdate 1.80 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.0.1200
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework Full v1.0.3705 (1033)" = Microsoft .NET Framework (English) v1.0.3705
"MP3 Audio Mixer G2 Support" = MP3 Audio Mixer G2 Support
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Music Challenge" = Music Challenge (remove only)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA" = NVIDIA Windows 2000/XP Display Drivers
"Office8.0" = Microsoft Office 97, Professional Edition
"PS2" = PS2
"RealPlayer 12.0" = RealPlayer
"Rhapsody" = Rhapsody
"S3Display" = S3Display
"S3Gamma2" = S3Gamma2
"S3Info2" = S3Info2
"S3Overlay" = S3Overlay
"Search Toolbar" = Search Toolbar
"SelectRebatesUninstall" = ShopAtHome.com Toolbar
"TurboTax 2008" = TurboTax 2008
"TurboTax 2009" = TurboTax 2009
"TurboTax 2010" = TurboTax 2010
"tv_enua" = Lernout & Hauspie TruVoice American English TTS Engine
"wcmdmgr.exe" = WildTangent Updater
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"WordPerfect Productivity Pack" = WordPerfect Productivity Pack
"wtwebdriver" = WildTangent Web Driver
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Media Player" = Move Media Player
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/14/2011 5:44:21 AM | Computer Name = MORTON | Source = Application Error | ID = 1000
Description = Faulting application avgwdsvc.exe, version 10.0.0.1295, faulting module
ntdll.dll, version 5.1.2600.6055, fault address 0x00001f18.

Error - 6/15/2011 11:49:46 AM | Computer Name = MORTON | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 6/15/2011 11:49:46 AM | Computer Name = MORTON | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7947453

Error - 6/15/2011 11:49:46 AM | Computer Name = MORTON | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7947453

Error - 6/15/2011 11:50:02 AM | Computer Name = MORTON | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 6/15/2011 11:50:02 AM | Computer Name = MORTON | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7963797

Error - 6/15/2011 11:50:02 AM | Computer Name = MORTON | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7963797

Error - 6/15/2011 3:39:34 PM | Computer Name = MORTON | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 0.0.0.0, faulting module
iexplore.exe, version 0.0.0.0, fault address 0x0008cb40.

Error - 6/15/2011 9:24:56 PM | Computer Name = MORTON | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/17/2011 8:37:43 AM | Computer Name = MORTON | Source = Application Hang | ID = 1002
Description = Hanging application ejx.exe, version 5.7.0.18066, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ Application Events ]
Error - 6/14/2011 5:44:21 AM | Computer Name = MORTON | Source = Application Error | ID = 1000
Description = Faulting application avgwdsvc.exe, version 10.0.0.1295, faulting module
ntdll.dll, version 5.1.2600.6055, fault address 0x00001f18.

Error - 6/15/2011 11:49:46 AM | Computer Name = MORTON | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 6/15/2011 11:49:46 AM | Computer Name = MORTON | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7947453

Error - 6/15/2011 11:49:46 AM | Computer Name = MORTON | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7947453

Error - 6/15/2011 11:50:02 AM | Computer Name = MORTON | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 6/15/2011 11:50:02 AM | Computer Name = MORTON | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7963797

Error - 6/15/2011 11:50:02 AM | Computer Name = MORTON | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7963797

Error - 6/15/2011 3:39:34 PM | Computer Name = MORTON | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 0.0.0.0, faulting module
iexplore.exe, version 0.0.0.0, fault address 0x0008cb40.

Error - 6/15/2011 9:24:56 PM | Computer Name = MORTON | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/17/2011 8:37:43 AM | Computer Name = MORTON | Source = Application Hang | ID = 1002
Description = Hanging application ejx.exe, version 5.7.0.18066, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 6/15/2011 7:00:47 PM | Computer Name = MORTON | Source = System Error | ID = 1003
Description = Error code 000000f4, parameter1 00000003, parameter2 89085020, parameter3
89085194, parameter4 8060577e.

Error - 6/15/2011 7:00:51 PM | Computer Name = MORTON | Source = System Error | ID = 1003
Description = Error code 000000f4, parameter1 00000003, parameter2 89180810, parameter3
89180984, parameter4 8060577e.

Error - 6/15/2011 7:00:53 PM | Computer Name = MORTON | Source = System Error | ID = 1003
Description = Error code 000000f4, parameter1 00000003, parameter2 8916f508, parameter3
8916f67c, parameter4 8060577e.

Error - 6/15/2011 7:00:56 PM | Computer Name = MORTON | Source = System Error | ID = 1003
Description = Error code 000000f4, parameter1 00000003, parameter2 8918d880, parameter3
8918d9f4, parameter4 8060577e.

Error - 6/16/2011 10:36:02 PM | Computer Name = MORTON | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the lxecCATSCustConnectService
service to connect.

Error - 6/16/2011 10:36:02 PM | Computer Name = MORTON | Source = Service Control Manager | ID = 7000
Description = The lxecCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 6/16/2011 10:36:02 PM | Computer Name = MORTON | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2

Error - 6/17/2011 8:42:54 AM | Computer Name = MORTON | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the lxecCATSCustConnectService
service to connect.

Error - 6/17/2011 8:42:54 AM | Computer Name = MORTON | Source = Service Control Manager | ID = 7000
Description = The lxecCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 6/17/2011 8:42:54 AM | Computer Name = MORTON | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2

< End of report >

Essexboy

Post #2June 18, 2011, 9:44 PM UTC

Hi there what location is AVG reporting ?

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
[2011/06/03 16:13:47 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Start Menu\Programs\Windows XP Recovery
[2011/06/08 23:51:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\eN28321MbDgN28321
[2011/06/17 02:46:25 | 000,001,308 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik
[2011/06/17 02:46:24 | 000,001,308 | -HS- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik
[2011/06/05 19:50:22 | 000,016,750 | -HS- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\8f2gvu11wnj076224dw377dm
[2011/06/05 19:50:22 | 000,016,750 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\8f2gvu11wnj076224dw377dm
[2011/06/02 22:18:31 | 000,015,540 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\u1uyqq1ej78o513ut27
[2011/06/02 22:18:30 | 000,015,540 | -HS- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\u1uyqq1ej78o513ut27
[2011/06/17 02:46:15 | 000,001,308 | -HS- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik
[2011/06/17 02:46:15 | 000,001,308 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik
[2011/06/02 11:41:59 | 000,015,540 | -HS- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\u1uyqq1ej78o513ut27
[2011/06/02 11:41:59 | 000,015,540 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\u1uyqq1ej78o513ut27

:Files
ipconfig /flushdns /c
C:\Documents and Settings\All Users\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik
C:\Documents and Settings\Owner\Local Settings\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik
C:\Documents and Settings\Owner\Local Settings\Application Data\8f2gvu11wnj076224dw377dm
C:\Documents and Settings\All Users\Application Data\8f2gvu11wnj076224dw377dm
C:\Documents and Settings\All Users\Application Data\u1uyqq1ej78o513ut27
C:\Documents and Settings\Owner\Local Settings\Application Data\u1uyqq1ej78o513ut27
C:\Documents and Settings\Owner\Local Settings\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik
C:\Documents and Settings\All Users\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik
C:\Documents and Settings\Owner\Local Settings\Application Data\u1uyqq1ej78o513ut27
C:\Documents and Settings\All Users\Application Data\u1uyqq1ej78o513ut27

:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]
Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Could you rerun OTL as below and let me know what your current problems are

Run OTL.
Select All Users
Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
Volsnap.sys
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
CREATERESTOREPOINT
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

FINALLY

Download aswMBR.exe ( 567KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

hsvtiger

Post #3June 19, 2011, 2:42 AM UTC

Thanks for the help, Essex.

Originally, AVG was reporting that the following locations could not be fixed and were infected with Trojan horse Cryptic.CYK:
C:\WINDOWS\system32\services.exe (1032):\memory_001b0000
C:\WINDOWS\explorer.exe (3080):\memory_001b0000
C:\Program Files\Internet Explorer\iexplore.exe (3716):\memory_00270000
C:\Program Files\Internet Explorer\iexplore.exe (2392):\memory_00270000

Here is the OTL RunFix Log:
All processes killed
========== OTL ==========
C:\Documents and Settings\Owner\Start Menu\Programs\Windows XP Recovery folder moved successfully.
Folder C:\Documents and Settings\All Users\Application Data\eN28321MbDgN28321\ not found.
C:\Documents and Settings\All Users\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik moved successfully.
C:\Documents and Settings\Owner\Local Settings\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik moved successfully.
C:\Documents and Settings\Owner\Local Settings\Application Data\8f2gvu11wnj076224dw377dm moved successfully.
C:\Documents and Settings\All Users\Application Data\8f2gvu11wnj076224dw377dm moved successfully.
C:\Documents and Settings\All Users\Application Data\u1uyqq1ej78o513ut27 moved successfully.
C:\Documents and Settings\Owner\Local Settings\Application Data\u1uyqq1ej78o513ut27 moved successfully.
File C:\Documents and Settings\Owner\Local Settings\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik not found.
File C:\Documents and Settings\All Users\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik not found.
File C:\Documents and Settings\Owner\Local Settings\Application Data\u1uyqq1ej78o513ut27 not found.
File C:\Documents and Settings\All Users\Application Data\u1uyqq1ej78o513ut27 not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Owner\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Owner\Desktop\cmd.txt deleted successfully.
File\Folder C:\Documents and Settings\All Users\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik not found.
File\Folder C:\Documents and Settings\Owner\Local Settings\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik not found.
File\Folder C:\Documents and Settings\Owner\Local Settings\Application Data\8f2gvu11wnj076224dw377dm not found.
File\Folder C:\Documents and Settings\All Users\Application Data\8f2gvu11wnj076224dw377dm not found.
File\Folder C:\Documents and Settings\All Users\Application Data\u1uyqq1ej78o513ut27 not found.
File\Folder C:\Documents and Settings\Owner\Local Settings\Application Data\u1uyqq1ej78o513ut27 not found.
File\Folder C:\Documents and Settings\Owner\Local Settings\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik not found.
File\Folder C:\Documents and Settings\All Users\Application Data\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik not found.
File\Folder C:\Documents and Settings\Owner\Local Settings\Application Data\u1uyqq1ej78o513ut27 not found.
File\Folder C:\Documents and Settings\All Users\Application Data\u1uyqq1ej78o513ut27 not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 56466 bytes

User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 13172810 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 91562356 bytes

User: Owner
->Temp folder emptied: 132086433 bytes
->Temporary Internet Files folder emptied: 523752098 bytes
->Java cache emptied: 31050419 bytes
->Apple Safari cache emptied: 26961920 bytes
->Flash cache emptied: 15976927 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 39097 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3336662 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 151923007 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 54086 bytes
RecycleBin emptied: 20480 bytes

Total Files Cleaned = 944.00 mb

[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Owner
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point (0)

OTL by OldTimer - Version 3.2.24.1 log created on 06182011_205626

Files\Folders moved on Reboot…
C:\Documents and Settings\Owner\Local Settings\Temp\config.dat moved successfully.
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF56A6.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF56B1.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF56F0.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF56FB.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF5727.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF5732.tmp not found!
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\YSBYXVP8\google[5].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WZFFDFA2\ac3[2].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WZFFDFA2\FuturaStd-CondensedBold[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WZFFDFA2\HelveticaNeueLTStd-MdCn[1].otf moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\MS4III20\topbuttons[1].xml moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\LD8ZTK6X\google[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HWUHTICD\Arvo-Regular[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HWUHTICD\B5153741[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HWUHTICD\gossipcenter[3].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HWUHTICD\gossipcenter[4].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HWUHTICD\sandbox[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HSJAP41X\FuturaStd-CondensedBold[1].otf moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HSJAP41X\google[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HSJAP41X\HelveticaNeueLTStd-MdCn[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HSJAP41X\tradegothicltstd-bdcn20-webfont[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HSJAP41X\trade_gothic_condensed_18-webfont[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FUOO8DTV\kerli[1].mp4 moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FUOO8DTV\PugTracker[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FRGF6WZF\0Rsk28hPc9_752862903[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FRGF6WZF\FuturaLT-Bold[1].otf moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FRGF6WZF\FuturaLT-Condensed[1].otf moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FRGF6WZF\gossipcenter[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FRGF6WZF\PugTracker[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4LHKYJAA\lily-aldridge-heats-beaches-st-barts-455126[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4LHKYJAA\PugTracker[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4LHKYJAA\redirect_v92_cim_11_10_4[1].html moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4LHKYJAA\vag_bold-webfont[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4LHKYJAA\vag_rounded_bt-webfont[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4LHKYJAA\vag_rounded_thin-webfont[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3FS4SWC8\cookingwithbutler-214815-02-18-2010[1].mp4 moved successfully.

Registry entries deleted on Reboot…

Here is the OTL QuickScan Log:
OTL logfile created on: 6/18/2011 9:08:17 PM - Run 2
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.19 Gb Total Physical Memory | 0.45 Gb Available Physical Memory | 38.29% Memory free
2.84 Gb Paging File | 2.22 Gb Available in Paging File | 78.11% Paging File free
Paging file location(s): C:\pagefile.sys 1824 3648 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 107.36 Gb Total Space | 31.58 Gb Free Space | 29.42% Space Free | Partition Type: NTFS
Drive D: | 4.43 Gb Total Space | 0.67 Gb Free Space | 15.15% Space Free | Partition Type: FAT32

Computer Name: MORTON | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Real\RealOne Player\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\SelectRebates\SelectRebates.exe ()
PRC - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - C:\Program Files\Lexmark Pro800-Pro900 Series\ezprint.exe ()
PRC - C:\Program Files\Lexmark Pro800-Pro900 Series\lxecmon.exe ()
PRC - C:\WINDOWS\system32\lxeccoms.exe ( )
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Garmin\gStart.exe (GARMIN Corp.)
PRC - C:\Program Files\Softex\OmniPass\omniServ.exe ()
PRC - C:\Program Files\Softex\OmniPass\OPXPApp.exe ()
PRC - C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
PRC - C:\WINDOWS\wt\updater\wcmdmgr.exe (WildTangent, Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\ddraw.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\dciman32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\nview.dll (NVIDIA Corporation)

========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – File not found
SRV - (AVG Security Toolbar Service) – C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe ()
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (IntuitUpdateService) – C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (lxec_device) – C:\WINDOWS\System32\lxeccoms.exe ( )
SRV - (lxecCATSCustConnectService) – C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxecserv.exe ()
SRV - (omniserv) – C:\Program Files\Softex\OmniPass\omniServ.exe ()
SRV - (Pml Driver HPH11) – C:\WINDOWS\system32\hphipm11.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (MBAMSwissArmy) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)
DRV - (S3Psddr) – C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (MxlW2k) – C:\WINDOWS\System32\drivers\MxlW2k.sys (MusicMatch, Inc.)
DRV - (ltmodem5) – C:\WINDOWS\system32\drivers\ltmdmnt.sys (LT)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (fasttx2k) – C:\WINDOWS\System32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.)
DRV - (viaagp1) – C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (SISAGP) – C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (NVENET) – C:\WINDOWS\system32\drivers\NVENET.sys (NVIDIA Corporation)
DRV - (nv_agp) – C:\WINDOWS\System32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (AN983) – C:\WINDOWS\system32\drivers\an983.sys (ADMtek Incorporated.)
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us8.hpwis.com/
IE - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us8.hpwis.com/
IE - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com/
IE - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1;localhost;*.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/02/06 14:49:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/06/09 21:26:21 | 000,000,000 | —D | M]

O1 HOSTS File: ([2011/06/18 20:57:19 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (Lexmark Printable Web) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll ()
O2 - BHO: (ShopAtHomeIEHelper Class) - {E8DAAA30-6CAA-4b58-9603-8E54238219E2} - C:\Program Files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll (ShopAtHome.com)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Client\YontooIEClient.dll (Yontoo Technology, Inc.)
O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (ShopAtHome.com Toolbar) - {98279C38-DE4B-4bcf-93C9-8EC26069D6F4} - C:\Program Files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll (ShopAtHome.com)
O3 - HKLM\..\Toolbar: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKLM\..\Toolbar: (hp toolkit) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\hp\EXPLOREBAR\HPTOOLKT.DLL (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\..\Toolbar\ShellBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\..\Toolbar\ShellBrowser: (hp toolkit) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\hp\EXPLOREBAR\HPTOOLKT.DLL (Hewlett-Packard Company)
O3 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\..\Toolbar\WebBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\..\Toolbar\WebBrowser: (ShopAtHome.com Toolbar) - {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - C:\Program Files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll (ShopAtHome.com)
O3 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\..\Toolbar\WebBrowser: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\..\Toolbar\WebBrowser: (hp toolkit) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\hp\EXPLOREBAR\HPTOOLKT.DLL (Hewlett-Packard Company)
O3 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark Pro800-Pro900 Series\ezprint.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [lxecmon.exe] C:\Program Files\Lexmark Pro800-Pro900 Series\lxecmon.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [PS2] C:\WINDOWS\system32\ps2.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [SelectRebates] C:\Program Files\SelectRebates\SelectRebates.exe ()
O4 - HKLM..\Run: [StorageGuard] C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realone player\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe (WildTangent, Inc.)
O4 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003..\Run: [gStart] C:\Garmin\gStart.exe (GARMIN Corp.)
O4 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003..\Run: [NVIEW] C:\WINDOWS\System32\nview.dll (NVIDIA Corporation)
O4 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003..\Run: [NvMediaCenter] C:\WINDOWS\System32\NVMCTRAY.DLL (NVIDIA Corporation)
O4 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003..\RunOnce: [Shockwave Updater] File not found
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O15 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\..Trusted Domains: gateway.madisoncity.k12.al.us ([]* in Local intranet)
O15 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKU\S-1-5-21-2646380841-1092760190-1851676499-1003\..Trusted Domains: listen.com ([www] http in Trusted sites)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} http://www.musicnotes.com/download/mnviewer.cab (Musicnotes Viewer)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} http://webiq005.webiqonline.com/WebIQ/Data…6-6D5536C585C9} (WebIQ Engine Application Object)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1223753926062 (WUWebControl Class)
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} http://www.facebook.com/controls/contactx.dll (ContactExtractor Class)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab (GMNRev Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} http://ak.imgag.com/imgag/cp/install/Crusher.cab (Creative Toolbox Plug-in)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab (PopCapLoader Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.3.0…inAxControl.CAB (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: PackageCab http://ak.imgag.com/imgag/cp/install/AxCtp2.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\OPXPGina: DllName - C:\Program Files\Softex\OmniPass\opxpgina.dll - C:\Program Files\Softex\OmniPass\OPXPGina.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/04/10 00:19:17 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 07:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2002/09/11 04:02:32 | 000,000,045 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O33 - MountPoints2\{d858f97b-fdc4-11df-8be0-000c6e5182ba}\Shell - "" = AutoRun
O33 - MountPoints2\{d858f97b-fdc4-11df-8be0-000c6e5182ba}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{d858f97b-fdc4-11df-8be0-000c6e5182ba}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL http://www.garmin.com/agent
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902053519425536)

========== Files/Folders - Created Within 30 Days ==========

[2011/06/18 20:56:26 | 000,000,000 | —D | C] – C:\_OTL
[2011/06/18 11:23:21 | 000,579,072 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/06/16 22:33:29 | 004,129,649 | —- | C] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe.exe
[2011/06/09 23:59:33 | 000,000,000 | -H-D | C] – C:\$AVG
[2011/06/09 21:31:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\AVG10
[2011/06/09 21:27:38 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/06/09 21:26:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2011/06/09 21:26:27 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\AVG 2011
[2011/06/09 21:23:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/06/09 21:23:37 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\AVG
[2011/06/09 21:21:52 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2011/06/09 21:09:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/06/08 23:51:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\eN28321MbDgN28321
[2011/06/06 20:59:49 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2011/06/03 16:55:11 | 000,000,000 | R–D | C] – C:\Documents and Settings\Owner\Recent
[2011/06/02 22:02:18 | 009,435,312 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup-1.51.0.1200.exe
[2011/05/30 08:00:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Earth
[2010/03/07 16:47:49 | 000,438,272 | —- | C] ( ) – C:\WINDOWS\System32\lxeccoin.dll
[2010/03/07 16:42:15 | 001,048,576 | —- | C] ( ) – C:\WINDOWS\System32\lxecserv.dll
[2010/03/07 16:42:15 | 000,847,872 | —- | C] ( ) – C:\WINDOWS\System32\lxecusb1.dll
[2010/03/07 16:42:15 | 000,643,072 | —- | C] ( ) – C:\WINDOWS\System32\lxecpmui.dll
[2010/03/07 16:42:15 | 000,364,544 | —- | C] ( ) – C:\WINDOWS\System32\lxecinpa.dll
[2010/03/07 16:42:15 | 000,356,352 | —- | C] ( ) – C:\WINDOWS\System32\LXEChcp.dll
[2010/03/07 16:42:15 | 000,344,064 | —- | C] ( ) – C:\WINDOWS\System32\lxeciesc.dll
[2010/03/07 16:42:14 | 000,802,816 | —- | C] ( ) – C:\WINDOWS\System32\lxeccomc.dll
[2010/03/07 16:42:14 | 000,688,128 | —- | C] ( ) – C:\WINDOWS\System32\lxechbn3.dll
[2010/03/07 16:42:14 | 000,598,696 | —- | C] ( ) – C:\WINDOWS\System32\lxeccoms.exe
[2010/03/07 16:42:14 | 000,577,536 | —- | C] ( ) – C:\WINDOWS\System32\lxeclmpm.dll
[2010/03/07 16:42:14 | 000,373,416 | —- | C] ( ) – C:\WINDOWS\System32\lxeccfg.exe
[2010/03/07 16:42:14 | 000,372,736 | —- | C] ( ) – C:\WINDOWS\System32\lxeccomm.dll
[2010/03/07 16:42:14 | 000,324,264 | —- | C] ( ) – C:\WINDOWS\System32\lxecih.exe
[1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/18 21:05:44 | 000,000,278 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2646380841-1092760190-1851676499-1003.job
[2011/06/18 21:05:43 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2646380841-1092760190-1851676499-1003.job
[2011/06/18 21:04:55 | 000,000,248 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2011/06/18 21:04:36 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/18 21:04:34 | 000,000,396 | —- | M] () – C:\WINDOWS\tasks\DriverCure Startup.job
[2011/06/18 21:04:02 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/18 21:03:38 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/18 21:03:37 | 1274,466,304 | -HS- | M] () – C:\hiberfil.sys
[2011/06/18 20:57:19 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2011/06/18 19:00:00 | 000,000,254 | —- | M] () – C:\WINDOWS\tasks\RMSchedule.job
[2011/06/18 17:28:54 | 119,073,882 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/06/18 11:22:07 | 000,579,072 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/06/17 19:31:29 | 000,019,968 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/17 03:27:02 | 000,000,380 | —- | M] () – C:\WINDOWS\tasks\DriverCure.job
[2011/06/16 22:33:39 | 004,129,649 | —- | M] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe.exe
[2011/06/16 22:26:30 | 001,314,301 | —- | M] () – C:\Documents and Settings\Owner\Desktop\bleepingcomputer_combofix_how-to-use-combofix.pdf
[2011/06/11 22:11:03 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/06/11 15:38:08 | 000,002,427 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Paint Shop Pro 7.lnk
[2011/06/09 22:52:47 | 000,312,630 | —- | M] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER_RevA.jpg
[2011/06/09 22:36:48 | 000,686,378 | —- | M] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER.psp
[2011/06/09 21:26:28 | 000,000,701 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/06/09 19:54:47 | 001,253,318 | —- | M] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER.jpg
[2011/06/09 13:32:25 | 001,228,854 | —- | M] () – C:\fsqwr.bmp
[2011/06/08 19:08:05 | 000,016,502 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Madison PHX_BUSA-3v3_Roster_RevA.pdf
[2011/06/06 21:45:50 | 000,016,729 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Warriors Tournament Stats.html
[2011/06/04 20:53:52 | 000,075,680 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Rhyan_Comprehensive Progress Report_20110604.pdf
[2011/06/04 20:35:15 | 000,071,355 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Jared_Comprehensive Progress Report_20110604.pdf
[2011/06/03 21:43:48 | 000,606,105 | —- | M] () – C:\Program Files\unhide.exe
[2011/06/03 06:50:52 | 000,001,740 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/06/02 22:41:42 | 000,000,795 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/02 22:18:54 | 001,007,108 | —- | M] () – C:\Documents and Settings\Owner\Desktop\rkill.exe
[2011/06/02 21:49:44 | 009,435,312 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup-1.51.0.1200.exe
[2011/06/02 11:43:50 | 000,002,187 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/05/31 21:35:39 | 000,091,259 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Conexis Payment Receipt_20110531.pdf
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/28 09:18:00 | 000,000,430 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.ics
[1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/18 17:28:54 | 119,073,882 | —- | C] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/06/16 22:26:27 | 001,314,301 | —- | C] () – C:\Documents and Settings\Owner\Desktop\bleepingcomputer_combofix_how-to-use-combofix.pdf
[2011/06/15 17:57:56 | 1274,466,304 | -HS- | C] () – C:\hiberfil.sys
[2011/06/09 22:52:46 | 000,312,630 | —- | C] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER_RevA.jpg
[2011/06/09 22:00:13 | 000,686,378 | —- | C] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER.psp
[2011/06/09 21:26:28 | 000,000,701 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/06/09 19:54:47 | 001,253,318 | —- | C] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER.jpg
[2011/06/09 00:27:24 | 001,228,854 | —- | C] () – C:\fsqwr.bmp
[2011/06/08 19:08:05 | 000,016,502 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Madison PHX_BUSA-3v3_Roster_RevA.pdf
[2011/06/06 21:45:50 | 000,016,729 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Warriors Tournament Stats.html
[2011/06/04 20:53:52 | 000,075,680 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Rhyan_Comprehensive Progress Report_20110604.pdf
[2011/06/04 20:35:15 | 000,071,355 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Jared_Comprehensive Progress Report_20110604.pdf
[2011/06/03 22:11:43 | 000,002,393 | —- | C] () – C:\Documents and Settings\All Users\Desktop\TurboTax 2010.lnk
[2011/06/03 22:11:43 | 000,002,393 | —- | C] () – C:\Documents and Settings\All Users\Desktop\TurboTax 2008.lnk
[2011/06/03 22:11:43 | 000,002,187 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/06/03 22:11:43 | 000,002,069 | —- | C] () – C:\Documents and Settings\All Users\Desktop\WordPerfect Task Manager.lnk
[2011/06/03 22:11:43 | 000,001,854 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/06/03 22:11:43 | 000,001,845 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Re-enable Updates from HP.lnk
[2011/06/03 22:11:43 | 000,001,286 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Visit Lexmark SmartSolutions.LNK
[2011/06/03 22:11:43 | 000,000,826 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/06/03 22:11:43 | 000,000,811 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/06/03 22:11:43 | 000,000,767 | —- | C] () – C:\Documents and Settings\All Users\Desktop\RealPlayer.lnk
[2011/06/03 22:11:43 | 000,000,717 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Register with HP.lnk
[2011/06/03 22:11:43 | 000,000,659 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Rhapsody.lnk
[2011/06/03 22:11:43 | 000,000,641 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Rhapsody.lnk
[2011/06/03 22:11:43 | 000,000,079 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/06/03 22:11:43 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Software Offers.hp9
[2011/06/03 22:11:42 | 000,002,427 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Paint Shop Pro 7.lnk
[2011/06/03 22:11:42 | 000,001,906 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Play Manager Soccer Professional Edition.lnk
[2011/06/03 22:11:42 | 000,001,858 | —- | C] () – C:\Documents and Settings\All Users\Desktop\MSN Explorer.lnk
[2011/06/03 22:11:42 | 000,001,751 | —- | C] () – C:\Documents and Settings\All Users\Desktop\musicmatch JUKEBOX.lnk
[2011/06/03 22:11:42 | 000,001,651 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Quicken 2003 New User Edition.lnk
[2011/06/03 22:11:42 | 000,001,615 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2011/06/03 22:11:42 | 000,001,553 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/06/03 22:11:42 | 000,001,466 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Tour Guide.lnk
[2011/06/03 22:11:42 | 000,001,439 | —- | C] () – C:\Documents and Settings\All Users\Desktop\MapInstall.lnk
[2011/06/03 22:11:42 | 000,000,905 | —- | C] () – C:\Documents and Settings\All Users\Desktop\OpenOffice.lnk
[2011/06/03 22:11:42 | 000,000,825 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Launch Lexmark Printer Home.LNK
[2011/06/03 22:11:42 | 000,000,795 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/03 22:11:42 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Desktop\My HP Club.hp11
[2011/06/03 22:11:42 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Music and Games for My PC.hp2
[2011/06/03 22:11:41 | 000,001,740 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/06/03 22:11:41 | 000,001,602 | —- | C] () – C:\Documents and Settings\All Users\Desktop\EMusic Downloads.lnk
[2011/06/03 22:11:41 | 000,001,561 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Picture Toolkit.lnk
[2011/06/03 22:11:41 | 000,001,552 | —- | C] () – C:\Documents and Settings\All Users\Desktop\About my HP PC.lnk
[2011/06/03 22:11:41 | 000,001,501 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Recovery.lnk
[2011/06/03 22:11:41 | 000,001,055 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Create & Print Home.url
[2011/06/03 22:11:41 | 000,000,925 | —- | C] () – C:\Documents and Settings\All Users\Desktop\gm_cakesbarscookies.lnk
[2011/06/03 22:11:41 | 000,000,862 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Photo & Imaging.lnk
[2011/06/03 22:11:41 | 000,000,862 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Director.lnk
[2011/06/03 22:11:41 | 000,000,745 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Acrobat.com.lnk
[2011/06/03 22:11:41 | 000,000,700 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CamStudio.lnk
[2011/06/03 22:11:41 | 000,000,104 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Help and Support.lnk
[2011/06/03 21:55:02 | 000,606,105 | —- | C] () – C:\Program Files\unhide.exe
[2011/06/02 22:36:20 | 001,007,108 | —- | C] () – C:\Documents and Settings\Owner\Desktop\rkill.exe
[2011/05/31 21:35:38 | 000,091,259 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Conexis Payment Receipt_20110531.pdf
[2011/02/07 16:21:25 | 000,179,512 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/12/09 12:47:34 | 000,177,798 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2010/08/15 09:54:34 | 000,005,308 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/08/05 14:07:25 | 000,009,136 | —- | C] () – C:\WINDOWS\System32\Inetwh16.dll
[2010/03/07 16:47:53 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxecvs.dll
[2010/03/07 16:47:37 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\lxecgcfg.dll
[2010/03/07 16:47:36 | 000,294,912 | —- | C] () – C:\WINDOWS\System32\lxeccui.dll
[2010/03/07 16:47:36 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\lxeccuir.dll
[2010/03/07 16:42:33 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\lxecrwrd.ini
[2010/03/07 16:42:15 | 000,385,024 | —- | C] () – C:\WINDOWS\System32\LXECinst.dll
[2010/03/07 16:42:14 | 000,323,584 | —- | C] () – C:\WINDOWS\System32\lxecins.dll
[2010/03/07 16:42:14 | 000,262,144 | —- | C] () – C:\WINDOWS\System32\lxecinsb.dll
[2010/03/07 16:42:14 | 000,253,952 | —- | C] () – C:\WINDOWS\System32\lxeccu.dll
[2010/03/07 16:42:14 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lxecgrd.dll
[2010/03/07 16:42:14 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\lxecinsr.dll
[2010/03/07 16:42:14 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\lxeccub.dll
[2010/03/07 16:42:14 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\lxecjswr.dll
[2010/03/07 16:42:14 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\lxeccur.dll
[2010/03/07 16:35:03 | 000,023,552 | —- | C] () – C:\WINDOWS\System32\LXECsmr.dll
[2010/03/07 16:35:02 | 000,299,008 | —- | C] () – C:\WINDOWS\System32\LXECsm.dll
[2009/12/26 00:36:04 | 000,043,948 | —- | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/12/04 16:33:31 | 000,000,359 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2009/09/26 19:28:41 | 000,000,318 | —- | C] () – C:\Documents and Settings\Owner\Application Data\1c64-ec47-1438-983d_6279rc
[2009/03/20 10:56:27 | 000,091,520 | —- | C] () – C:\WINDOWS\System32\WebIQEngineSetup.exe
[2009/02/21 07:13:43 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2008/12/13 11:21:59 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2008/10/14 23:32:58 | 000,019,968 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/10/13 23:14:21 | 000,000,022 | —- | C] () – C:\WINDOWS\exchng.ini
[2008/10/13 22:42:36 | 000,000,611 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/10/13 22:06:22 | 000,019,558 | —- | C] () – C:\WINDOWS\hpoins01.dat
[2008/10/13 22:06:22 | 000,016,606 | —- | C] () – C:\WINDOWS\hpomdl01.dat
[2008/10/13 22:02:01 | 000,061,678 | —- | C] () – C:\Documents and Settings\Owner\Application Data\PFP100JPR.{PB
[2008/10/13 22:02:01 | 000,012,358 | —- | C] () – C:\Documents and Settings\Owner\Application Data\PFP100JCM.{PB
[2008/10/11 18:35:20 | 000,006,550 | —- | C] () – C:\WINDOWS\jautoexp.dat
[2008/10/11 14:56:02 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2008/10/11 14:30:19 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2008/02/04 19:23:10 | 000,693,792 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2003/04/10 06:35:00 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/04/10 06:34:24 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\iAlmcoin.dll
[2003/04/10 06:21:36 | 000,000,051 | —- | C] () – C:\WINDOWS\System32\mshrml.ini
[2003/04/10 03:51:07 | 000,000,438 | —- | C] () – C:\WINDOWS\System32\1_ssetup.ini
[2003/04/10 03:51:07 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\sunistlog.ini
[2003/04/10 02:32:34 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2003/04/10 02:32:34 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2003/04/10 02:06:10 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2003/04/10 02:04:00 | 000,090,112 | R— | C] () – C:\WINDOWS\bwUnin-6.2.3.66.exe
[2003/04/10 02:03:38 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2003/04/10 02:03:38 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\syscontr.dll
[2003/04/10 01:57:15 | 000,000,052 | —- | C] () – C:\WINDOWS\intuprof.ini
[2003/04/10 01:57:04 | 000,000,626 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2003/04/10 01:16:44 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/04/10 01:06:59 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\sis740.bin
[2003/04/10 01:06:59 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\sis650.bin
[2003/04/10 00:59:54 | 000,001,024 | —- | C] () – C:\WINDOWS\System32\drivers\jedih2rx.bin
[2003/04/10 00:59:54 | 000,000,122 | —- | C] () – C:\WINDOWS\System32\drivers\ramsed.bin
[2003/04/10 00:55:02 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/04/10 00:44:58 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2003/04/10 00:44:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2003/04/10 00:44:29 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2003/04/10 00:23:21 | 000,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/04/10 00:21:27 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2003/04/10 00:16:07 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2003/04/10 00:05:45 | 000,000,659 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/04/10 00:05:26 | 000,474,322 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2003/04/10 00:05:26 | 000,076,172 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2003/04/09 17:10:31 | 000,004,346 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/04/09 17:09:25 | 000,211,288 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2003/03/19 18:50:18 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2002/11/14 10:09:12 | 000,036,864 | —- | C] () – C:\WINDOWS\hpfsched.exe
[2002/11/14 10:08:26 | 000,004,760 | —- | C] () – C:\WINDOWS\hphmdl11.dat
[2002/05/24 10:00:00 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lockout.dll
[2002/05/24 10:00:00 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\lockres.dll
[2001/08/14 20:47:08 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\vxpsapi.dll
[2001/07/13 08:04:00 | 000,373,248 | —- | C] () – C:\WINDOWS\EyeCand3.INI
[2001/01/03 08:38:54 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2001/01/03 08:38:53 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2001/01/03 08:38:32 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2001/01/03 08:38:28 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2001/01/03 08:11:26 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2001/01/03 08:11:26 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2001/01/03 08:11:23 | 000,004,490 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2001/01/03 08:11:19 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2001/01/03 08:11:14 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[1996/11/17 01:00:00 | 000,047,104 | —- | C] () – C:\WINDOWS\System32\WRKGADM.EXE
[1996/11/17 01:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\ODBCSTF.DLL
[1996/11/17 01:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\DOCOBJ.DLL
[1996/11/17 01:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL

========== LOP Check ==========

[2011/06/09 21:31:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2011/06/09 21:28:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/06/09 21:27:38 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2010/09/08 21:44:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DriverCure
[2011/06/09 19:24:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\eN28321MbDgN28321
[2008/10/19 17:55:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Jes-Soft
[2010/08/10 22:37:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Lexmark Pro800-Pro900 Series
[2011/06/09 21:31:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2009/05/24 20:42:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Musicnotes
[2008/10/25 16:44:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2011/01/20 15:58:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2011/06/07 07:03:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/07/04 16:07:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/12/25 13:38:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/05/24 09:54:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2003/04/10 06:21:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Default User\Application Data\interMute
[2003/04/10 01:52:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Default User\Application Data\InterTrust
[2003/04/10 02:04:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Default User\Application Data\SampleView
[2010/03/08 21:59:35 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Softland
[2011/06/09 21:31:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVG10
[2010/09/08 20:52:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\DriverCure
[2010/12/03 21:39:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\GARMIN
[2011/06/17 20:45:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\interMute
[2003/04/10 01:52:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InterTrust
[2008/11/10 20:06:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InterVideo
[2009/09/26 19:28:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\My Sam's Club Digital Photo Center
[2008/10/18 13:08:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\OpenOffice.org
[2003/04/10 02:04:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SampleView
[2010/05/20 21:22:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Unity
[2008/10/14 22:14:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\VERITAS
[2009/08/19 20:11:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\W Photo Studio Viewer
[2011/06/18 21:04:34 | 000,000,396 | —- | M] () – C:\WINDOWS\Tasks\DriverCure Startup.job
[2011/06/17 03:27:02 | 000,000,380 | —- | M] () – C:\WINDOWS\Tasks\DriverCure.job
[2011/06/18 19:00:00 | 000,000,254 | —- | M] () – C:\WINDOWS\Tasks\RMSchedule.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2004/08/04 02:56:49 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/04/13 19:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 19:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\svchost.exe
[2004/08/04 02:56:57 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 – C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: USERINIT.EXE >
[2004/08/04 02:56:57 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF – C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe

< MD5 for: VOLSNAP.SYS >
[2008/04/13 13:41:01 | 000,052,352 | —- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 – C:\WINDOWS\ServicePackFiles\i386\volsnap.sys
[2008/04/13 13:41:01 | 000,052,352 | —- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 – C:\WINDOWS\system32\drivers\volsnap.sys
[2004/08/04 01:00:16 | 000,052,352 | —- | M] (Microsoft Corporation) MD5=EE4660083DEBA849FF6C485D944B379B – C:\WINDOWS\$NtServicePackUninstall$\volsnap.sys

< MD5 for: WINLOGON.EXE >
[2004/08/04 02:56:57 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< %systemroot%\*. /mp /s >

< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/02/18 06:49:53 | 000,173,568 | —- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/02/18 06:49:53 | 000,173,568 | —- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/02/18 06:49:53 | 000,173,568 | —- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: iexplore.exe
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\MSN Explorer\shell\open\command\\: "C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE" [2002/08/29 07:00:00 | 000,094,208 | —- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\\ReinstallCommand: "C:\Program Files\Safari\Safari.exe" /reinstall [2010/11/03 20:11:24 | 002,388,264 | —- | M] (Apple Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\\HideIconsCommand: "C:\Program Files\Safari\Safari.exe" /hideicons [2010/11/03 20:11:24 | 002,388,264 | —- | M] (Apple Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\\ShowIconsCommand: "C:\Program Files\Safari\Safari.exe" /showicons [2010/11/03 20:11:24 | 002,388,264 | —- | M] (Apple Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\shell\open\command\\: "C:\Program Files\Safari\Safari.exe" [2010/11/03 20:11:24 | 002,388,264 | —- | M] (Apple Inc.)

========== Alternate Data Streams ==========

@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1

< End of report >

Here is the aswMBR Log:
aswMBR version 0.9.6.399 Copyright© 2011 AVAST Software
Run date: 2011-06-18 21:26:05
—————————–
21:26:05.968 OS Version: Windows 5.1.2600 Service Pack 3
21:26:05.968 Number of processors: 1 586 0xA00
21:26:05.968 ComputerName: MORTON UserName: Owner
21:26:09.125 Initialize success
21:27:19.140 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
21:27:19.140 Disk 0 Vendor: SAMSUNG_SV1204H RK100-11 Size: 114498MB BusType: 3
21:27:21.171 Disk 0 MBR read successfully
21:27:21.171 Disk 0 MBR scan
21:27:21.171 Disk 0 unknown MBR code
21:27:23.171 Disk 0 scanning sectors +234465840
21:27:23.203 Disk 0 scanning C:\WINDOWS\system32\drivers
21:27:33.750 Service scanning
21:27:34.812 Disk 0 trace - called modules:
21:27:34.828 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8929f1ed]<<
21:27:34.828 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89389ab8]
21:27:34.828 3 CLASSPNP.SYS[f7637fd7] -> nt!IofCallDriver -> \Device\00000065[0x8938cf18]
21:27:34.828 5 ACPI.sys[f75ae620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8938e940]
21:27:34.828 \Driver\atapi[0x8930e208] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x8929f1ed
21:27:35.343 Scan finished successfully
21:28:39.546 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Owner\My Documents\MBR.dat"
21:28:39.562 The log file has been saved successfully to "C:\Documents and Settings\Owner\My Documents\aswMBR_Scan_20110618_2128.txt"

Essexboy

Post #4June 19, 2011, 9:29 AM UTC

Hmm one did not want to die - lets try that again and have a quick fix on the MBR. What are your current problems ?

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
[2011/06/08 23:51:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\eN28321MbDgN28321

:Files
ipconfig /flushdns /c
C:\Documents and Settings\All Users\Application Data\eN28321MbDgN28321

:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]
Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.

🖼Click to load external image (Posted Image)
If an infected file is detected, the default action will be Cure, click on Continue.

🖼Click to load external image (Posted Image)
If a suspicious file is detected, the default action will be Skip, click on Continue.

🖼Click to load external image (Posted Image)
It may ask you to reboot the computer to complete the process. Click on Reboot Now.

🖼Click to load external image (Posted Image)
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

hsvtiger

Post #5June 19, 2011, 3:29 PM UTC

As instructed, I ran OTL RunFix, ReBooted, and then ran OTL QuickScan.

Here is the OTL QuickScan Log:
OTL logfile created on: 6/19/2011 9:37:39 AM - Run 3
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.19 Gb Total Physical Memory | 0.50 Gb Available Physical Memory | 42.30% Memory free
2.84 Gb Paging File | 2.27 Gb Available in Paging File | 80.03% Paging File free
Paging file location(s): C:\pagefile.sys 1824 3648 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 107.36 Gb Total Space | 31.43 Gb Free Space | 29.27% Space Free | Partition Type: NTFS
Drive D: | 4.43 Gb Total Space | 0.67 Gb Free Space | 15.15% Space Free | Partition Type: FAT32

Computer Name: MORTON | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Real\RealOne Player\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\SelectRebates\SelectRebates.exe ()
PRC - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Lexmark Pro800-Pro900 Series\ezprint.exe ()
PRC - C:\Program Files\Lexmark Pro800-Pro900 Series\lxecmon.exe ()
PRC - C:\WINDOWS\system32\lxeccoms.exe ( )
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Garmin\gStart.exe (GARMIN Corp.)
PRC - C:\Program Files\Softex\OmniPass\omniServ.exe ()
PRC - C:\Program Files\Softex\OmniPass\OPXPApp.exe ()
PRC - C:\WINDOWS\wt\updater\wcmdmgr.exe (WildTangent, Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\ddraw.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\dciman32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\nview.dll (NVIDIA Corporation)

========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – File not found
SRV - (AVG Security Toolbar Service) – C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe ()
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (IntuitUpdateService) – C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (lxec_device) – C:\WINDOWS\System32\lxeccoms.exe ( )
SRV - (lxecCATSCustConnectService) – C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxecserv.exe ()
SRV - (omniserv) – C:\Program Files\Softex\OmniPass\omniServ.exe ()
SRV - (Pml Driver HPH11) – C:\WINDOWS\system32\hphipm11.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (MBAMSwissArmy) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)
DRV - (S3Psddr) – C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (MxlW2k) – C:\WINDOWS\System32\drivers\MxlW2k.sys (MusicMatch, Inc.)
DRV - (ltmodem5) – C:\WINDOWS\system32\drivers\ltmdmnt.sys (LT)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (fasttx2k) – C:\WINDOWS\System32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.)
DRV - (viaagp1) – C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (SISAGP) – C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (NVENET) – C:\WINDOWS\system32\drivers\NVENET.sys (NVIDIA Corporation)
DRV - (nv_agp) – C:\WINDOWS\System32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (AN983) – C:\WINDOWS\system32\drivers\an983.sys (ADMtek Incorporated.)
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us8.hpwis.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us8.hpwis.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com/
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1;localhost;*.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/02/06 14:49:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/06/09 21:26:21 | 000,000,000 | —D | M]

O1 HOSTS File: ([2011/06/19 09:20:39 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (Lexmark Printable Web) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll ()
O2 - BHO: (ShopAtHomeIEHelper Class) - {E8DAAA30-6CAA-4b58-9603-8E54238219E2} - C:\Program Files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll (ShopAtHome.com)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Client\YontooIEClient.dll (Yontoo Technology, Inc.)
O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (ShopAtHome.com Toolbar) - {98279C38-DE4B-4bcf-93C9-8EC26069D6F4} - C:\Program Files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll (ShopAtHome.com)
O3 - HKLM\..\Toolbar: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKLM\..\Toolbar: (hp toolkit) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\hp\EXPLOREBAR\HPTOOLKT.DLL (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\ShellBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKCU\..\Toolbar\ShellBrowser: (hp toolkit) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\hp\EXPLOREBAR\HPTOOLKT.DLL (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (ShopAtHome.com Toolbar) - {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - C:\Program Files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll (ShopAtHome.com)
O3 - HKCU\..\Toolbar\WebBrowser: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (hp toolkit) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\hp\EXPLOREBAR\HPTOOLKT.DLL (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark Pro800-Pro900 Series\ezprint.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [lxecmon.exe] C:\Program Files\Lexmark Pro800-Pro900 Series\lxecmon.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [PS2] C:\WINDOWS\system32\ps2.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [SelectRebates] C:\Program Files\SelectRebates\SelectRebates.exe ()
O4 - HKLM..\Run: [StorageGuard] C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realone player\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe (WildTangent, Inc.)
O4 - HKCU..\Run: [gStart] C:\Garmin\gStart.exe (GARMIN Corp.)
O4 - HKCU..\Run: [NVIEW] C:\WINDOWS\System32\nview.dll (NVIDIA Corporation)
O4 - HKCU..\Run: [NvMediaCenter] C:\WINDOWS\System32\NVMCTRAY.DLL (NVIDIA Corporation)
O4 - HKCU..\RunOnce: [Shockwave Updater] File not found
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O15 - HKCU\..Trusted Domains: gateway.madisoncity.k12.al.us ([]* in Local intranet)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKCU\..Trusted Domains: listen.com ([www] http in Trusted sites)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} http://www.musicnotes.com/download/mnviewer.cab (Musicnotes Viewer)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} http://webiq005.webiqonline.com/WebIQ/Data…6-6D5536C585C9} (WebIQ Engine Application Object)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1223753926062 (WUWebControl Class)
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} http://www.facebook.com/controls/contactx.dll (ContactExtractor Class)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab (GMNRev Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} http://ak.imgag.com/imgag/cp/install/Crusher.cab (Creative Toolbox Plug-in)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab (PopCapLoader Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.3.0…inAxControl.CAB (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: PackageCab http://ak.imgag.com/imgag/cp/install/AxCtp2.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\OPXPGina: DllName - C:\Program Files\Softex\OmniPass\opxpgina.dll - C:\Program Files\Softex\OmniPass\OPXPGina.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/04/10 00:19:17 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 07:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2002/09/11 04:02:32 | 000,000,045 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O33 - MountPoints2\{d858f97b-fdc4-11df-8be0-000c6e5182ba}\Shell - "" = AutoRun
O33 - MountPoints2\{d858f97b-fdc4-11df-8be0-000c6e5182ba}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{d858f97b-fdc4-11df-8be0-000c6e5182ba}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL http://www.garmin.com/agent
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/06/18 21:25:12 | 000,581,120 | —- | C] (AVAST Software) – C:\Documents and Settings\Owner\Desktop\aswMBR.exe
[2011/06/18 20:56:26 | 000,000,000 | —D | C] – C:\_OTL
[2011/06/18 11:23:21 | 000,579,072 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/06/16 22:33:29 | 004,129,649 | —- | C] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe.exe
[2011/06/09 23:59:33 | 000,000,000 | -H-D | C] – C:\$AVG
[2011/06/09 21:31:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\AVG10
[2011/06/09 21:27:38 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/06/09 21:26:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2011/06/09 21:26:27 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\AVG 2011
[2011/06/09 21:23:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/06/09 21:23:37 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\AVG
[2011/06/09 21:21:52 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2011/06/09 21:09:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/06/06 20:59:49 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2011/06/03 16:55:11 | 000,000,000 | R–D | C] – C:\Documents and Settings\Owner\Recent
[2011/06/02 22:02:18 | 009,435,312 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup-1.51.0.1200.exe
[2011/05/30 08:00:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Earth
[2010/03/07 16:47:49 | 000,438,272 | —- | C] ( ) – C:\WINDOWS\System32\lxeccoin.dll
[2010/03/07 16:42:15 | 001,048,576 | —- | C] ( ) – C:\WINDOWS\System32\lxecserv.dll
[2010/03/07 16:42:15 | 000,847,872 | —- | C] ( ) – C:\WINDOWS\System32\lxecusb1.dll
[2010/03/07 16:42:15 | 000,643,072 | —- | C] ( ) – C:\WINDOWS\System32\lxecpmui.dll
[2010/03/07 16:42:15 | 000,364,544 | —- | C] ( ) – C:\WINDOWS\System32\lxecinpa.dll
[2010/03/07 16:42:15 | 000,356,352 | —- | C] ( ) – C:\WINDOWS\System32\LXEChcp.dll
[2010/03/07 16:42:15 | 000,344,064 | —- | C] ( ) – C:\WINDOWS\System32\lxeciesc.dll
[2010/03/07 16:42:14 | 000,802,816 | —- | C] ( ) – C:\WINDOWS\System32\lxeccomc.dll
[2010/03/07 16:42:14 | 000,688,128 | —- | C] ( ) – C:\WINDOWS\System32\lxechbn3.dll
[2010/03/07 16:42:14 | 000,598,696 | —- | C] ( ) – C:\WINDOWS\System32\lxeccoms.exe
[2010/03/07 16:42:14 | 000,577,536 | —- | C] ( ) – C:\WINDOWS\System32\lxeclmpm.dll
[2010/03/07 16:42:14 | 000,373,416 | —- | C] ( ) – C:\WINDOWS\System32\lxeccfg.exe
[2010/03/07 16:42:14 | 000,372,736 | —- | C] ( ) – C:\WINDOWS\System32\lxeccomm.dll
[2010/03/07 16:42:14 | 000,324,264 | —- | C] ( ) – C:\WINDOWS\System32\lxecih.exe
[1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/19 09:32:41 | 000,000,278 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2646380841-1092760190-1851676499-1003.job
[2011/06/19 09:32:39 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2646380841-1092760190-1851676499-1003.job
[2011/06/19 09:29:14 | 000,000,248 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2011/06/19 09:29:01 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/19 09:29:00 | 000,000,396 | —- | M] () – C:\WINDOWS\tasks\DriverCure Startup.job
[2011/06/19 09:28:10 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/19 09:28:06 | 1274,466,304 | -HS- | M] () – C:\hiberfil.sys
[2011/06/19 09:20:39 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2011/06/19 09:18:31 | 119,179,087 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/06/19 09:04:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/18 22:11:09 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/06/18 21:28:39 | 000,000,512 | —- | M] () – C:\Documents and Settings\Owner\My Documents\MBR.dat
[2011/06/18 21:25:13 | 000,581,120 | —- | M] (AVAST Software) – C:\Documents and Settings\Owner\Desktop\aswMBR.exe
[2011/06/18 19:00:00 | 000,000,254 | —- | M] () – C:\WINDOWS\tasks\RMSchedule.job
[2011/06/18 17:28:54 | 119,073,882 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm.old
[2011/06/18 11:22:07 | 000,579,072 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/06/17 19:31:29 | 000,019,968 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/17 03:27:02 | 000,000,380 | —- | M] () – C:\WINDOWS\tasks\DriverCure.job
[2011/06/16 22:33:39 | 004,129,649 | —- | M] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe.exe
[2011/06/16 22:26:30 | 001,314,301 | —- | M] () – C:\Documents and Settings\Owner\Desktop\bleepingcomputer_combofix_how-to-use-combofix.pdf
[2011/06/11 15:38:08 | 000,002,427 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Paint Shop Pro 7.lnk
[2011/06/09 22:52:47 | 000,312,630 | —- | M] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER_RevA.jpg
[2011/06/09 22:36:48 | 000,686,378 | —- | M] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER.psp
[2011/06/09 21:26:28 | 000,000,701 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/06/09 19:54:47 | 001,253,318 | —- | M] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER.jpg
[2011/06/09 13:32:25 | 001,228,854 | —- | M] () – C:\fsqwr.bmp
[2011/06/08 19:08:05 | 000,016,502 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Madison PHX_BUSA-3v3_Roster_RevA.pdf
[2011/06/06 21:45:50 | 000,016,729 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Warriors Tournament Stats.html
[2011/06/04 20:53:52 | 000,075,680 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Rhyan_Comprehensive Progress Report_20110604.pdf
[2011/06/04 20:35:15 | 000,071,355 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Jared_Comprehensive Progress Report_20110604.pdf
[2011/06/03 21:43:48 | 000,606,105 | —- | M] () – C:\Program Files\unhide.exe
[2011/06/03 06:50:52 | 000,001,740 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/06/02 22:41:42 | 000,000,795 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/02 22:18:54 | 001,007,108 | —- | M] () – C:\Documents and Settings\Owner\Desktop\rkill.exe
[2011/06/02 21:49:44 | 009,435,312 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup-1.51.0.1200.exe
[2011/06/02 11:43:50 | 000,002,187 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/05/31 21:35:39 | 000,091,259 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Conexis Payment Receipt_20110531.pdf
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/28 09:18:00 | 000,000,430 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.ics
[1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/19 09:18:31 | 119,179,087 | —- | C] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/06/18 21:28:39 | 000,000,512 | —- | C] () – C:\Documents and Settings\Owner\My Documents\MBR.dat
[2011/06/18 17:28:54 | 119,073,882 | —- | C] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm.old
[2011/06/16 22:26:27 | 001,314,301 | —- | C] () – C:\Documents and Settings\Owner\Desktop\bleepingcomputer_combofix_how-to-use-combofix.pdf
[2011/06/15 17:57:56 | 1274,466,304 | -HS- | C] () – C:\hiberfil.sys
[2011/06/09 22:52:46 | 000,312,630 | —- | C] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER_RevA.jpg
[2011/06/09 22:00:13 | 000,686,378 | —- | C] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER.psp
[2011/06/09 21:26:28 | 000,000,701 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/06/09 19:54:47 | 001,253,318 | —- | C] () – C:\Documents and Settings\Owner\My Documents\MADISON PHOENIX SOCCER.jpg
[2011/06/09 00:27:24 | 001,228,854 | —- | C] () – C:\fsqwr.bmp
[2011/06/08 19:08:05 | 000,016,502 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Madison PHX_BUSA-3v3_Roster_RevA.pdf
[2011/06/06 21:45:50 | 000,016,729 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Warriors Tournament Stats.html
[2011/06/04 20:53:52 | 000,075,680 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Rhyan_Comprehensive Progress Report_20110604.pdf
[2011/06/04 20:35:15 | 000,071,355 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Jared_Comprehensive Progress Report_20110604.pdf
[2011/06/03 22:11:43 | 000,002,393 | —- | C] () – C:\Documents and Settings\All Users\Desktop\TurboTax 2010.lnk
[2011/06/03 22:11:43 | 000,002,393 | —- | C] () – C:\Documents and Settings\All Users\Desktop\TurboTax 2008.lnk
[2011/06/03 22:11:43 | 000,002,187 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/06/03 22:11:43 | 000,002,069 | —- | C] () – C:\Documents and Settings\All Users\Desktop\WordPerfect Task Manager.lnk
[2011/06/03 22:11:43 | 000,001,854 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/06/03 22:11:43 | 000,001,845 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Re-enable Updates from HP.lnk
[2011/06/03 22:11:43 | 000,001,286 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Visit Lexmark SmartSolutions.LNK
[2011/06/03 22:11:43 | 000,000,826 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/06/03 22:11:43 | 000,000,811 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/06/03 22:11:43 | 000,000,767 | —- | C] () – C:\Documents and Settings\All Users\Desktop\RealPlayer.lnk
[2011/06/03 22:11:43 | 000,000,717 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Register with HP.lnk
[2011/06/03 22:11:43 | 000,000,659 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Rhapsody.lnk
[2011/06/03 22:11:43 | 000,000,641 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Rhapsody.lnk
[2011/06/03 22:11:43 | 000,000,079 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/06/03 22:11:43 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Software Offers.hp9
[2011/06/03 22:11:42 | 000,002,427 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Paint Shop Pro 7.lnk
[2011/06/03 22:11:42 | 000,001,906 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Play Manager Soccer Professional Edition.lnk
[2011/06/03 22:11:42 | 000,001,858 | —- | C] () – C:\Documents and Settings\All Users\Desktop\MSN Explorer.lnk
[2011/06/03 22:11:42 | 000,001,751 | —- | C] () – C:\Documents and Settings\All Users\Desktop\musicmatch JUKEBOX.lnk
[2011/06/03 22:11:42 | 000,001,651 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Quicken 2003 New User Edition.lnk
[2011/06/03 22:11:42 | 000,001,615 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2011/06/03 22:11:42 | 000,001,553 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/06/03 22:11:42 | 000,001,466 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Tour Guide.lnk
[2011/06/03 22:11:42 | 000,001,439 | —- | C] () – C:\Documents and Settings\All Users\Desktop\MapInstall.lnk
[2011/06/03 22:11:42 | 000,000,905 | —- | C] () – C:\Documents and Settings\All Users\Desktop\OpenOffice.lnk
[2011/06/03 22:11:42 | 000,000,825 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Launch Lexmark Printer Home.LNK
[2011/06/03 22:11:42 | 000,000,795 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/03 22:11:42 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Desktop\My HP Club.hp11
[2011/06/03 22:11:42 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Music and Games for My PC.hp2
[2011/06/03 22:11:41 | 000,001,740 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/06/03 22:11:41 | 000,001,602 | —- | C] () – C:\Documents and Settings\All Users\Desktop\EMusic Downloads.lnk
[2011/06/03 22:11:41 | 000,001,561 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Picture Toolkit.lnk
[2011/06/03 22:11:41 | 000,001,552 | —- | C] () – C:\Documents and Settings\All Users\Desktop\About my HP PC.lnk
[2011/06/03 22:11:41 | 000,001,501 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Recovery.lnk
[2011/06/03 22:11:41 | 000,001,055 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Create & Print Home.url
[2011/06/03 22:11:41 | 000,000,925 | —- | C] () – C:\Documents and Settings\All Users\Desktop\gm_cakesbarscookies.lnk
[2011/06/03 22:11:41 | 000,000,862 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Photo & Imaging.lnk
[2011/06/03 22:11:41 | 000,000,862 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Director.lnk
[2011/06/03 22:11:41 | 000,000,745 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Acrobat.com.lnk
[2011/06/03 22:11:41 | 000,000,700 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CamStudio.lnk
[2011/06/03 22:11:41 | 000,000,104 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Help and Support.lnk
[2011/06/03 21:55:02 | 000,606,105 | —- | C] () – C:\Program Files\unhide.exe
[2011/06/02 22:36:20 | 001,007,108 | —- | C] () – C:\Documents and Settings\Owner\Desktop\rkill.exe
[2011/05/31 21:35:38 | 000,091,259 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Conexis Payment Receipt_20110531.pdf
[2011/02/07 16:21:25 | 000,179,512 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/12/09 12:47:34 | 000,177,798 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2010/08/15 09:54:34 | 000,005,308 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/08/05 14:07:25 | 000,009,136 | —- | C] () – C:\WINDOWS\System32\Inetwh16.dll
[2010/03/07 16:47:53 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxecvs.dll
[2010/03/07 16:47:37 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\lxecgcfg.dll
[2010/03/07 16:47:36 | 000,294,912 | —- | C] () – C:\WINDOWS\System32\lxeccui.dll
[2010/03/07 16:47:36 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\lxeccuir.dll
[2010/03/07 16:42:33 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\lxecrwrd.ini
[2010/03/07 16:42:15 | 000,385,024 | —- | C] () – C:\WINDOWS\System32\LXECinst.dll
[2010/03/07 16:42:14 | 000,323,584 | —- | C] () – C:\WINDOWS\System32\lxecins.dll
[2010/03/07 16:42:14 | 000,262,144 | —- | C] () – C:\WINDOWS\System32\lxecinsb.dll
[2010/03/07 16:42:14 | 000,253,952 | —- | C] () – C:\WINDOWS\System32\lxeccu.dll
[2010/03/07 16:42:14 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lxecgrd.dll
[2010/03/07 16:42:14 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\lxecinsr.dll
[2010/03/07 16:42:14 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\lxeccub.dll
[2010/03/07 16:42:14 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\lxecjswr.dll
[2010/03/07 16:42:14 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\lxeccur.dll
[2010/03/07 16:35:03 | 000,023,552 | —- | C] () – C:\WINDOWS\System32\LXECsmr.dll
[2010/03/07 16:35:02 | 000,299,008 | —- | C] () – C:\WINDOWS\System32\LXECsm.dll
[2009/12/26 00:36:04 | 000,043,948 | —- | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/12/04 16:33:31 | 000,000,359 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2009/09/26 19:28:41 | 000,000,318 | —- | C] () – C:\Documents and Settings\Owner\Application Data\1c64-ec47-1438-983d_6279rc
[2009/03/20 10:56:27 | 000,091,520 | —- | C] () – C:\WINDOWS\System32\WebIQEngineSetup.exe
[2009/02/21 07:13:43 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2008/12/13 11:21:59 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2008/10/14 23:32:58 | 000,019,968 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/10/13 23:14:21 | 000,000,022 | —- | C] () – C:\WINDOWS\exchng.ini
[2008/10/13 22:42:36 | 000,000,611 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/10/13 22:06:22 | 000,019,558 | —- | C] () – C:\WINDOWS\hpoins01.dat
[2008/10/13 22:06:22 | 000,016,606 | —- | C] () – C:\WINDOWS\hpomdl01.dat
[2008/10/13 22:02:01 | 000,061,678 | —- | C] () – C:\Documents and Settings\Owner\Application Data\PFP100JPR.{PB
[2008/10/13 22:02:01 | 000,012,358 | —- | C] () – C:\Documents and Settings\Owner\Application Data\PFP100JCM.{PB
[2008/10/11 18:35:20 | 000,006,550 | —- | C] () – C:\WINDOWS\jautoexp.dat
[2008/10/11 14:56:02 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2008/10/11 14:30:19 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2008/02/04 19:23:10 | 000,693,792 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2003/04/10 06:35:00 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/04/10 06:34:24 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\iAlmcoin.dll
[2003/04/10 06:21:36 | 000,000,051 | —- | C] () – C:\WINDOWS\System32\mshrml.ini
[2003/04/10 03:51:07 | 000,000,438 | —- | C] () – C:\WINDOWS\System32\1_ssetup.ini
[2003/04/10 03:51:07 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\sunistlog.ini
[2003/04/10 02:32:34 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2003/04/10 02:32:34 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2003/04/10 02:06:10 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2003/04/10 02:04:00 | 000,090,112 | R— | C] () – C:\WINDOWS\bwUnin-6.2.3.66.exe
[2003/04/10 02:03:38 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2003/04/10 02:03:38 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\syscontr.dll
[2003/04/10 01:57:15 | 000,000,052 | —- | C] () – C:\WINDOWS\intuprof.ini
[2003/04/10 01:57:04 | 000,000,626 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2003/04/10 01:16:44 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/04/10 01:06:59 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\sis740.bin
[2003/04/10 01:06:59 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\sis650.bin
[2003/04/10 00:59:54 | 000,001,024 | —- | C] () – C:\WINDOWS\System32\drivers\jedih2rx.bin
[2003/04/10 00:59:54 | 000,000,122 | —- | C] () – C:\WINDOWS\System32\drivers\ramsed.bin
[2003/04/10 00:55:02 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/04/10 00:44:58 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2003/04/10 00:44:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2003/04/10 00:44:29 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2003/04/10 00:23:21 | 000,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/04/10 00:21:27 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2003/04/10 00:16:07 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2003/04/10 00:05:45 | 000,000,659 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/04/10 00:05:26 | 000,474,322 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2003/04/10 00:05:26 | 000,076,172 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2003/04/09 17:10:31 | 000,004,346 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/04/09 17:09:25 | 000,211,288 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2003/03/19 18:50:18 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2002/11/14 10:09:12 | 000,036,864 | —- | C] () – C:\WINDOWS\hpfsched.exe
[2002/11/14 10:08:26 | 000,004,760 | —- | C] () – C:\WINDOWS\hphmdl11.dat
[2002/05/24 10:00:00 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lockout.dll
[2002/05/24 10:00:00 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\lockres.dll
[2001/08/14 20:47:08 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\vxpsapi.dll
[2001/07/13 08:04:00 | 000,373,248 | —- | C] () – C:\WINDOWS\EyeCand3.INI
[2001/01/03 08:38:54 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2001/01/03 08:38:53 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2001/01/03 08:38:32 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2001/01/03 08:38:28 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2001/01/03 08:11:26 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2001/01/03 08:11:26 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2001/01/03 08:11:23 | 000,004,490 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2001/01/03 08:11:19 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2001/01/03 08:11:14 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[1996/11/17 01:00:00 | 000,047,104 | —- | C] () – C:\WINDOWS\System32\WRKGADM.EXE
[1996/11/17 01:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\ODBCSTF.DLL
[1996/11/17 01:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\DOCOBJ.DLL
[1996/11/17 01:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL

========== LOP Check ==========

[2011/06/09 21:31:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2011/06/09 21:28:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/06/09 21:27:38 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2010/09/08 21:44:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DriverCure
[2008/10/19 17:55:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Jes-Soft
[2010/08/10 22:37:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Lexmark Pro800-Pro900 Series
[2011/06/09 21:31:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2009/05/24 20:42:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Musicnotes
[2008/10/25 16:44:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2011/01/20 15:58:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2011/06/07 07:03:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/07/04 16:07:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/12/25 13:38:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/05/24 09:54:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/06/09 21:31:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVG10
[2010/09/08 20:52:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\DriverCure
[2010/12/03 21:39:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\GARMIN
[2011/06/17 20:45:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\interMute
[2003/04/10 01:52:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InterTrust
[2008/11/10 20:06:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InterVideo
[2009/09/26 19:28:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\My Sam's Club Digital Photo Center
[2008/10/18 13:08:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\OpenOffice.org
[2003/04/10 02:04:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SampleView
[2010/05/20 21:22:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Unity
[2008/10/14 22:14:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\VERITAS
[2009/08/19 20:11:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\W Photo Studio Viewer
[2011/06/19 09:29:00 | 000,000,396 | —- | M] () – C:\WINDOWS\Tasks\DriverCure Startup.job
[2011/06/17 03:27:02 | 000,000,380 | —- | M] () – C:\WINDOWS\Tasks\DriverCure.job
[2011/06/18 19:00:00 | 000,000,254 | —- | M] () – C:\WINDOWS\Tasks\RMSchedule.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1

< End of report >

I followed the instructions for downloading and running tdsskiller, but after extracting and double-clicking on tdsskiller.exe, it would NEVER run. (???)

I am not currently experiencing any serious symptoms, although I am getting a couple of "hollywood-related" IE windows popping up from "nowhere". Again, my original problem was that I could not completely eradicate the virus and I do NOT know that this problem has been solved. Thx!

Essexboy

Post #6June 19, 2011, 3:42 PM UTC

Ok the inability of TDSSKiller to run suggest a TDL3 variant - I am afraid I will have to remove AVG. You will need a fresh copy of combofix as well

OK I will need to use a stronger tool, unfortunately it will mean uninstalling AVG for the duration

We need to temporarily remove your Anti-Virus, as it interferes with the fix I want to run. You can reinstall it again later. If you are not happy about doing this, please let me know before proceding

Download a fresh copy of AVG to your desktop
Download the AVG removal tool to your desktop
Download AppRemover .

Uninstall AVG via Programmes and Features
Run the AVG removal tool

Run appremover
Click Next >>
[external image: Posted Image]

Ensure "Remove Security Application" is collected and click Next >>
[external image: Posted Image]

AppRemover will scan all the security applications on your PC
[external image: Posted Image]

Select Any AVG entries from the applications offered and click Next >> twice.
[external image: Posted Image]

Follow any further on-screen instructions. If asked to reboot,please do so.

Note: Please do not browse the internet or open any email attachments until your Anti-Virus is re-installed

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

hsvtiger

Post #7June 19, 2011, 3:43 PM UTC

I did re-run AVG and it is still reporting these locations as being infected with Cryptic.CYK: C:\WINDOWS\system32\services.exe (1032):\memory_001b0000 C:\WINDOWS\explorer.exe (3080):\memory_001b0000 C:\Program Files\Internet Explorer\iexplore.exe (3716):\memory_00270000 C:\Program Files\Internet Explorer\iexplore.exe (2392):\memory_00270000

Essexboy

Post #8June 19, 2011, 3:55 PM UTC

Yep we need to run combofix as that is an indication along with the inability of TDSSKiller to run If you do not wish to uninstall AVG I can use another programme but it will take an hour or so to run

hsvtiger

Post #9June 19, 2011, 5:42 PM UTC

ComboFix 11-06-17.04 - Owner 06/19/2011 11:59:54.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1215.845 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\Tarma Installer
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\Owner\Templates\2jfc8wwm7ycpfm031iq1747w633v26o7v3ik
c:\documents and settings\Owner\WINDOWS
c:\program files\Search Toolbar
c:\program files\Search Toolbar\icon.ico
c:\program files\Search Toolbar\SearchToolbar.dll
c:\program files\Search Toolbar\SearchToolbarUninstall.exe
c:\program files\Search Toolbar\SearchToolbarUpdater.exe
c:\program files\SelectRebates
c:\program files\SelectRebates\FFToolbar\chrome.manifest
c:\program files\SelectRebates\FFToolbar\chrome\sahtoolbar.jar
c:\program files\SelectRebates\FFToolbar\defaults\preferences\sahtoolbar.js
c:\program files\SelectRebates\FFToolbar\install.rdf
c:\program files\SelectRebates\SahImages\alert.png
c:\program files\SelectRebates\SahImages\check.png
c:\program files\SelectRebates\SahImages\close.png
c:\program files\SelectRebates\SelectAlerts.dat
c:\program files\SelectRebates\SelectRebates.exe
c:\program files\SelectRebates\SelectRebates.ini
c:\program files\SelectRebates\SelectRebatesA.dat
c:\program files\SelectRebates\SelectRebatesApi.exe
c:\program files\SelectRebates\SelectRebatesB.dat
c:\program files\SelectRebates\SelectRebatesBT.dat
c:\program files\SelectRebates\SelectRebatesDownload.exe
c:\program files\SelectRebates\SelectRebatesH.dat
c:\program files\SelectRebates\SelectRebatesUninstall.exe
c:\program files\SelectRebates\SRebates.dll
c:\program files\SelectRebates\SRFF3.dll
c:\program files\SelectRebates\Toolbar\AddtoList.bmp
c:\program files\SelectRebates\Toolbar\basis.xml
c:\program files\SelectRebates\Toolbar\Basis.xml.dym
c:\program files\SelectRebates\Toolbar\Blank.bmp
c:\program files\SelectRebates\Toolbar\CashBack.bmp
c:\program files\SelectRebates\Toolbar\Coupons.bmp
c:\program files\SelectRebates\Toolbar\GroceryCoupon.bmp
c:\program files\SelectRebates\Toolbar\i_magnifying.bmp
c:\program files\SelectRebates\Toolbar\icons.bmp
c:\program files\SelectRebates\Toolbar\logo.bmp
c:\program files\SelectRebates\Toolbar\logo_24.bmp
c:\program files\SelectRebates\Toolbar\logo_HotSpots.bmp
c:\program files\SelectRebates\Toolbar\ReviewSite.bmp
c:\program files\SelectRebates\Toolbar\RightControls.dym
c:\program files\SelectRebates\Toolbar\sahtb-alert.bmp
c:\program files\SelectRebates\Toolbar\sahtb-go.bmp
c:\program files\SelectRebates\Toolbar\sahtb-grocerycoupons.bmp
c:\program files\SelectRebates\Toolbar\sahtb-icons.bmp
c:\program files\SelectRebates\Toolbar\sahtb-restaurant.bmp
c:\program files\SelectRebates\Toolbar\sahtb-wishlist.bmp
c:\program files\SelectRebates\Toolbar\Scissors.bmp
c:\program files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll
c:\windows\Downloaded Program Files\popcaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\system32\config\systemprofile\WINDOWS
D:\Autorun.inf
.
Infected copy of c:\windows\system32\drivers\volsnap.sys was found and disinfected
Restored copy from - Kitty had a snack

.
((((((((((((((((((((((((( Files Created from 2011-05-19 to 2011-06-19 )))))))))))))))))))))))))))))))
.
.
2011-06-19 16:39 . 2011-06-19 16:39 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2011-06-19 01:56 . 2011-06-19 01:56 ——– d—–w- C:\_OTL
2011-06-10 02:27 . 2011-06-10 02:27 ——– d–h–w- c:\documents and settings\All Users\Application Data\Common Files
2011-06-10 02:23 . 2011-06-19 16:42 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG10
2011-06-10 02:09 . 2011-06-19 16:40 ——– d—–w- c:\documents and settings\All Users\Application Data\MFAData
2011-06-04 02:55 . 2011-06-04 02:43 606105 —-a-w- c:\program files\unhide.exe
2011-05-30 12:59 . 2011-05-30 12:59 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2011-05-30 03:03 . 2011-05-30 03:03 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-29 14:11 . 2011-02-26 01:49 39984 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
2010-12-20 18:09 191488 ——w- c:\program files\Yontoo Layers Client\YontooIEClient.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"="nview.dll" [2003-07-28 852038]
"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-07-28 49152]
"gStart"="c:\garmin\gStart.exe" [2005-01-20 1896448]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-14 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-03-12 114688]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440]
"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]
"nwiz"="nwiz.exe" [2003-07-28 323584]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 57344]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"wcmdmgr"="c:\windows\wt\updater\wcmdmgrl.exe" [2002-09-27 20480]
"lxecmon.exe"="c:\program files\Lexmark Pro800-Pro900 Series\lxecmon.exe" [2010-01-18 770728]
"EzPrint"="c:\program files\Lexmark Pro800-Pro900 Series\ezprint.exe" [2010-01-18 139944]
"TkBellExe"="c:\program files\real\realone player\update\realsched.exe" [2011-02-06 273544]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-02 421160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
.
c:\documents and settings\Owner\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2003-02-21 10:50 40960 —-a-w- c:\program files\Softex\OmniPass\OPXPGina.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Updates from HP\\137903\\Program\\BackWeb-137903.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\lxeccoms.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R2 lxec_device;lxec_device;c:\windows\system32\lxeccoms.exe -service –> c:\windows\system32\lxeccoms.exe -service [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 2:16 PM 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/1/2010 8:34 AM 135664]
S2 lxecCATSCustConnectService;lxecCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxecserv.exe [3/7/2010 4:47 PM 98984]
S2 mrtRate;mrtRate; [x]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/1/2010 8:34 AM 135664]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2/25/2011 8:49 PM 39984]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 2:16 PM 753504]
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
.
2011-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 13:34]
.
2011-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 13:34]
.
2011-06-19 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2646380841-1092760190-1851676499-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 20:25]
.
2011-06-19 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2646380841-1092760190-1851676499-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 20:25]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://srch-us8.hpwis.com/
mSearch Bar = hxxp://srch-us8.hpwis.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1;localhost;*.local
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
Trusted Zone: intuit.com\ttlc
Trusted Zone: listen.com\www
TCP: DhcpNameServer = [removed] [removed]
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: PackageCab - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-SelectRebates - c:\program files\SelectRebates\SelectRebates.exe
AddRemove-Search Toolbar - c:\program files\Search Toolbar\SearchToolbarUninstall.exe
AddRemove-{889DF117-14D1-44EE-9F31-C5FB5D47F68B} - c:\docume~1\ALLUSE~1\APPLIC~1\TARMAI~1\{889DF~1\Setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-19 12:09
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-2646380841-1092760190-1851676499-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(524)
c:\program files\Softex\OmniPass\opxpgina.dll
.
Completion time: 2011-06-19 12:13:13
ComboFix-quarantined-files.txt 2011-06-19 17:12
.
Pre-Run: 33,957,322,752 bytes free
Post-Run: 33,975,242,752 bytes free
.
- - End Of File - - E3AE3F4081E73326C14DAE487BAEE931

Essexboy

Post #10June 19, 2011, 5:46 PM UTC

Infected copy of c:\windows\system32\drivers\volsnap.sys was found and disinfected
Restored copy from - Kitty had a snack

Gotcha

You can now re-install AVG and the alerts should be gone

[external image: Posted Image] Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

hsvtiger

Post #11June 19, 2011, 8:36 PM UTC

Below is the Malwarebytes log.
I also re-installed and ran AVG. It got about 80% thru and seemed to really slow down (or maybe I just got impatient).
To that point, the AVG Log had only found one virus (don't recall the name, but it wasn't Cryptic.CYK) and was able to clean it.
However, it was way past the point that it had previously been finding Cryptic.CYK, so that's a good sign.
Anyway, I terminated the AVG run, so I could get you this MWB Log you asked for.
I will re-run AVG and post those results later, but so far it looks very encouraging

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6845

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

6/19/2011 3:16:54 PM
mbam-log-2011-06-19 (15-16-53).txt

Scan type: Quick scan
Objects scanned: 154986
Time elapsed: 17 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Essexboy

Post #12June 19, 2011, 8:39 PM UTC

When you get a chance could you look at the AVG log to see what I missed

Once you are happy I will remove my tools and tidy you up

hsvtiger

Post #13June 19, 2011, 9:56 PM UTC

I re-ran AVG and it came up CLEAN! So, I think I'm good, do you agree? Thanks for all of your help!

Essexboy

Post #14June 19, 2011, 10:00 PM UTC

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day —– Your log now appears clean

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:Commands
[resethosts]
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done

Uninstall ComboFix

Remove Combofix now that we're done with it.

Please press the Windows Key and R on your keyboard. This will bring up the Run… command.
Now copy/paste this: ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /Uninstall, it needs to be there.

[external image: Posted Image]
Please follow the prompts to uninstall Combofix.
This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.
You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Do not show hidden files and folders.
Click Yes to confirm.
Click OK.

[external image: Posted Image] Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

Go to this site and click Do I have Java
It will check your current version and then offer to update to the latest version

SPRING CLEAN

Download and run Puran Disc Defragmenter
For the first run I would recommend a boot defrag and disk check

[external image: Posted Image]

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

[external image: Posted Image] Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe

Essexboy

Post #15June 21, 2011, 5:46 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Trojan Horse Cryptic.CYK

✨ Ask AI

Ask AI