What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Spyware Scan found Genome Torjans

32 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I do a Spyware Terminator scan every night and last night the scan showed Genome Trojans. Genome - 25, Genome - 99, Genome - 44 & Genome - 100. I'm not sure what to do. :pullhair: It looks like some of those are in the os/root or something like that. I will paste that part of the report that shows the Trojans. The whole report is 5 pages, I'm not sure if you need all of that. I was going to try and quarantine them but I didn't want to mess up my computer so I thought I'd check with you guys first to see what I should do. Please help!!!! Thank you! Threat Files : G:\Documents and Settings\All Users\Start Menu\Programs\Games\Spider Solitaire.lnk : G:\Documents and Settings\All Users\Start Menu\Programs\Games\Spider Solitaire.lnk : G:\Config.Msi\357eee4.rbf : G:\OS\ROOT\XP_PRO_ENG (D)\I386\FAXPATCH.EXE : G:\OS\ROOT\XP_PRO_ENG (D)\I386\FAXPATCH.EXE : G:\OS\ROOT\XP_PRO_ENG (D)\I386\TELNET.EXE : G:\OS\ROOT\XP_PRO_ENG (D)\I386\TELNET.EXE : G:\System Volume Information\_restore{76D333FC-8467-467F-BF58-B330FF9BE505}\RP315\A0043263.msi : G:\System Volume Information\_restore{76D333FC-8467-467F-BF58-B330FF9BE505}\RP356\A0047283.msi : G:\WINDOWS\$hf_mig$\KB2508429\SP3QFE\srv.sys : G:\WINDOWS\$NtUninstallKB960859_0$\telnet.exe : G:\WINDOWS\$NtUninstallKB960859_0$\telnet.exe : G:\WINDOWS\$NtUninstallKB980182$\iedw.exe : G:\WINDOWS\$NtUninstallKB980182$\iedw.exe
Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Watch Topic button to the right of your topic title and then choosing the notification method ( Recommended: Inmediate Notification)
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

**Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise, this will be a team effort. This may cause a delay, but I will do my best to keep it as short as possible. Please bear with me, I will post back to you as soon as I can.**

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
Post #3

Threat Files
: G:\Documents and Settings\All Users\Start Menu\Programs\Games\Spider Solitaire.lnk
: G:\Documents and Settings\All Users\Start Menu\Programs\Games\Spider Solitaire.lnk
: G:\Config.Msi\357eee4.rbf

*** : G:\OS\ROOT\XP_PRO_ENG (D)\I386\FAXPATCH.EXE
: G:\OS\ROOT\XP_PRO_ENG (D)\I386\FAXPATCH.EXE
: G:\OS\ROOT\XP_PRO_ENG (D)\I386\TELNET.EXE
: G:\OS\ROOT\XP_PRO_ENG (D)\I386\TELNET.EXE ***

: G:\System Volume Information\_restore{76D333FC-8467-467F-BF58-B330FF9BE505}\RP315\A0043263.msi
: G:\System Volume Information\_restore{76D333FC-8467-467F-BF58-B330FF9BE505}\RP356\A0047283.msi
: G:\WINDOWS\$hf_mig$\KB2508429\SP3QFE\srv.sys
: G:\WINDOWS\$NtUninstallKB960859_0$\telnet.exe
: G:\WINDOWS\$NtUninstallKB960859_0$\telnet.exe
: G:\WINDOWS\$NtUninstallKB980182$\iedw.exe
: G:\WINDOWS\$NtUninstallKB980182$\iedw.exe



Real quick….. I just realized something. I am testing a printer and they had me download a firmware file(some fixes) – it was either yesterday or the day before. When looking over the scan report again I'm wondering if the Trojans in between the *** (or even all of them) might have something to do with that download I did. It caught my eye because of where it says something about FAXPATCH and TELNET. I had to download a file, put it on a jump drive, then put it in the printer for an update. I wasn't really thinking about it but I really don't think I need to have that on my computer. But, can I just delete that file? I would think so but I thought I'd check first. And do you think that would remove those Trojans if I did. If that might even be the problem or part of the problem. That's the only thing I've downloaded lately. I just thought of this and figured I'd let you know in case it might help.

Thanks!
Post #4 last edited
Actually, since I moved the firmware update from my computer to the jump drive it shouldn't be on my computer any more, should it? Or do somethings still stay on my computer? Sorry to bother you again, I was just thinking about that. Also, I have an update that wants to install (the little yellow shield icon on the bottom task bar to the right)(probably from Microsoft), should I go ahead and do the update or should I wait until I get this other taken care of first? The only thing, if I wait sometimes it will automatically update. Sorry for throwing so much at you. Thanks.
Post #5
Hi candi7,

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

Please download aswMBR to your desktop.

  • Double click the aswMBR icon to run it.
    Vista and Windows 7 users right click the icon and choose "Run as administrator".
  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

In your next reply please post both the logs created by DDS and the log created by aswMBR. :)
Post #6 last edited
:smack: Well, I tried doing as you asked. I downloaded the DDS to my desktop. I clicked on the icon and a box came up to start the scan so I clicked start and nothing else, the scan started right away. The little ####'s went across the screen about 3/4 of the way then stopped. It said the scan shouldn't take more than 3 minutes, well I left it sit over night, about 7-8 hours and it was in the same place. I remember when I had a virus/ some problems before and I wrote in for some help I was asked to do the same thing. I remember the DDS name well because of the same thing happening. We spent a week or more just trying to get the DDS to work. Well, we never did. They had me do another scan instead. I'm not sure if there is any way you can go back and see when I had this problem the last time. When I got your reply and I read your notes, I got a little nervous when I seen the DDS but figured I'd give it a try and hope maybe things were different now but no such luck. So, I'm not sure what to do now. Also, yesterday I did a Spybot scan and a Malwarebytes scan but nothing showed up on either of those. But its still showing on the Spyware Terminator scan. And, I still have that little yellow shield down in the lower right task bar. I believe its some kind of a Microsoft update. Can I go ahead and install it and restart my computer? I think it already installed the one I was asking about yesterday because most of the day it kept asking me to restart my computer. Well, I missed it the one time and it restarted but the little yellow shield is back again.
Post #7
Well this is really weird! Last night/this mornings scan doesn't show those Trojans any more. The scan didn't show anything but when I looked thru the report I seen this ….. Threat Files : G:\Config.Msi\357eee4.rbf : G:\System Volume Information\_restore{76D333FC-8467-467F-BF58-B330FF9BE505}\RP356\A0047283.msi : Unless those are something really minor and not worth worring about. But it does say something (the last one) - Trojan.GenericFF-1. But on the main ending page of the scan it says " No Threats Found " This is pretty weird. Unless, I wonder if that update yesterday did something. The past few days or so my computer did seem a little slow but this morning it seems to be alright. Sorry to keep bothering you but I thought I should let you know. Thanks!
Post #8
Hi,

Jeff will be away for awhile, hope you dont mind me jumping in until his return


  • Please download rkill (Courtesy of Bleepingcomputer.com).
  • There are 5 different versions of this tool. If one of them will not run, please try the next one in the list.
  • Note: Vista and Windows 7 Users must right click and select "Run as Administrator" to run the tool.
  • Note: You only need to get one of the tools to run, not all of them.


1. rkill.exe
2. rkill.com
3. rkill.scr
4. WiNlOgOn.exe
5. uSeRiNiT.exe

Note: You will likely see a message from this rogue telling you the file is infected. Ignore the message. Leave the message OPEN, do not close the message.

Run rkill repeatedly until it's able to do it's job. This may take a few tries.

You'll be able to tell rkill has done it's job when your desktop (explorer.exe) cycles off and then on again.



Now try both aswMBR and DDS again, if still no luck than try this one

OTL by OldTimer
  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Click the "Scan All Users" checkbox.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
Post #9
Hi Ken,

Thanks for taking over for Jeff and helping me. Lately my computer seems to be running slower than usual. Today my internet froze a few times. I was going through some email and looking on some shopping sites and it would all the sudden freeze. The last time even the pointer froze. It didn't do that the 2 times before but it wouldn't do anything when I would try to click on something any way. I had to shut the computer down and start it back up to be able to do anything every time. So, it almost seems like I do have something going on. Its also pretty weird how those Genome Trojans just disappeared. My Spyware Terminator scan ran over night and this morning it said there were "No Threats Found" but when I looked through the report there were a few things listed there…….. (they kinda look like the same one's as on yesterday's scan)
Threat Files
: G:\Config.Msi\357eee4.rbf
: G:\System Volume Information\_restore{76D333FC-8467-467F-BF58-B330FF9BE505}\RP356\A0047283.msi
: G:\WINDOWS\$hf_mig$\KB2508429\SP3QFE\srv.sys

I did as you asked and downloaded the rkill and ran it. I'm pretty sure it did whatever it was supposed to because it almost seemed like my desktop reset(all the icons disappeared real quick but then came right back). I tried the to run the DDS again several times but it still wouldn't finish. I was able to run the aswMBR and the results are as follows -

aswMBR version 0.9.7.750 Copyright© 2011 AVAST Software
Run date: 2011-07-15 16:55:17
—————————–
16:55:17.000 OS Version: Windows 5.1.2600 Service Pack 3
16:55:17.000 Number of processors: 1 586 0x209
16:55:17.000 ComputerName: P-071A7C4D21704 UserName: Administrator
16:55:17.375 Initialize success
16:56:01.343 Service scanning
16:56:02.156 Disk 0 trace - called modules:
16:56:02.171 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
16:56:02.171 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8634fab8]
16:56:02.171 3 CLASSPNP.SYS[f74d7fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-e[0x863e3d98]
16:56:02.171 Scan finished successfully
16:57:46.218 The log file has been saved successfully to "G:\Documents and Settings\Administrator\Desktop\aswMBR.txt"


And I was able to run the OTL and the reports are as follows -

OTL.Txt

OTL logfile created on: 7/15/2011 5:18:17 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = G:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1021.98 Mb Total Physical Memory | 532.67 Mb Available Physical Memory | 52.12% Memory free
2.41 Gb Paging File | 2.08 Gb Available in Paging File | 86.37% Paging File free
Paging file location(s): g:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = G: | %SystemRoot% = G:\WINDOWS | %ProgramFiles% = G:\Program Files
Drive G: | 104.01 Gb Total Space | 74.97 Gb Free Space | 72.09% Space Free | Partition Type: NTFS

Computer Name: P-071A7C4D21704 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - G:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - G:\WINDOWS\system32\spool\drivers\w32x86\3\EKAiO2MUI.exe (Eastman Kodak Company)
PRC - G:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
PRC - G:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - G:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - G:\Program Files\Macrium\Reflect\ReflectService.exe ()
PRC - G:\Program Files\System Protect\SysProtect_srv.exe (Xacti Corporation)
PRC - G:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
PRC - G:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe (Crawler.com)
PRC - G:\Program Files\Spyware Terminator\sp_rsser.exe (Crawler.com)
PRC - G:\Program Files\Online Vault\OnlineVault.exe (Xacti Corporation)
PRC - G:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - G:\Program Files\CDBurnerXP\NMSAccessU.exe ()
PRC - G:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
PRC - G:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - G:\WINDOWS\system32\lxctcoms.exe ( )


========== Modules (SafeList) ==========

MOD - G:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
MOD - G:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (Kodak AiO Network Discovery Service) – G:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
SRV - (ReflectService) – G:\Program Files\Macrium\Reflect\ReflectService.exe ()
SRV - (SP_Service) – G:\Program Files\System Protect\SysProtect_srv.exe (Xacti Corporation)
SRV - (sp_rssrv) – G:\Program Files\Spyware Terminator\sp_rsser.exe (Crawler.com)
SRV - (ACDaemon) – G:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (NMSAccess) – G:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (DfSdkS) – G:\Program Files\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\Dfsdks.exe (mst software GmbH, Germany)
SRV - (W3SVC) – G:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (SMTPSVC) Simple Mail Transfer Protocol (SMTP) – G:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (IISADMIN) – G:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (lxct_device) – G:\WINDOWS\System32\lxctcoms.exe ( )


========== Driver Services (SafeList) ==========

DRV - (pssnap) – G:\WINDOWS\system32\DRIVERS\pssnap.sys (Macrium Software)
DRV - (PSMounter) – G:\WINDOWS\system32\drivers\psmounter.sys (Macrium Software)
DRV - (sp_prot) – G:\WINDOWS\system32\drivers\sp_prot.sys ()
DRV - (sp_rsdrv2) – G:\WINDOWS\system32\drivers\sp_rsdrv2.sys ()
DRV - (Revoflt) – G:\WINDOWS\system32\drivers\revoflt.sys (VS Revo Group)
DRV - (cpudrv) – G:\Program Files\SystemRequirementsLab\cpudrv.sys ()
DRV - (StarOpen) – G:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (Afc) – G:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-789336058-308236825-682003330-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-789336058-308236825-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.10.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: [removed]:1.4
FF - prefs.js..extensions.enabledItems: [removed]:5.0.1
FF - prefs.js..extensions.enabledItems: {3ee8d0be-f450-4ef2-97b9-ac2222d14db3}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:1.1
FF - prefs.js..extensions.enabledItems: [removed]:1.3.2
FF - prefs.js..extensions.enabledItems: {75623d5d-4683-402a-b610-ac4bab767c86}:3.0.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:3.4.2
FF - prefs.js..extensions.enabledItems: [removed]:1.3.64
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:3.3.3.2
FF - prefs.js..extensions.enabledItems: {2e710e6b-5e9d-44ba-8f4e-09a040978b49}:1.3.2
FF - prefs.js..extensions.enabledItems: {5c1a272d-6af9-4229-b821-11703c6b5ccf}:2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26

FF - user.js..browser.search.openintab: false

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: G:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: G:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: G:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: G:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: G:\PROGRA~1\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: G:\PROGRA~1\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: g:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: G:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: G:\Documents and Settings\Administrator\Local Settings\Application Data\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: G:\Program Files\Siber Systems\AI RoboForm\Firefox [2010/06/07 00:42:54 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Components: G:\Program Files\Mozilla Firefox\components [2011/06/23 03:57:25 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Plugins: G:\Program Files\Mozilla Firefox\plugins [2011/06/22 16:56:54 | 000,000,000 | —D | M]

[2010/06/05 05:23:33 | 000,000,000 | —D | M] (No name found) – G:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2011/07/14 22:35:28 | 000,000,000 | —D | M] (No name found) – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions
[2011/06/23 19:37:42 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/05/19 23:00:28 | 000,000,000 | —D | M] ("ToolbarBrowser") – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\{2e710e6b-5e9d-44ba-8f4e-09a040978b49}
[2011/05/06 14:22:35 | 000,000,000 | —D | M] (Free TV Bar c3 Community Toolbar) – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}
[2011/05/19 23:00:28 | 000,000,000 | —D | M] (Niche Watch Tool) – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\{5c1a272d-6af9-4229-b821-11703c6b5ccf}
[2010/06/09 17:48:27 | 000,000,000 | —D | M] (Yahoo! Toolbar) – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/12/22 11:13:08 | 000,000,000 | —D | M] (Surf Canyon - Search Engine Assistant) – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\{75623d5d-4683-402a-b610-ac4bab767c86}
[2011/05/06 15:13:01 | 000,000,000 | —D | M] (No name found) – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\[removed]
[2011/05/06 14:23:00 | 000,000,000 | —D | M] ("Personas Interactive") – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\[removed]
[2011/04/27 01:39:28 | 000,000,000 | —D | M] ("CBSurge.com") – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\[removed]
[2011/05/06 15:13:01 | 000,000,000 | —D | M] (No name found) – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\[removed]
[2011/05/06 14:22:34 | 000,000,000 | —D | M] (Conduit Engine) – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\[removed]
[2010/11/04 21:12:02 | 000,000,000 | —D | M] (United States English Spellchecker) – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\[removed]
[2011/05/06 15:13:01 | 000,000,000 | —D | M] (No name found) – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\[removed]
[2011/05/06 14:22:08 | 000,000,000 | —D | M] (No name found) – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\nostmp
[2011/03/26 14:49:01 | 000,000,000 | —D | M] ("SEO For Firefox") – G:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\[removed]
[2011/07/14 22:35:28 | 000,000,000 | —D | M] (No name found) – G:\Program Files\Mozilla Firefox\extensions
[2010/06/07 19:23:02 | 000,000,000 | —D | M] (Java Console) – G:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/11 04:03:27 | 000,000,000 | —D | M] (Java Console) – G:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/25 04:38:25 | 000,000,000 | —D | M] (Java Console) – G:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/04 05:09:12 | 000,000,000 | —D | M] (Java Console) – G:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/03/02 04:37:48 | 000,000,000 | —D | M] (Java Console) – G:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/07/14 04:56:40 | 000,000,000 | —D | M] (Java Console) – G:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/03/02 04:37:33 | 000,000,000 | —D | M] (Java Quick Starter) – G:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/06/07 00:42:54 | 000,000,000 | —D | M] (AI Roboform Toolbar for Firefox) – G:\PROGRAM FILES\SIBER SYSTEMS\AI ROBOFORM\FIREFOX
[2009/11/19 17:16:28 | 000,091,552 | —- | M] (Coupons, Inc.) – G:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2011/05/04 04:52:23 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – G:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2009/11/19 17:16:29 | 000,091,552 | —- | M] (Coupons, Inc.) – G:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2009/09/21 12:24:16 | 000,001,329 | —- | M] () – G:\Program Files\mozilla firefox\searchplugins\crawlersrch.xml

O1 HOSTS File: ([2011/07/02 13:17:16 | 000,434,745 | R— | M]) - G:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 14987 more lines…
O2 - BHO: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - G:\Program Files\Lexmark Toolbar\toolband.dll ()
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - G:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - G:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - G:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - G:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - G:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKU\S-1-5-21-789336058-308236825-682003330-500\..\Toolbar\WebBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - G:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKU\S-1-5-21-789336058-308236825-682003330-500\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - G:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] G:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [Conime] G:\WINDOWS\system32\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [EKAIO2StatusMonitor] G:\WINDOWS\system32\spool\drivers\w32x86\3\EKAiO2MUI.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [Lexmark 5400 Series Fax Server] G:\Program Files\Lexmark 5400 Series\fm3032.exe ()
O4 - HKLM..\Run: [SpywareTerminator] G:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe (Crawler.com)
O4 - HKU\S-1-5-21-789336058-308236825-682003330-500..\Run: [OnlineVault] G:\Program Files\Online Vault\OnlineVault.exe (Xacti Corporation)
O4 - HKU\S-1-5-21-789336058-308236825-682003330-500..\Run: [SpywareTerminatorUpdate] G:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O4 - Startup: G:\Documents and Settings\Administrator\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = G:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: G:\Documents and Settings\Administrator\Start Menu\Programs\Startup\ZooskMessenger.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPropertiesMyComputer = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileAssociate = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-789336058-308236825-682003330-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-789336058-308236825-682003330-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-789336058-308236825-682003330-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-789336058-308236825-682003330-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\S-1-5-21-789336058-308236825-682003330-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Customize Menu - G:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: E&xport to Microsoft Excel - G:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Fill Forms - G:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Save Forms - G:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: Se&nd to OneNote - G:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - G:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - G:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - G:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - G:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - G:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - G:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Online Vault - {FA32182A-EA44-4583-803B-AA827F0D4E06} - G:\Program Files\Online Vault\OnlineVault.exe (Xacti Corporation)
O9 - Extra 'Tools' menuitem : Online Vault - {FA32182A-EA44-4583-803B-AA827F0D4E06} - G:\Program Files\Online Vault\OnlineVault.exe (Xacti Corporation)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1275797429265 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - G:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - G:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: G:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: G:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - G:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/15 17:16:55 | 000,000,000 | RH-D | C] – G:\Documents and Settings\Administrator\Recent
[2011/07/15 16:58:42 | 000,579,584 | —- | C] (OldTimer Tools) – G:\Documents and Settings\Administrator\Desktop\OTL.exe
[2011/07/15 16:54:11 | 001,906,688 | —- | C] (AVAST Software) – G:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2011/07/15 11:20:00 | 000,000,000 | —D | C] – G:\Documents and Settings\Administrator\My Documents\Spyware Terminator Scan Reports
[2011/07/14 04:56:54 | 000,000,000 | —D | C] – G:\Program Files\Common Files\Java
[2011/07/14 04:56:38 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – G:\WINDOWS\System32\javaws.exe
[2011/07/14 04:56:38 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – G:\WINDOWS\System32\javaw.exe
[2011/07/14 04:56:38 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – G:\WINDOWS\System32\java.exe
[2011/07/14 03:50:05 | 000,000,000 | R–D | C] – G:\Documents and Settings\Administrator\Start Menu\Programs\Administrative Tools
[2011/07/14 03:47:54 | 000,000,000 | —D | C] – G:\Documents and Settings\Administrator\My Documents\NewbiesGuidetoInternetMarketing
[2011/07/14 03:46:20 | 000,489,596 | R— | C] (Swearware) – G:\Documents and Settings\Administrator\Desktop\dds.com
[2011/07/09 01:40:20 | 000,000,000 | —D | C] – G:\Documents and Settings\Administrator\My Documents\PVL
[2011/07/09 01:13:59 | 000,000,000 | —D | C] – G:\Documents and Settings\Administrator\My Documents\Virtual Assistant Help
[2011/07/09 01:11:35 | 000,000,000 | —D | C] – G:\Documents and Settings\Administrator\My Documents\Blogging
[2011/07/06 19:39:17 | 000,000,000 | —D | C] – G:\Program Files\Apple Software Update
[2011/07/06 00:05:58 | 000,000,000 | —D | C] – G:\Documents and Settings\Administrator\Desktop\EKKeyGeneratorLauncher
[2011/07/01 01:05:02 | 000,000,000 | —D | C] – G:\Documents and Settings\Administrator\My Documents\My Articles
[2011/06/23 03:10:42 | 000,000,000 | —D | C] – G:\WINDOWS\System32\XPSViewer
[2011/06/23 03:10:33 | 000,000,000 | —D | C] – G:\Program Files\MSBuild
[2011/06/23 03:10:19 | 000,000,000 | —D | C] – G:\Program Files\Reference Assemblies
[2011/06/23 03:08:59 | 000,597,504 | —- | C] (Microsoft Corporation) – G:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2011/06/23 03:08:59 | 000,117,760 | —- | C] (Microsoft Corporation) – G:\WINDOWS\System32\prntvpt.dll
[2011/06/23 03:08:59 | 000,089,088 | —- | C] (Microsoft Corporation) – G:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2011/06/23 03:08:58 | 001,676,288 | —- | C] (Microsoft Corporation) – G:\WINDOWS\System32\xpssvcs.dll
[2011/06/23 03:08:58 | 001,676,288 | —- | C] (Microsoft Corporation) – G:\WINDOWS\System32\dllcache\xpssvcs.dll
[2011/06/23 03:08:58 | 000,575,488 | —- | C] (Microsoft Corporation) – G:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2011/06/23 03:08:57 | 000,000,000 | —D | C] – G:\1edbb7fcab18f304c1b6c7fb94c171
[2011/06/19 20:13:29 | 000,000,000 | —D | C] – G:\Documents and Settings\All Users\Start Menu\Programs\Kodak
[2011/06/19 19:57:00 | 000,760,320 | R— | C] (Eastman Kodak Company) – G:\WINDOWS\System32\EKAiO2MON.dll
[2011/06/19 19:56:53 | 000,146,432 | R— | C] (Eastman Kodak Company) – G:\WINDOWS\System32\EKAiO2COI04.dll
[2011/06/17 19:49:25 | 000,000,000 | —D | C] – G:\Documents and Settings\LocalService\Application Data\Temp
[2011/06/17 03:00:22 | 000,000,000 | —D | C] – G:\Program Files\MSXML 4.0
[2011/06/16 19:47:43 | 000,006,784 | —- | C] (Microsoft Corporation) – G:\WINDOWS\System32\dllcache\serscan.sys
[2011/06/16 19:45:26 | 000,000,000 | —D | C] – G:\Documents and Settings\Administrator\Local Settings\Application Data\Eastman_Kodak_Company
[2011/06/16 19:40:55 | 000,000,000 | —D | C] – G:\Documents and Settings\Administrator\Local Settings\Application Data\Eastman Kodak Company
[2011/06/16 19:40:19 | 000,000,000 | —D | C] – G:\WINDOWS\System32\kodak
[2011/06/16 19:40:02 | 000,000,000 | —D | C] – G:\WINDOWS\System32\DRVSTORE
[2011/06/16 19:39:25 | 000,000,000 | —D | C] – G:\Program Files\Kodak
[2011/06/16 19:39:14 | 000,000,000 | —D | C] – G:\Program Files\MSXML 6.0
[2011/06/16 19:32:21 | 000,000,000 | —D | C] – G:\Documents and Settings\Administrator\Application Data\Temp
[2011/06/16 19:32:19 | 000,000,000 | —D | C] – G:\Documents and Settings\All Users\Application Data\Kodak
[2011/06/16 03:51:31 | 000,000,000 | —D | C] – G:\Program Files\Common Files\Adobe
[2011/06/15 17:43:23 | 000,105,472 | —- | C] (Microsoft Corporation) – G:\WINDOWS\System32\dllcache\mup.sys
[2010/06/12 18:49:13 | 000,413,696 | —- | C] ( ) – G:\WINDOWS\System32\lxctinpa.dll
[2010/06/12 18:49:13 | 000,397,312 | —- | C] ( ) – G:\WINDOWS\System32\lxctiesc.dll
[2010/06/12 18:49:13 | 000,323,584 | —- | C] ( ) – G:\WINDOWS\System32\LXCThcp.dll
[2010/06/12 18:49:12 | 000,991,232 | —- | C] ( ) – G:\WINDOWS\System32\lxctusb1.dll
[2010/06/12 18:49:11 | 001,224,704 | —- | C] ( ) – G:\WINDOWS\System32\lxctserv.dll
[2010/06/12 18:49:11 | 000,643,072 | —- | C] ( ) – G:\WINDOWS\System32\lxctpmui.dll
[2010/06/12 18:49:11 | 000,163,840 | —- | C] ( ) – G:\WINDOWS\System32\lxctprox.dll
[2010/06/12 18:49:11 | 000,094,208 | —- | C] ( ) – G:\WINDOWS\System32\lxctpplc.dll
[2010/06/12 18:49:10 | 000,585,728 | —- | C] ( ) – G:\WINDOWS\System32\lxctlmpm.dll
[2010/06/12 18:49:09 | 000,696,320 | —- | C] ( ) – G:\WINDOWS\System32\lxcthbn3.dll
[2010/06/12 18:49:09 | 000,385,968 | —- | C] ( ) – G:\WINDOWS\System32\lxctih.exe
[2010/06/12 18:49:08 | 000,537,520 | —- | C] ( ) – G:\WINDOWS\System32\lxctcoms.exe
[2010/06/12 18:49:07 | 000,684,032 | —- | C] ( ) – G:\WINDOWS\System32\lxctcomc.dll
[2010/06/12 18:49:07 | 000,421,888 | —- | C] ( ) – G:\WINDOWS\System32\lxctcomm.dll
[2010/06/12 18:49:07 | 000,381,872 | —- | C] ( ) – G:\WINDOWS\System32\lxctcfg.exe

========== Files - Modified Within 30 Days ==========

[2011/07/15 16:58:42 | 000,579,584 | —- | M] (OldTimer Tools) – G:\Documents and Settings\Administrator\Desktop\OTL.exe
[2011/07/15 16:54:59 | 001,906,688 | —- | M] (AVAST Software) – G:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2011/07/15 15:47:38 | 000,000,274 | —- | M] () – G:\WINDOWS\tasks\WGASetup.job
[2011/07/15 15:47:19 | 000,002,048 | –S- | M] () – G:\WINDOWS\bootstat.dat
[2011/07/15 15:17:42 | 001,008,041 | —- | M] () – G:\Documents and Settings\Administrator\Desktop\rkill.exe
[2011/07/15 06:17:27 | 000,013,646 | —- | M] () – G:\WINDOWS\System32\wpa.dbl
[2011/07/14 04:49:17 | 000,329,096 | —- | M] () – G:\WINDOWS\System32\FNTCACHE.DAT
[2011/07/14 03:46:21 | 000,489,596 | R— | M] (Swearware) – G:\Documents and Settings\Administrator\Desktop\dds.com
[2011/07/13 09:08:01 | 000,000,284 | —- | M] () – G:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/07/11 02:16:08 | 000,012,668 | —- | M] () – G:\Documents and Settings\Administrator\My Documents\Total Pages Printed - how to do.odt
[2011/07/08 23:20:40 | 003,292,255 | —- | M] () – G:\Documents and Settings\Administrator\My Documents\nwlfr.odt
[2011/07/06 01:46:02 | 000,046,080 | —- | M] () – G:\Documents and Settings\Administrator\My Documents\Envelope -FA RA.php
[2011/07/05 20:04:31 | 000,072,080 | —- | M] () – G:\Documents and Settings\Administrator\g2mdlhlpx.exe
[2011/07/02 13:17:16 | 000,434,745 | R— | M] () – G:\WINDOWS\System32\drivers\etc\hosts
[2011/07/02 11:06:20 | 000,000,282 | —- | M] () – G:\WINDOWS\tasks\Spybot - Search & Destroy Updater - Scheduled Task.job
[2011/06/29 19:55:52 | 000,565,278 | —- | M] () – G:\WINDOWS\System32\perfh009.dat
[2011/06/29 19:55:52 | 000,107,986 | —- | M] () – G:\WINDOWS\System32\perfc009.dat
[2011/06/28 03:46:48 | 000,000,682 | —- | M] () – G:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/06/25 21:13:41 | 000,001,808 | —- | M] () – G:\Documents and Settings\All Users\Desktop\Media Impression 2.lnk
[2011/06/23 04:05:18 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – G:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/06/19 20:19:41 | 000,001,863 | —- | M] () – G:\Documents and Settings\All Users\Desktop\KODAK AiO Home Center.lnk
[2011/06/19 01:15:08 | 000,002,467 | —- | M] () – G:\Documents and Settings\Administrator\Desktop\Vz In-Home Agent.lnk
[2011/06/16 03:51:56 | 000,001,734 | —- | M] () – G:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk

========== Files Created - No Company Name ==========

[2011/07/15 15:17:42 | 001,008,041 | —- | C] () – G:\Documents and Settings\Administrator\Desktop\rkill.exe
[2011/07/11 02:16:01 | 000,012,668 | —- | C] () – G:\Documents and Settings\Administrator\My Documents\Total Pages Printed - how to do.odt
[2011/07/06 00:29:43 | 000,046,080 | —- | C] () – G:\Documents and Settings\Administrator\My Documents\Envelope -FA RA.php
[2011/07/02 11:06:20 | 000,000,282 | —- | C] () – G:\WINDOWS\tasks\Spybot - Search & Destroy Updater - Scheduled Task.job
[2011/06/19 20:19:41 | 000,001,863 | —- | C] () – G:\Documents and Settings\All Users\Desktop\KODAK AiO Home Center.lnk
[2011/06/16 03:51:56 | 000,001,804 | —- | C] () – G:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/06/16 03:51:56 | 000,001,734 | —- | C] () – G:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/03/03 19:57:29 | 000,499,712 | —- | C] () – G:\WINDOWS\iwexec.exe
[2010/10/01 20:54:48 | 000,000,754 | —- | C] () – G:\WINDOWS\WORDPAD.INI
[2010/09/09 23:24:23 | 000,000,034 | —- | C] () – G:\WINDOWS\System32\oeminfo.ini
[2010/06/24 20:49:20 | 000,007,168 | —- | C] () – G:\WINDOWS\System32\drivers\StarOpen.sys
[2010/06/12 18:54:42 | 000,040,960 | —- | C] () – G:\WINDOWS\System32\lxctvs.dll
[2010/06/12 18:54:37 | 000,331,776 | —- | C] () – G:\WINDOWS\System32\lxctcoin.dll
[2010/06/12 18:54:00 | 000,065,536 | —- | C] () – G:\WINDOWS\System32\lxctcaps.dll
[2010/06/12 18:53:59 | 000,692,224 | —- | C] () – G:\WINDOWS\System32\lxctdrs.dll
[2010/06/12 18:53:59 | 000,061,440 | —- | C] () – G:\WINDOWS\System32\lxctcnv4.dll
[2010/06/12 18:53:18 | 000,045,056 | —- | C] () – G:\WINDOWS\System32\lxctpmon.dll
[2010/06/12 18:53:18 | 000,032,768 | —- | C] () – G:\WINDOWS\System32\LXCTFXPU.DLL
[2010/06/12 18:49:13 | 000,274,432 | —- | C] () – G:\WINDOWS\System32\LXCTinst.dll
[2010/06/12 18:49:09 | 000,204,800 | —- | C] () – G:\WINDOWS\System32\lxctgrd.dll
[2010/06/05 05:23:13 | 000,000,000 | —- | C] () – G:\WINDOWS\nsreg.dat
[2010/06/05 04:21:45 | 000,012,288 | —- | C] () – G:\WINDOWS\System32\drivers\sp_prot.sys
[2010/06/05 04:09:06 | 000,142,592 | —- | C] () – G:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2010/06/05 01:50:39 | 000,021,791 | —- | C] () – G:\WINDOWS\System32\smtpctrs.ini
[2010/06/05 01:50:39 | 000,001,037 | —- | C] () – G:\WINDOWS\System32\ntfsdrct.ini
[2010/06/05 01:50:25 | 000,038,576 | —- | C] () – G:\WINDOWS\System32\w3ctrs.ini
[2010/06/05 01:50:25 | 000,010,225 | —- | C] () – G:\WINDOWS\System32\axperf.ini
[2010/06/05 01:50:23 | 000,011,435 | —- | C] () – G:\WINDOWS\System32\infoctrs.ini
[2010/06/05 01:31:02 | 000,000,444 | —- | C] () – G:\WINDOWS\System32\d3d8caps.dat
[2010/06/05 00:38:36 | 000,002,048 | –S- | C] () – G:\WINDOWS\bootstat.dat
[2010/06/05 00:32:59 | 000,025,480 | —- | C] () – G:\WINDOWS\System32\emptyregdb.dat
[2010/06/04 20:14:53 | 000,004,161 | —- | C] () – G:\WINDOWS\ODBCINST.INI
[2010/06/04 20:13:41 | 000,329,096 | —- | C] () – G:\WINDOWS\System32\FNTCACHE.DAT
[2008/05/26 22:59:42 | 000,018,904 | —- | C] () – G:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 22:59:40 | 000,106,605 | —- | C] () – G:\WINDOWS\System32\structuredqueryschema.bin
[2007/09/27 11:51:02 | 000,020,698 | —- | C] () – G:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 11:48:48 | 000,030,628 | —- | C] () – G:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 11:48:28 | 000,031,698 | —- | C] () – G:\WINDOWS\System32\gthrctr.ini
[2007/05/21 01:51:28 | 000,069,632 | —- | C] () – G:\WINDOWS\System32\csExWBDLMan.dll
[2004/08/12 04:36:06 | 013,107,200 | —- | C] () – G:\WINDOWS\System32\oembios.bin
[2004/08/12 04:36:06 | 000,004,627 | —- | C] () – G:\WINDOWS\System32\oembios.dat
[2004/08/12 04:28:00 | 000,004,569 | —- | C] () – G:\WINDOWS\System32\secupd.dat
[2004/08/12 04:26:08 | 000,272,128 | —- | C] () – G:\WINDOWS\System32\perfi009.dat
[2004/08/12 04:26:07 | 000,565,278 | —- | C] () – G:\WINDOWS\System32\perfh009.dat
[2004/08/12 04:26:06 | 000,028,626 | —- | C] () – G:\WINDOWS\System32\perfd009.dat
[2004/08/12 04:26:05 | 000,107,986 | —- | C] () – G:\WINDOWS\System32\perfc009.dat
[2004/08/12 04:24:57 | 000,000,741 | —- | C] () – G:\WINDOWS\System32\noise.dat
[2004/08/12 04:22:08 | 000,673,088 | —- | C] () – G:\WINDOWS\System32\mlang.dat
[2004/08/12 04:22:01 | 000,046,258 | —- | C] () – G:\WINDOWS\System32\mib.bin
[2004/08/12 04:18:55 | 000,218,003 | —- | C] () – G:\WINDOWS\System32\dssec.dat
[2004/08/12 04:18:32 | 000,001,804 | —- | C] () – G:\WINDOWS\System32\dcache.bin

========== LOP Check ==========

[2011/06/14 00:56:06 | 000,000,000 | -HSD | M] – G:\Documents and Settings\Administrator\Application Data\.#
[2010/06/18 18:37:34 | 000,000,000 | —D | M] – G:\Documents and Settings\Administrator\Application Data\5400 Series
[2010/08/10 18:15:53 | 000,000,000 | —D | M] – G:\Documents and Settings\Administrator\Application Data\Ashampoo
[2010/06/24 20:49:37 | 000,000,000 | —D | M] – G:\Documents and Settings\Administrator\Application Data\Canneverbe Limited
[2011/03/22 17:21:16 | 000,000,000 | —D | M] – G:\Documents and Settings\Administrator\Application Data\com.picaboo.Picaboo.A382D4714709B456C4E0088DFC1F7243AF9EBF75.1
[2011/03/26 21:07:24 | 000,000,000 | —D | M] – G:\Documents and Settings\Administrator\Application Data\com.zoosk.Desktop.096E6A67431258A508A2446A847B240591D2C99B.1
[2010/11/25 23:08:55 | 000,000,000 | —D | M] – G:\Documents and Settings\Administrator\Application Data\gtk-2.0
[2010/06/29 02:24:51 | 000,000,000 | —D | M] – G:\Documents and Settings\Administrator\Application Data\OpenOffice.org
[2011/06/14 04:37:35 | 000,000,000 | —D | M] – G:\Documents and Settings\Administrator\Application Data\OVData
[2011/07/15 05:18:10 | 000,000,000 | —D | M] – G:\Documents and Settings\Administrator\Application Data\Spyware Terminator
[2010/06/07 20:57:25 | 000,000,000 | —D | M] – G:\Documents and Settings\Administrator\Application Data\SystemRequirementsLab
[2010/11/04 11:56:58 | 000,000,000 | —D | M] – G:\Documents and Settings\Administrator\Application Data\TechWizard
[2011/06/16 19:32:21 | 000,000,000 | —D | M] – G:\Documents and Settings\Administrator\Application Data\Temp
[2010/12/21 01:50:55 | 000,000,000 | —D | M] – G:\Documents and Settings\Administrator\Application Data\Windows Desktop Search
[2011/02/14 04:11:51 | 000,000,000 | —D | M] – G:\Documents and Settings\Administrator\Application Data\Windows Search
[2010/06/12 18:52:48 | 000,000,000 | —D | M] – G:\Documents and Settings\All Users\Application Data\5400 Series
[2010/08/10 18:13:39 | 000,000,000 | —D | M] – G:\Documents and Settings\All Users\Application Data\ashampoo
[2010/06/24 20:49:37 | 000,000,000 | —D | M] – G:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2010/09/03 22:49:12 | 000,000,000 | —D | M] – G:\Documents and Settings\All Users\Application Data\Macrium
[2010/06/07 00:42:56 | 000,000,000 | —D | M] – G:\Documents and Settings\All Users\Application Data\RoboForm
[2011/07/15 06:02:36 | 000,000,000 | —D | M] – G:\Documents and Settings\All Users\Application Data\Spyware Terminator
[2011/06/17 19:49:25 | 000,000,000 | —D | M] – G:\Documents and Settings\LocalService\Application Data\Temp
[2011/07/15 15:47:38 | 000,000,274 | —- | M] () – G:\WINDOWS\Tasks\WGASetup.job

========== Purity Check ==========



< End of report >


And Extras.Txt

OTL Extras logfile created on: 7/15/2011 5:18:17 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = G:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1021.98 Mb Total Physical Memory | 532.67 Mb Available Physical Memory | 52.12% Memory free
2.41 Gb Paging File | 2.08 Gb Available in Paging File | 86.37% Paging File free
Paging file location(s): g:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = G: | %SystemRoot% = G:\WINDOWS | %ProgramFiles% = G:\Program Files
Drive G: | 104.01 Gb Total Space | 74.97 Gb Free Space | 72.09% Space Free | Partition Type: NTFS

Computer Name: P-071A7C4D21704 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-789336058-308236825-682003330-500\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – G:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – "G:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "G:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"9051:UDP" = 9051:UDP:LocalSubNet:Enabled:FiOS Tech Wizard
"5353:UDP" = 5353:UDP:*:Enabled:Bonjour Port 5353
"9322:TCP" = 9322:TCP:*:Enabled:EKDiscovery

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"G:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe" = G:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator – (Crawler.com)
"G:\WINDOWS\system32\lxctcoms.exe" = G:\WINDOWS\system32\lxctcoms.exe:*:Enabled:5400 Series Server – ( )
"G:\Program Files\Microsoft Office\Office14\ONENOTE.EXE" = G:\Program Files\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote – (Microsoft Corporation)
"G:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" = G:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook – (Microsoft Corporation)
"G:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe" = G:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe:*:Enabled:Kodak.AiO.HomeCenter – (Eastman Kodak Company)
"G:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe" = G:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe:*:Enabled:Kodak.AiO.Statistics – (Eastman Kodak Company)
"G:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe" = G:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe:*:Enabled:Kodak.AiO.SetupUtility – (Eastman Kodak Company)
"G:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe" = G:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe:*:Enabled:Kodak.AiO.FwUpdater – (Eastman Kodak Company)
"G:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe" = G:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe:*:Enabled:Kodak.AiO.Installer – (Eastman Kodak Company)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Toolbar
"{15D9EB74-998E-4A04-B468-51C2E7B32182}" = Microsoft Picture It! Publishing 2001
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java™ 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java™ 6 Update 26
"{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer
"{2A9CD591-2DB0-415E-AD6E-E0D905CFD057}" = Macrium Reflect - Free Edition
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DABE68E-FD6C-46FC-9045-AD1E3A09D106}" = ArcSoft MediaImpression 2
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56BA241F-580C-43D2-8403-947241AAE633}" = center
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{59732AC4-4885-48D6-BFB2-1C97B184A208}" = Vz In Home Agent
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.1
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver
"{8EB39AA7-4019-4550-AF6C-BE51BB27B446}" = TC Web Conferencing
"{90140000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 14
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.0)
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials
"{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK AiO Software
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EF53BFAB-4C10-40DB-A82D-9B07111715C6}" = aioscnnr
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F7FC9307-374E-4017-8E9D-DE1154780480}" = System Requirements Lab for Intel
"{F8131A35-47FD-27AD-116D-0E79AF5DE5EE}" = Acrobat.com
"{FA32182A-EA44-4583-803B-AA827F0D4E06}_is1" = Online Vault
"{FAB82F58-0830-B525-AA3B-F8E4AEBEBF2D}" = Picaboo X
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AI RoboForm" = AI RoboForm (All Users)
"Ashampoo Burning Studio 6 FREE_is1" = Ashampoo Burning Studio 6 FREE
"Ashampoo WinOptimizer 2010 Advanced_is1" = Ashampoo WinOptimizer 2010 Advanced
"CCleaner" = CCleaner
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"com.picaboo.Picaboo.A382D4714709B456C4E0088DFC1F7243AF9EBF75.1" = Picaboo X
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"DivX Setup.divx.com" = DivX Setup
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Lexmark 5400 Series" = Lexmark 5400 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.0.1200
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox (3.6.18)" = Mozilla Firefox (3.6.18)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Niche Browser_is1" = Niche Browser
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Office14.SingleImage" = Microsoft Office Professional 2010
"PROSet" = Intel® PRO Network Connections Drivers
"SFS Download Manager" = SFS Download Manager
"Shockwave" = Shockwave
"Spyware Terminator_is1" = Spyware Terminator
"Sweep!" = Sweep!
"System Protect_is1" = System Protect
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-789336058-308236825-682003330-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GoToMeeting" = GoToMeeting 4.8.0.723
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/14/2011 6:02:18 AM | Computer Name = P-071A7C4D21704 | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 7/15/2011 6:28:27 AM | Computer Name = P-071A7C4D21704 | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 7/15/2011 6:33:24 AM | Computer Name = P-071A7C4D21704 | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 7/15/2011 6:34:26 AM | Computer Name = P-071A7C4D21704 | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 7/15/2011 6:40:56 AM | Computer Name = P-071A7C4D21704 | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 7/15/2011 1:17:01 PM | Computer Name = P-071A7C4D21704 | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 7/15/2011 1:23:28 PM | Computer Name = P-071A7C4D21704 | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 7/15/2011 3:07:03 PM | Computer Name = P-071A7C4D21704 | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 7/15/2011 3:49:48 PM | Computer Name = P-071A7C4D21704 | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 7/15/2011 3:49:48 PM | Computer Name = P-071A7C4D21704 | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

[ OSession Events ]
Error - 12/15/2010 3:34:16 AM | Computer Name = P-071A7C4D21704 | Source = Microsoft Office 12 Sessions | ID = 7001
Description =

[ System Events ]
Error - 5/11/2011 2:27:46 AM | Computer Name = P-071A7C4D21704 | Source = DCOM | ID = 10000
Description = Unable to start a DCOM Server: {98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}.
The
error: "%6" Happened while starting this command: "G:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32Info.exe"
/PDFShell -Embedding

Error - 5/12/2011 8:58:23 PM | Computer Name = P-071A7C4D21704 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
IntelIde

Error - 6/19/2011 12:54:08 AM | Computer Name = P-071A7C4D21704 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 6/19/2011 7:56:10 PM | Computer Name = P-071A7C4D21704 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 6/19/2011 8:22:53 PM | Computer Name = P-071A7C4D21704 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 6/19/2011 8:50:06 PM | Computer Name = P-071A7C4D21704 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 6/23/2011 5:07:20 AM | Computer Name = P-071A7C4D21704 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070002: Security Update for Microsoft .NET Framework 4 on Windows
XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008 x86 (KB2518870).

Error - 7/4/2011 7:51:47 PM | Computer Name = P-071A7C4D21704 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk1\D, has a bad block.

Error - 7/6/2011 12:45:29 AM | Computer Name = P-071A7C4D21704 | Source = Print | ID = 6161
Description = The document G:\Documents and Settings\Administrator\My Documents\Envelope
- RA.php owned by Administrator failed to print on printer KODAK HERO 7.1 AiO.
Data type: NT EMF 1.008. Size of the spool file in bytes: 3576. Number of bytes
printed: 0. Total number of pages in the document: 1. Number of pages printed: 0.
Client machine: \\P-071A7C4D21704. Win32 error code returned by the print processor:
2 (0x2).

Error - 7/7/2011 4:12:48 AM | Computer Name = P-071A7C4D21704 | Source = Service Control Manager | ID = 7034
Description = The Windows Image Acquisition (WIA) service terminated unexpectedly.
It has done this 1 time(s).


< End of report >

Also, there for a while, I'd say the past few weeks or so, my computer seems to be running a lot harder than usual. By that I mean (you know the sound the cpu makes when you put a disc in and it starts spinning/reading it) but there isn't a disc in my computer. It would do that off and on all day and night, probably about every 10-15 minutes. But, I haven't heard it do that much if at all the past day or two. Not sure if that is any help but thought I'd let you know any way. .

Thanks again for your help!
Post #10
Hi,

Lets do this

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • See this Link for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #11
Ok, now Combofix freezes and it won't close or I can't click on anything else. I disabled my spyware protection and firewall. I checked the TeaTimer in Spybot S&D but it was already unchecked. I double clicked on the Combofix icon, clicked run then a blue box came up. It said it shouldn't take more than 10 minutes to do the scan, double for badly infected computers. Then the little cursor just sits there and blinks(doesn't move anywhere). My computer just sat there, too…. (you know how you can hear it processing) … well, mine was quiet, not a sound. I let it sit there for about 4-5 hours and it still didn't do anything. Am I maybe doing something wrong? I thought the last time I had problems with my computer, there was something else besides the DDS that wouldn't work right …. I'm wondering if it was the Combofix…… hmmm, I'm not sure. And, when I realized it wasn't going to do anything else I tried to close it but it wouldn't close and I couldn't click on anything else. I had to shut the computer down and restart it to be able to do anything. …….. :pullhair:
Post #12
Sorry your having problems with this.

If this or any other programs hang, just go to Task Manager by pressing Ctrl. Alt. Del on your keyboard and under Applications just find the program and end it

Try booting to Safemode with Networking and see if it will run,

To Enter Safemode
  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
    this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode with Networking
  • Then press the Enter Key on your Keyboard
Tutorial if you need it How to boot into Safemode
Post #13
Hi Ken, Well, I tried it in safe mode and it wouldn't work like that either. It basically sat there laughing at me ……. lol!… :lol: It did the same thing as before. It was kind of weird though when I was in safe mode and I clicked on combofix a box came up saying "Are you sure you want to move combofix and all its contents to the recycle bin". I didn't click on anything else so I'm not sure why that came up. I clicked no. Also, when I was in safe mode I couldn't open my virus protection to disable it. I went back to regular mode and turned everything off but in my virus protection ( I just changed to F-Secure virus protection ) the only option to turn it off said "Turn off till the next boot or reboot". I started combofix and it did the exact same thing as in regular mode. I tried what you said about bringing up task manager(which I believe I tried before) and canceling or stopping combofix but it didn't do anything/didn't stop it. Its almost as if my screen is frozen. I tried about everything I could think of and the only way to get it to close or get into anything is to shut it down (even clicking on restart or turn computer off won't do anything) I have to physically turn it off and back on. ….. :wall: I'm sorry for all the problems.
Post #14
Well, lets forget about CF just now and lets do this

Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan
    • Only if Malicious objects are found then ensure Cure is selected
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)







ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]
Please make sure you include the following items in your next post:
The log that was produced after running ESET Online Scanner.
Post #15
Ok, finally something worked……. lol! I did both scans, TDSSKiller and the ESET Online Scanner and they both said No Threats Found. Also, I mentioned in the last post or the one before that I changed virus/spyware protection to F-Secure. The scan I did last night said there were No Threats found, too. I seen in with the couple different scans I can do(In F-Secure) that there is a "rootkit" scan. I am going to try that to see what that does or says. The night before I did a regular scan because I wasn't aware of the other scans yet. Last night I did a deep scan. It just seems kind of weird that one day its saying I have these Trojans and the next day there gone….. the just disappeared. My computer does seem to be working better or more as it usually does. Doesn't seem as slow or it doesn't keep processing every 10-15 minutes or so. Can a virus do that though…… just show up one day and the next day just disappear? Thanks!!!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI