What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Personal Shield pro infection

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I got infected with the Personal Shield Pro malware or virus I am not sure what it is, I reformated my computer and reinstalled everything from the original disks, since everything is working normally now does that mean I got rid of ior is it still hiding someware on my computer? Thanks for any help and aloha. Kalai
Post #2
This is the DDS report— DDS (Ver_2011-07-14.01) - NTFS_x86 Internet Explorer: 7.0.6001.18000 Run by [removed] at 23:28:09 on 2011-07-17 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3060.2071 [GMT -10:00] . AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} . ============== Running Processes ================ . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\SLsvc.exe C:\Windows\System32\spoolsv.exe C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\WINDOWS\RtHDVCpl.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\System32\igfxpers.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\MSN\MSNCoreFiles\msn.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\MSN\MSNIA\CC\MSNCC\logonmgr.exe C:\Program Files\MSN\MSNIA\CC\MSNCC\msncc.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\System32\svchost.exe -k WerSvcGroup . ============== Pseudo HJT Report =============== . uWindow Title = Internet Explorer provided by Dell BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\program files\mcafee\msk\mskapbho.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20110717142037.dll BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\program files\mcafee\siteadvisor\McIEPlg.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Windows Live Toolbar Helper: {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - c:\program files\windows live\toolbar\wltcore.dll TB: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - c:\program files\windows live\toolbar\wltcore.dll TB: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - c:\program files\windows live\toolbar\wltcore.dll TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\program files\mcafee\siteadvisor\McIEPlg.dll uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background mRun: [Windows Defender] c:\program files\windows defender\MSASCui.exe -hide mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe mPolicies-System: EnableUIADesktopToggle = dword:0 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab TCP: Interfaces\{599E6033-102B-44D0-B474-EE05964A85E4} : NameServer = 198.6.100.150 198.6.1.150 TCP: Interfaces\{A602B6F6-D9DC-4084-8223-4FD51F4BEC69} : DHCPNameServer = 172.17.33.1 Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor\McIEPlg.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor\McIEPlg.dll Notify: igfxcui - igfxdev.dll LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg mASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "c:\program files\windows mail\WinMail.exe" OCInstallUserConfigOE . ============= SERVICES / DRIVERS =============== . R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-4-14 385536] R1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\drivers\mfenlfk.sys [2011-7-17 64304] R1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2011-7-17 160720] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2011-7-17 271480] R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2011-7-17 271480] R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2011-7-17 271480] R2 McOobeSv;McAfee OOBE Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2011-7-17 271480] R2 McProxy;McAfee Proxy Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2011-7-17 271480] R2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2011-7-17 170144] R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2011-7-17 188136] R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\common files\mcafee\systemcore\mfevtps.exe [2011-7-17 141792] R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2011-7-17 55456] R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2011-7-17 152320] R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2011-7-17 51688] R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2011-7-17 312616] S2 0242111310976566mcinstcleanup;McAfee Application Installer Cleanup (0242111310976566);c:\windows\temp\024211~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service –> c:\windows\temp\024211~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?] S2 SftService;SoftThinks Agent Service;"c:\windows\sminst\sftservice.exe" –> c:\windows\sminst\sftservice.EXE [?] S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2011-7-17 83496] . =============== Created Last 30 ================ . 2011-07-18 08:55:52 ——– d—–w- c:\users\[removed]\appdata\local\Adobe 2011-07-18 05:41:49 171520 —-a-w- c:\windows\system32\wintrust.dll 2011-07-18 05:41:36 98304 —-a-w- c:\windows\system32\cabview.dll 2011-07-18 00:20:36 9344 —-a-w- c:\windows\system32\drivers\mfeclnk.sys 2011-07-18 00:20:13 83496 —-a-w- c:\windows\system32\drivers\mferkdet.sys 2011-07-18 00:20:13 64304 —-a-w- c:\windows\system32\drivers\mfenlfk.sys 2011-07-18 00:20:13 55456 —-a-w- c:\windows\system32\drivers\cfwids.sys 2011-07-18 00:20:13 51688 —-a-w- c:\windows\system32\drivers\mfebopk.sys 2011-07-18 00:20:13 312616 —-a-w- c:\windows\system32\drivers\mfefirek.sys 2011-07-18 00:20:13 160720 —-a-w- c:\windows\system32\drivers\mfewfpk.sys 2011-07-18 00:20:13 152320 —-a-w- c:\windows\system32\drivers\mfeavfk.sys 2011-07-18 00:20:02 ——– d—–w- c:\program files\McAfee.com 2011-07-18 00:20:02 ——– d—–w- c:\program files\common files\Mcafee 2011-07-18 00:19:49 ——– d—–w- c:\program files\McAfee 2011-07-18 00:18:47 95568 —-a-r- c:\windows\system32\drivers\mfeapfk.sys 2011-07-17 23:22:15 14744 —-a-w- c:\users\[removed]\appdata\roaming\microsoft\identitycrl\production\ppcrlconfig.dll 2011-07-17 23:15:01 45056 —-a-r- c:\users\[removed]\appdata\roaming\microsoft\installer\{42929f0f-ce14-47af-9fc7-ff297a603021}\NewShortcut1_42929F0FCE1447AF9FC7FF297A603021_1.exe 2011-07-17 23:14:58 ——– d—–w- c:\windows\system32\vmm32 2011-07-17 21:47:45 ——– d—–w- c:\users\[removed]\Tracing 2011-07-17 20:54:54 2421760 —-a-w- c:\windows\system32\wucltux.dll 2011-07-17 20:54:30 87552 —-a-w- c:\windows\system32\wudriver.dll 2011-07-17 20:54:24 33792 —-a-w- c:\windows\system32\wuapp.exe 2011-07-17 20:54:24 171608 —-a-w- c:\windows\system32\wuwebv.dll 2011-07-17 14:49:35 ——– d—–w- c:\users\[removed]\appdata\roaming\MSNInstaller 2011-07-17 14:48:37 ——– d—–w- c:\users\[removed]\appdata\local\Stardock_Corporation 2011-07-17 14:46:12 ——– d—–w- c:\users\[removed]\appdata\local\DataSafeOnline 2011-07-17 14:46:01 ——– d—–w- C:\Intel 2011-07-17 14:45:52 ——– d-sh–w- C:\$RECYCLE.BIN 2011-07-17 14:45:36 ——– d—–w- c:\users\[removed]\appdata\local\VirtualStore . ==================== Find3M ==================== . . ============= FINISH: 23:28:28.66 =============== AND THIS IS THE 2ND REPORT— . . . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-07-14.01) . Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume3 Install Date: 5/12/2009 6:01:33 AM System Uptime: 7/17/2011 7:43:38 PM (4 hours ago) . Motherboard: Dell Inc. | | 0G679R Processor: Pentium® Dual-Core CPU E5200 @ 2.50GHz | Socket 775 | 2000/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 283 GiB total, 227.186 GiB free. D: is FIXED (NTFS) - 15 GiB total, 2.97 GiB free. E: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . . ==== Installed Programs ====================== . Acrobat.com Adobe AIR Adobe Flash Player 10 ActiveX Adobe Reader 9 Banctec Service Agreement Choice Guard Conexant D850 PCI V.92 Modem Dell-eBay Dell Edoc Viewer Dell Resource CD DELL0703 Digital Line Detect Intel® PRO Network Connections 12.1.11.0 Java™ 6 Update 11 Junk Mail filter update McAfee Total Protection Microsoft Application Error Reporting Microsoft Search Enhancement Pack Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Sync Framework Runtime Native v1.0 (x86) Microsoft Sync Framework Services Native v1.0 (x86) Microsoft Visual C++ 2005 Redistributable Modem Diagnostic Tool MSN MSVCRT Realtek High Definition Audio Driver Roxio Creator Audio Roxio Creator Copy Roxio Creator Data Roxio Creator DE Roxio Creator Tools Roxio Express Labeler 3 Roxio Update Manager WildTangent Games Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Mail Windows Live Messenger Windows Live Photo Gallery Windows Live Sign-in Assistant Windows Live Sync Windows Live Toolbar Windows Live Upload Tool Windows Live Writer . ==== End Of File =========================== will post the other required stuff later, let me know if there is anything else I need to do or if you have any questions, aloha Kalai
Post #3
HI, this is the Trend Micro Hijack This report—
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:45:04 PM, on 7/17/2011
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\WINDOWS\RtHDVCpl.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\MSN\MSNIA\CC\MSNCC\logonmgr.exe
C:\Program Files\MSN\MSNIA\CC\MSNCC\msncc.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Users\[removed]\Documents\My Downloads\indexhijackthis.exe
C:\Users\[removed]\Documents\My Downloads\indexhijackthis.exe
C:\Users\[removed]\Documents\My Downloads\index.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USCON/1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110717142037.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "c:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{599E6033-102B-44D0-B474-EE05964A85E4}: NameServer = 198.6.100.150 198.6.1.150
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: McAfee Application Installer Cleanup (0242111310976566) (0242111310976566mcinstcleanup) - Unknown owner - C:\Windows\TEMP\024211~1.EXE (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee OOBE Service (McOobeSv) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McShield - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: SoftThinks Agent Service (SftService) - Unknown owner - C:\WINDOWS\SMINST\sftservice.EXE (file missing)
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 7456 bytes

Thanks and aloha.

Kalai
Post #4
Hi, this is the OTL report—
OTL logfile created on: 7/17/2011 11:53:57 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\[removed]\Documents\My Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.99 Gb Total Physical Memory | 1.97 Gb Available Physical Memory | 65.93% Memory free
6.19 Gb Paging File | 4.94 Gb Available in Paging File | 79.81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 283.40 Gb Total Space | 227.18 Gb Free Space | 80.16% Space Free | Partition Type: NTFS
Drive D: | 14.65 Gb Total Space | 2.97 Gb Free Space | 20.27% Space Free | Partition Type: NTFS

Computer Name: KOAWOODHAWAI-PC | User Name: [removed] | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\[removed]\Documents\My Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Users\[removed]\Documents\My Downloads\indexhijackthis.exe (Trend Micro Inc.)
PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\SystemCore\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\MSN\MSNCoreFiles\msn.exe (Microsoft Corporation)
PRC - C:\Program Files\MSN\MSNIA\CC\MSNCC\logonmgr.exe (Microsoft Corporation.)
PRC - C:\Program Files\MSN\MSNIA\CC\MSNCC\msncc.exe (Microsoft Corporation)
PRC - C:\WINDOWS\RtHDVCpl.exe (Realtek Semiconductor)


========== Modules (SafeList) ==========

MOD - C:\Users\[removed]\Documents\My Downloads\OTL.exe (OldTimer Tools)
MOD - c:\Program Files\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)
MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (SftService) – File not found
SRV - (0242111310976566mcinstcleanup) McAfee Application Installer Cleanup (0242111310976566) – C:\WINDOWS\Temp\0242111310976566mcinst.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (mfevtp) – C:\Program Files\Common Files\Mcafee\SystemCore\mfevtps.exe (McAfee, Inc.)
SRV - (MSK80Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McOobeSv) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (GameConsoleService) – C:\Program Files\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (mfefirek) – C:\WINDOWS\System32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfewfpk) – C:\WINDOWS\System32\drivers\mfewfpk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\WINDOWS\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfenlfk) – C:\WINDOWS\System32\drivers\mfenlfk.sys (McAfee, Inc.)
DRV - (cfwids) – C:\WINDOWS\System32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mfehidk) – C:\Windows\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\WINDOWS\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (XAudio) – C:\WINDOWS\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (HSXHWBS2) – C:\WINDOWS\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (e1express) Intel® – C:\WINDOWS\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (R300) – C:\WINDOWS\System32\drivers\atikmdag.sys (ATI Technologies Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USCON/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2011/07/17 22:09:22 | 000,000,000 | —D | M]


O1 HOSTS File: ([2006/09/18 11:41:30 | 000,000,761 | —- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\Mcafee\SystemCore\ScriptSn.20110717142037.dll (McAfee, Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O4 - HKLM..\Run: [dellsupportcenter] File not found
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: //@mail.mar@/ ([]msn in Local intranet)
O15 - HKCU\..Trusted Domains: //@signup.mar@/ ([]msn in Computer)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Inspiron_DT_1152x864_01.jpg
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Inspiron_DT_1152x864_01.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 11:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2004/04/30 11:01:00 | 000,000,053 | -HS- | M] () - D:\AUTORUN.INF – [ NTFS ]
O33 - MountPoints2\{663f744a-3f0d-11de-a456-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{663f744a-3f0d-11de-a456-806e6f6e6963}\Shell\AutoRun\command - "" = E:\langsel.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/07/17 23:24:58 | 000,000,000 | —D | C] – C:\Users\[removed]\Documents\My Downloads
[2011/07/17 22:55:52 | 000,000,000 | —D | C] – C:\Users\[removed]\AppData\Local\Adobe
[2011/07/17 20:18:22 | 000,000,000 | —D | C] – C:\Users\[removed]\AppData\Roaming\Macromedia
[2011/07/17 19:45:08 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2011/07/17 14:20:36 | 000,009,344 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfeclnk.sys
[2011/07/17 14:20:13 | 000,312,616 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfefirek.sys
[2011/07/17 14:20:13 | 000,160,720 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfewfpk.sys
[2011/07/17 14:20:13 | 000,152,320 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfeavfk.sys
[2011/07/17 14:20:13 | 000,083,496 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mferkdet.sys
[2011/07/17 14:20:13 | 000,064,304 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfenlfk.sys
[2011/07/17 14:20:13 | 000,055,456 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\cfwids.sys
[2011/07/17 14:20:13 | 000,051,688 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfebopk.sys
[2011/07/17 14:20:02 | 000,000,000 | —D | C] – C:\Program Files\McAfee.com
[2011/07/17 14:20:02 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Mcafee
[2011/07/17 14:19:49 | 000,000,000 | —D | C] – C:\Program Files\McAfee
[2011/07/17 14:18:47 | 000,095,568 | R— | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfeapfk.sys
[2011/07/17 14:18:37 | 000,000,000 | —D | C] – C:\ProgramData\McAfee
[2011/07/17 13:39:48 | 000,000,000 | —D | C] – C:\Users\[removed]\AppData\Roaming\Adobe
[2011/07/17 13:14:58 | 000,000,000 | —D | C] – C:\Windows\System32\vmm32
[2011/07/17 11:47:45 | 000,000,000 | —D | C] – C:\Users\[removed]\Tracing
[2011/07/17 11:47:36 | 000,000,000 | —D | C] – C:\Users\[removed]\AppData\Roaming\MSN6
[2011/07/17 10:54:55 | 000,044,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wups2.dll
[2011/07/17 10:54:54 | 002,421,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wucltux.dll
[2011/07/17 10:54:31 | 000,035,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wups.dll
[2011/07/17 10:54:30 | 000,575,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wuapi.dll
[2011/07/17 10:54:30 | 000,087,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wudriver.dll
[2011/07/17 10:54:24 | 000,171,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wuwebv.dll
[2011/07/17 10:54:24 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wuapp.exe
[2011/07/17 04:49:35 | 000,000,000 | —D | C] – C:\Users\[removed]\AppData\Roaming\MSNInstaller
[2011/07/17 04:49:32 | 000,000,000 | —D | C] – C:\Program Files\MSN
[2011/07/17 04:48:37 | 000,000,000 | —D | C] – C:\Users\[removed]\AppData\Local\Stardock_Corporation
[2011/07/17 04:46:12 | 000,000,000 | —D | C] – C:\Users\[removed]\AppData\Local\DataSafeOnline
[2011/07/17 04:46:01 | 000,000,000 | —D | C] – C:\Intel
[2011/07/17 04:45:52 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/07/17 04:45:48 | 000,000,000 | R–D | C] – C:\Users\[removed]\Searches
[2011/07/17 04:45:48 | 000,000,000 | R–D | C] – C:\Users\[removed]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/07/17 04:45:40 | 000,000,000 | —D | C] – C:\Users\[removed]\AppData\Roaming\Identities
[2011/07/17 04:45:38 | 000,000,000 | R–D | C] – C:\Users\[removed]\Contacts
[2011/07/17 04:45:36 | 000,000,000 | —D | C] – C:\Users\[removed]\AppData\Local\VirtualStore
[2011/07/17 04:45:30 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2011/07/17 04:43:21 | 000,000,000 | —D | C] – C:\Users\[removed]\AppData\Roaming\Dell
[2011/07/17 04:43:06 | 000,000,000 | –SD | C] – C:\Users\[removed]\AppData\Roaming\Microsoft
[2011/07/17 04:43:06 | 000,000,000 | R–D | C] – C:\Users\[removed]\Videos
[2011/07/17 04:43:06 | 000,000,000 | R–D | C] – C:\Users\[removed]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011/07/17 04:43:06 | 000,000,000 | R–D | C] – C:\Users\[removed]\Saved Games
[2011/07/17 04:43:06 | 000,000,000 | R–D | C] – C:\Users\[removed]\Pictures
[2011/07/17 04:43:06 | 000,000,000 | R–D | C] – C:\Users\[removed]\Music
[2011/07/17 04:43:06 | 000,000,000 | R–D | C] – C:\Users\[removed]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011/07/17 04:43:06 | 000,000,000 | R–D | C] – C:\Users\[removed]\Links
[2011/07/17 04:43:06 | 000,000,000 | R–D | C] – C:\Users\[removed]\Favorites
[2011/07/17 04:43:06 | 000,000,000 | R–D | C] – C:\Users\[removed]\Downloads
[2011/07/17 04:43:06 | 000,000,000 | R–D | C] – C:\Users\[removed]\Documents
[2011/07/17 04:43:06 | 000,000,000 | R–D | C] – C:\Users\[removed]\Desktop
[2011/07/17 04:43:06 | 000,000,000 | R–D | C] – C:\Users\[removed]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\AppData\Local\Temporary Internet Files
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\Templates
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\Start Menu
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\SendTo
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\Recent
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\PrintHood
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\NetHood
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\Documents\My Videos
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\Documents\My Pictures
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\Documents\My Music
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\My Documents
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\Local Settings
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\AppData\Local\History
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\Cookies
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\Application Data
[2011/07/17 04:43:06 | 000,000,000 | -HSD | C] – C:\Users\[removed]\AppData\Local\Application Data
[2011/07/17 04:43:06 | 000,000,000 | -H-D | C] – C:\Users\[removed]\AppData
[2011/07/17 04:43:06 | 000,000,000 | —D | C] – C:\Users\[removed]\AppData\Local\Temp
[2011/07/17 04:43:06 | 000,000,000 | —D | C] – C:\Users\[removed]\AppData\Local\SoftThinks
[2011/07/17 04:43:06 | 000,000,000 | —D | C] – C:\Users\[removed]\AppData\Local\Microsoft
[2011/07/17 04:43:06 | 000,000,000 | —D | C] – C:\Users\[removed]\AppData\Roaming\Media Center Programs
[2011/07/17 04:39:09 | 000,000,000 | -HSD | C] – C:\ProgramData\Templates
[2011/07/17 04:39:09 | 000,000,000 | -HSD | C] – C:\Users\Public\Documents\My Videos
[2011/07/17 04:39:09 | 000,000,000 | -HSD | C] – C:\Users\Public\Documents\My Pictures
[2011/07/17 04:39:09 | 000,000,000 | -HSD | C] – C:\Users\Public\Documents\My Music
[2011/07/17 04:39:08 | 000,000,000 | -HSD | C] – C:\ProgramData\Start Menu
[2011/07/17 04:39:08 | 000,000,000 | -HSD | C] – C:\ProgramData\Favorites
[2011/07/17 04:39:08 | 000,000,000 | -HSD | C] – C:\ProgramData\Documents
[2011/07/17 04:39:08 | 000,000,000 | -HSD | C] – C:\ProgramData\Desktop
[2011/07/17 04:39:08 | 000,000,000 | -HSD | C] – C:\ProgramData\Application Data

========== Files - Modified Within 30 Days ==========

[2011/07/17 23:44:06 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/07/17 23:44:06 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/07/17 22:55:03 | 000,000,388 | —- | M] () – C:\Users\[removed]\Desktop\Documents - Shortcut.lnk
[2011/07/17 22:54:57 | 000,000,385 | —- | M] () – C:\Users\[removed]\Desktop\Pictures - Shortcut.lnk
[2011/07/17 19:50:21 | 000,595,446 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/07/17 19:50:21 | 000,101,144 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/07/17 19:45:08 | 000,001,735 | —- | M] () – C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2011/07/17 19:44:05 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/07/17 11:30:51 | 000,230,120 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/07/17 10:54:52 | 000,001,973 | —- | M] () – C:\Users\Public\Desktop\MSN.lnk
[2011/07/17 10:54:52 | 000,001,787 | —- | M] () – C:\Users\[removed]\Application Data\Microsoft\Internet Explorer\Quick Launch\MSN.lnk
[2011/07/17 05:25:19 | 000,000,943 | —- | M] () – C:\Users\[removed]\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/07/17 04:37:39 | 000,047,092 | —- | M] () – C:\Windows\System32\license.rtf

========== Files Created - No Company Name ==========

[2011/07/17 22:55:03 | 000,000,388 | —- | C] () – C:\Users\[removed]\Desktop\Documents - Shortcut.lnk
[2011/07/17 22:54:57 | 000,000,385 | —- | C] () – C:\Users\[removed]\Desktop\Pictures - Shortcut.lnk
[2011/07/17 14:25:11 | 000,001,029 | —- | C] () – C:\Users\[removed]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MSN Connection Center.lnk
[2011/07/17 14:24:21 | 000,001,735 | —- | C] () – C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2011/07/17 10:54:52 | 000,001,973 | —- | C] () – C:\Users\Public\Desktop\MSN.lnk
[2011/07/17 10:54:52 | 000,001,787 | —- | C] () – C:\Users\[removed]\Application Data\Microsoft\Internet Explorer\Quick Launch\MSN.lnk
[2011/07/17 05:25:19 | 000,000,943 | —- | C] () – C:\Users\[removed]\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/07/17 04:45:50 | 000,000,949 | —- | C] () – C:\Users\[removed]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011/07/17 04:45:48 | 000,000,944 | —- | C] () – C:\Users\[removed]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2011/07/17 04:45:38 | 000,000,915 | —- | C] () – C:\Users\[removed]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2011/07/17 04:43:06 | 000,000,258 | —- | C] () – C:\Users\[removed]\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2009/05/12 13:54:58 | 001,953,696 | —- | C] () – C:\Windows\System32\igklg400.dll
[2009/05/12 13:54:58 | 001,533,360 | —- | C] () – C:\Windows\System32\igklg450.dll
[2009/05/12 13:54:58 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1409.dll
[2009/05/12 13:54:58 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2009/05/12 13:51:36 | 000,106,605 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/05/12 13:51:36 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/02/03 13:11:25 | 000,000,000 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2006/11/02 02:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 02:47:37 | 000,230,120 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 02:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 00:33:01 | 000,595,446 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 00:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 00:33:01 | 000,101,144 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 00:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 00:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 00:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/01 22:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/01 22:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/01 21:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/01 21:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat

========== LOP Check ==========

[2011/07/17 05:03:53 | 000,000,000 | —D | M] – C:\Users\[removed]\AppData\Roaming\MSNInstaller
[2011/07/17 19:43:10 | 000,008,602 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2006/09/18 11:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2008/01/20 16:24:42 | 000,333,203 | RHS- | M] () – C:\bootmgr
[2006/09/18 11:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2009/05/12 13:55:07 | 000,003,879 | RH– | M] () – C:\dell.sdr
[2011/07/17 19:43:49 | 3523,690,496 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/11/02 02:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 02:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 02:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 02:37:12 | 000,030,808 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 11:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/11/02 02:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2008/12/04 17:55:20 | 000,307,560 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 16:43:21 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/01/20 17:14:18 | 016,846,848 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 17:14:08 | 000,106,496 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 17:14:18 | 000,020,480 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 00:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 00:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/07/17 05:25:19 | 000,000,221 | -HS- | M] () – C:\Users\[removed]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-07-18 05:42:23

< End of report >
.
.
I will post the extras report in teh next post, thanks and aloha.

Kalai
Post #5
Hi, this is the Extras report—
OTL Extras logfile created on: 7/17/2011 11:53:57 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\[removed]\Documents\My Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.99 Gb Total Physical Memory | 1.97 Gb Available Physical Memory | 65.93% Memory free
6.19 Gb Paging File | 4.94 Gb Available in Paging File | 79.81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 283.40 Gb Total Space | 227.18 Gb Free Space | 80.16% Space Free | Partition Type: NTFS
Drive D: | 14.65 Gb Total Space | 2.97 Gb Free Space | 20.27% Space Free | Partition Type: NTFS

Computer Name: KOAWOODHAWAI-PC | User Name: [removed] | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{16A6B806-D12C-4556-B858-4261A78A6D3C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{83189024-DD45-4C07-9CD8-AA583CA15E9C}" = lport=2869 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2C1540BF-975F-4506-BBDB-643F88A5861E}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{402B5211-C876-4001-B1AB-ADF63F81FD32}" = dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{C785EDDA-20EF-4CBD-AC5A-E9311738D34E}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{FD5C0711-205A-42BF-8C5F-10AC33F7953A}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{020D8396-D6D9-4B53-A9A1-83C47E2E27AA}" = Windows Live Call
"{053C30EA-D4C6-47A0-8537-8D231D9BE873}" = DELL0703
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 11
"{294EAADF-E50F-4DD8-AD8D-19587EA10512}" = Modem Diagnostic Tool
"{299CF645-48C7-4FA1-8BCD-5CE200CF180D}" = Microsoft Search Enhancement Pack
"{2B4C7E1E-E446-4740-ADB5-9842E742EE8A}" = Windows Live Toolbar
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3138EAD3-700B-4A10-B617-B3F8096EE30D}" = Dell Edoc Viewer
"{42929F0F-CE14-47AF-9FC7-FF297A603021}" = Dell Resource CD
"{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}" = Banctec Service Agreement
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{505DF7A3-88D5-4DD6-9AD5-C98C2ED0CEC4}" = Windows Live Sign-in Assistant
"{63C1109E-D977-49ED-BCE3-D00D0BF187D6}" = Windows Live Mail
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}" = Windows Live Writer
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel® PRO Network Connections 12.1.11.0
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B935C985-A17F-484B-8470-09E4FC27DC26}" = Dell-eBay
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{D9D754A1-EAC5-406C-A28B-C49B1E846711}" = Windows Live Essentials
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F73A5B18-EB75-4B2C-B32D-9457576E2417}" = Windows Live Photo Gallery
"{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}" = Windows Live Sync
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"CNXT_MODEM_PCI_HSF" = Conexant D850 PCI V.92 Modem
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"MSC" = McAfee Total Protection
"MSNINST" = MSN
"PROSetDX" = Intel® PRO Network Connections 12.1.11.0
"WildTangent dell Master Uninstall" = WildTangent Games
"WinLiveSuite_Wave3" = Windows Live Essentials

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/17/2011 8:17:31 PM | Computer Name = koawoodhawai-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/17/2011 8:24:49 PM | Computer Name = koawoodhawai-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 7/17/2011 8:24:49 PM | Computer Name = koawoodhawai-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 7/17/2011 8:24:49 PM | Computer Name = koawoodhawai-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 7/17/2011 8:24:49 PM | Computer Name = koawoodhawai-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 7/17/2011 9:04:20 PM | Computer Name = koawoodhawai-PC | Source = Microsoft-Windows-CAPI2 | ID = 131077
Description =

Error - 7/17/2011 9:04:20 PM | Computer Name = koawoodhawai-PC | Source = Microsoft-Windows-CAPI2 | ID = 131077
Description =

Error - 7/18/2011 12:25:06 AM | Computer Name = koawoodhawai-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/18/2011 1:45:38 AM | Computer Name = koawoodhawai-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/18/2011 5:30:03 AM | Computer Name = koawoodhawai-PC | Source = Application Error | ID = 1000
Description = Faulting application mcagent.exe, version 10.5.177.0, time stamp 0x4bcccad5,
faulting module OLEAUT32.dll, version 6.0.6001.18000, time stamp 0x4791a74f, exception
code 0xc0000005, fault offset 0x0002ff54, process id 0xcd4, application start time
0x01cc450dd9d1b559.

[ System Events ]
Error - 7/17/2011 8:35:05 PM | Computer Name = koawoodhawai-PC | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{599E6033-102B-44D0-B474-EE05964A85E4}
because another computer on the network has the same name. The server could not
start.

Error - 7/17/2011 8:54:16 PM | Computer Name = koawoodhawai-PC | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{599E6033-102B-44D0-B474-EE05964A85E4}
because another computer on the network has the same name. The server could not
start.

Error - 7/17/2011 8:54:19 PM | Computer Name = koawoodhawai-PC | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{599E6033-102B-44D0-B474-EE05964A85E4}
because another computer on the network has the same name. The server could not
start.

Error - 7/18/2011 12:23:33 AM | Computer Name = koawoodhawai-PC | Source = HTTP | ID = 15016
Description =

Error - 7/18/2011 12:25:06 AM | Computer Name = koawoodhawai-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 7/18/2011 12:25:12 AM | Computer Name = koawoodhawai-PC | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{599E6033-102B-44D0-B474-EE05964A85E4}
because another computer on the network has the same name. The server could not
start.

Error - 7/18/2011 1:44:17 AM | Computer Name = koawoodhawai-PC | Source = HTTP | ID = 15016
Description =

Error - 7/18/2011 1:45:38 AM | Computer Name = koawoodhawai-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 7/18/2011 1:46:14 AM | Computer Name = koawoodhawai-PC | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{599E6033-102B-44D0-B474-EE05964A85E4}
because another computer on the network has the same name. The server could not
start.

Error - 7/18/2011 1:46:20 AM | Computer Name = koawoodhawai-PC | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{599E6033-102B-44D0-B474-EE05964A85E4}
because another computer on the network has the same name. The server could not
start.


< End of report >
.
Please let me know it I am still infected with this Personal Shield Pro and let me know if you have any questions, aloha.

Kalai
Post #6
Hi Kalai,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

If you reformatted… you got rid of the virus. Though if you restored infected files onto your "clean" computer… you would be re-infected.

I'm not seeing any sign of infections in your logs.

Let's get an online scan as a double check:

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
Post #7
Hi TomK, thanks for helping me, I tried to use the online scan and nothing happened, I am at 42 kbps could that be the reason, any ideas, thanks. Kalai
Post #8
Kalai,

It should have worked… but maybe we'll just do things differently.

This is a good tool for you to have and use. It won't interfere with your other security. Just run it once a week or so to help keep an eye on things.

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).
Post #9
Hi TomK, this is what I got from the Malwarebytes– Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Database version: 7268 Windows 6.0.6001 Service Pack 1 Internet Explorer 7.0.6001.18000 7/24/2011 6:44:11 PM mbam-log-2011-07-24 (18-44-11).txt Scan type: Quick scan Objects scanned: 149627 Time elapsed: 4 minute(s), 34 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Thanks and aloha. Kalai
Post #10
Kalai,

I think you are good to go. :thumbup:

Keep the Malwarebytes' program. Update it and run a scan every now and then.

  • Double click on OTL to run it.
  • Click on CleanUp!
  • When done, you will be prompted to restart your computer. Please restart your computer.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:
Post #11
Hi TomK, thanks for your help, I understand all that you have said and I thank you for your help, aloha from Hawaii and Mahalo nui loa. Kalai

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI