Phishing or spyware? password reset

Hi so recently my passwords for several of my accounts have been being changing. I'm not too entirely sure what the cause is however, I believe it might be the cause of a phishing website or spyware. My gmail account password has been changed and now I can't even retrieve it because for some reason, my security question also got changed. As for my aol email, the same thing occured where the passwords would change everytime I tried to reset it and input my own password and this has been going on for the past 3 days. however just today, my aol email's security question also got changed so I can't even reset the password at this point. My facebook and other social networking accounts, the passwords keep reverting back to my old password whenever I change it. I'm not really sure what the cause is but I really need your assistance. I can't even communicate or go online now to talk to people because I can't access any of my emails or my social networking sites. Am I infected with a spyware and is someone on my account? Please help me. I know this description might sound weird but that is the case. Here's my OTL log


OTL logfile created on: 8/12/2011 12:02:59 PM - Run 5
OTL by OldTimer - Version 3.2.26.1 Folder = C:UserskennyDownloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19120)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.93 Gb Total Physical Memory | 0.58 Gb Available Physical Memory | 29.89% Memory free
4.10 Gb Paging File | 2.54 Gb Available in Paging File | 61.93% Paging File free
Paging file location(s): ?:pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:Windows | %ProgramFiles% = C:Program Files
Drive C: | 139.19 Gb Total Space | 70.94 Gb Free Space | 50.96% Space Free | Partition Type: NTFS
Drive D: | 9.86 Gb Total Space | 1.74 Gb Free Space | 17.70% Space Free | Partition Type: NTFS

Computer Name: KENNY-PC | User Name: kenny | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:UserskennyDownloadsOTL.exe (OldTimer Tools)
PRC - C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe (Malwarebytes Corporation)
PRC - C:Program FilesooVooooVoo.exe (ooVoo LLC)
PRC - C:Program FilesAVAST SoftwareAvastAvastUI.exe (AVAST Software)
PRC - C:Program FilesAVAST SoftwareAvastAvastSvc.exe (AVAST Software)
PRC - C:Program FilesAIM7aim.exe (AOL Inc.)
PRC - C:Windowsexplorer.exe (Microsoft Corporation)
PRC - C:Program FilesLogitechQuickCamQuickcam.exe ()
PRC - C:Program FilesCommon FilesLogiShrdLQCVFXCOCIManager.exe ()
PRC - C:Program FilesCommon FilesLogiShrdLVMVFMLVPrcSrv.exe (Logitech Inc.)
PRC - C:Program FilesYahoo!SoftwareUpdateYahooAUService.exe (Yahoo! Inc.)
PRC - C:WindowsSMINSTBLService.exe ()
PRC - C:Program FilesWindows DefenderMSASCui.exe (Microsoft Corporation)
PRC - C:Program FilesViewpointCommonViewpointService.exe (Viewpoint Corporation)


========== Modules (SafeList) ==========

MOD - C:UserskennyDownloadsOTL.exe (OldTimer Tools)
MOD - C:Program FilesAVAST SoftwareAvastsnxhk.dll (AVAST Software)
MOD - C:Windowswinsxsx86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (Akamai) – c:Program FilesCommon FilesAkamainetsession_win_2da1ebd.dll ()
SRV - (MBAMService) – C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe (Malwarebytes Corporation)
SRV - (avast! Antivirus) – C:Program FilesAVAST SoftwareAvastAvastSvc.exe (AVAST Software)
SRV - (npggsvc) – C:WindowsSystem32GameMon.des (INCA Internet Co., Ltd.)
SRV - (LVPrcSrv) – C:Program FilesCommon FilesLogiShrdLVMVFMLVPrcSrv.exe (Logitech Inc.)
SRV - (OpenVPNService) – C:Program FilesOpenVPNbinopenvpnserv.exe ()
SRV - (YahooAUService) – C:Program FilesYahoo!SoftwareUpdateYahooAUService.exe (Yahoo! Inc.)
SRV - (Recovery Service for Windows) – C:WindowsSMINSTBLService.exe ()
SRV - (WinDefend) – C:Program FilesWindows DefenderMpSvc.dll (Microsoft Corporation)
SRV - (Viewpoint Manager Service) – C:Program FilesViewpointCommonViewpointService.exe (Viewpoint Corporation)


========== Driver Services (SafeList) ==========

DRV - (MBAMProtector) – C:WindowsSystem32driversmbam.sys (Malwarebytes Corporation)
DRV - (aswSnx) – C:WindowsSystem32driversaswSnx.sys (AVAST Software)
DRV - (aswSP) – C:WindowsSystem32driversaswSP.sys (AVAST Software)
DRV - (aswTdi) – C:WindowsSystem32driversaswTdi.sys (AVAST Software)
DRV - (aswRdr) – C:WindowsSystem32driversaswRdr.sys (AVAST Software)
DRV - (aswMonFlt) – C:WindowsSystem32driversaswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) – C:WindowsSystem32driversaswFsBlk.sys (AVAST Software)
DRV - (Mkd2kfNt) – C:WindowsSystem32driversMkd2kfNT.sys (AhnLab, Inc.)
DRV - (hamachi) – C:WindowsSystem32drivershamachi.sys (LogMeIn, Inc.)
DRV - (TesDrvPt) – C:WindowsSystem32TesDrvPt.sys (TENCENT)
DRV - (Mkd2Nadr) – C:WindowsSystem32driversMkd2Nadr.sys (AhnLab, Inc.)
DRV - (LVUVC) QuickCam Pro for Notebooks(UVC) – C:WindowsSystem32driverslvuvc.sys (Logitech Inc.)
DRV - (LVUSBSta) – C:WindowsSystem32driversLVUSBSta.sys (Logitech Inc.)
DRV - (LVRS) – C:WindowsSystem32driverslvrs.sys (Logitech Inc.)
DRV - (LVPr2Mon) – C:WindowsSystem32driversLVPr2Mon.sys ()
DRV - (tap0901) – C:WindowsSystem32driverstap0901.sys (The OpenVPN Project)
DRV - (RTL8169) – C:WindowsSystem32driversRtlh86.sys (Realtek Corporation )
DRV - (CnxtHdAudService) – C:WindowsSystem32driversCHDRT32.sys (Conexant Systems Inc.)
DRV - (IntcHdmiAddService) Intel® – C:WindowsSystem32driversIntcHdmi.sys (Intel® Corporation)
DRV - (athr) – C:WindowsSystem32driversathr.sys (Atheros Communications, Inc.)
DRV - (msloop) – C:WindowsSystem32driversloop.sys (Microsoft Corporation)
DRV - (XAudio) – C:WindowsSystem32driversXAudio.sys (Conexant Systems, Inc.)
DRV - (lvpopflt) – C:WindowsSystem32driverslvpopflt.sys (Logitech Inc.)
DRV - (HpqKbFiltr) – C:WindowsSystem32driversHpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (NVENETFD) – C:WindowsSystem32driversnvm60x32.sys (NVIDIA Corporation)
DRV - (NPPTNT2) – C:WindowsSystem32npptNT2.sys (INCA Internet Co., Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLMSOFTWAREMicrosoftInternet ExplorerMain,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…rio&pf;=cnnb
IE - HKLM..URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:Program FilesAIM Toolbaraimtb.dll (AOL LLC.)

IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Search Bar = http://www.crawler.com/search/dispatcher.a…&tbid;=60468
IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Start Page = http://www.bing.com/?pc=Z015&form;=ZGAPHP
IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Start Page Restore = http://www.google.com/
IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,StartPageCache = 1
IE - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings: "ProxyEnable" = 0
IE - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: [removed]:20110101
FF - prefs.js..keyword.URL: "http://www.bing.com/search?pc=Z015&form;=ZGAADF&q;="


FF - [removed]/FlashPlayer: C:Windowssystem32MacromedFlashNPSWF32.dll ()
FF - [removed]/ShockwavePlayer: C:Windowssystem32AdobeDirectornp32dsw.dll (Adobe Systems, Inc.)
FF - [removed]/asp/npaosmgr.1: C:Program FilesAhnLabASPComponentsaosmgrconflict_221npaosmgr.dll (AhnLab, Inc.)
FF - [removed]/asp/npmkd25aos: C:Program FilesAhnLabASPMyKeyDefense 2.5npmkd25aos.dll (AhnLab, Inc.)
FF - [removed]/vlc;version=0.8.6f: C:Program FilesDyynoDyyno Playernpvlc.dll (Dyyno)
FF - [removed]/JavaPlugin: C:Program FilesJavajre6binnew_pluginnpjp2.dll (Sun Microsystems, Inc.)
FF - [removed]/NpCtrl,version=1.0: c:Program FilesMicrosoft Silverlight4.0.60531.0npctrl.dll ( Microsoft Corporation)
FF - [removed]/OfficeLive,version=1.5: C:Program FilesMicrosoftOffice LivenpOLW.dll (Microsoft Corp.)
FF - [removed]/WLPG,version=15.4.3502.0922: C:Program FilesWindows LivePhoto GalleryNPWLPG.dll (Microsoft Corporation)
FF - [removed]/WLPG,version=15.4.3508.1109: C:Program FilesWindows LivePhoto GalleryNPWLPG.dll (Microsoft Corporation)
FF - [removed]/WPF,version=3.5: c:WindowsMicrosoft.NETFrameworkv3.5Windows Presentation FoundationNPWPF.dll (Microsoft Corporation)
FF - [removed]/NxGame: C:ProgramDataNexonUSNGMnpNxGameUS.dll (Nexon)
FF - [removed]/PandoWebPlugin: C:Program FilesPando NetworksMedia BoosternpPandoWebPlugin.dll (Pando Networks)
FF - [removed]/Google Update;version=3: C:Program FilesGoogleUpdate1.3.21.65npGoogleUpdate3.dll (Google Inc.)
FF - [removed]/Google Update;version=9: C:Program FilesGoogleUpdate1.3.21.65npGoogleUpdate3.dll (Google Inc.)
FF - [removed]/VMP: C:Program FilesViewpointViewpoint Media PlayernpViewpoint.dll ()
FF - [removed]/asp/npmkd25aos: C:Program FilesAhnLabASPMyKeyDefense 2.5npmkd25aos.dll (AhnLab, Inc.)
FF - [removed]/Google Update;version=3: C:UserskennyAppDataLocalGoogleUpdate1.3.21.65npGoogleUpdate3.dll (Google Inc.)
FF - [removed]/Google Update;version=9: C:UserskennyAppDataLocalGoogleUpdate1.3.21.65npGoogleUpdate3.dll (Google Inc.)
FF - HKCUSoftwareMozillaPluginspandonetworks.com/PandoWebPlugin: C:Program FilesPando NetworksMedia BoosternpPandoWebPlugin.dll (Pando Networks)

FF - [removed]: C:Program FilesHPDigital ImagingSmart Web PrintingMozillaAddOn3 [2010/01/13 17:56:52 | 000,000,000 | —D | M]
FF - [removed]: C:Program FilesAVAST SoftwareAvastWebRepFF [2011/08/01 16:29:26 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINEsoftwaremozillaMozilla Firefox 5.0extensionsComponents: C:Program FilesMozilla Firefoxcomponents [2011/08/07 21:06:52 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINEsoftwaremozillaMozilla Firefox 5.0extensionsPlugins: C:Program FilesMozilla Firefoxplugins [2011/08/07 21:06:52 | 000,000,000 | —D | M]
FF - [removed]: C:Program FilesHPDigital ImagingSmart Web PrintingMozillaAddOn3 [2010/01/13 17:56:52 | 000,000,000 | —D | M]

[2011/01/03 19:38:36 | 000,000,000 | —D | M] (No name found) – C:UserskennyAppDataRoamingMozillaExtensions
[2009/11/03 14:29:23 | 000,000,000 | —D | M] (No name found) – C:[removed]
[2011/05/20 16:27:08 | 000,000,000 | —D | M] (No name found) – C:UserskennyAppDataRoamingMozillaFirefoxProfilesfk1mvvth.defaultextensi
ons
[2011/04/11 20:32:24 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:UserskennyAppDataRoamingMozillaFirefoxProfilesfk1mvvth.defaultextensi
ons{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/30 00:47:07 | 000,001,919 | —- | M] () – C:UserskennyAppDataRoamingMozillaFirefoxProfilesfk1mvvth.defaultsearchp
luginsbing-zugo.xml
[2011/06/08 00:15:54 | 000,000,000 | —D | M] (No name found) – C:Program FilesMozilla Firefoxextensions
[2010/12/28 22:08:59 | 000,000,000 | —D | M] (Java Console) – C:Program FilesMozilla Firefoxextensions{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/05/30 18:56:23 | 000,000,000 | —D | M] (Java Console) – C:Program FilesMozilla Firefoxextensions{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
[2011/06/08 00:15:54 | 000,000,000 | —D | M] (Java Console) – C:Program FilesMozilla Firefoxextensions{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
File not found (No name found) –
[2011/06/25 16:23:03 | 000,142,296 | —- | M] (Mozilla Foundation) – C:Program Filesmozilla firefoxcomponentsbrowsercomps.dll
[2011/05/04 04:52:23 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:Program Filesmozilla firefoxpluginsnpdeployJava1.dll
[2007/04/16 13:07:12 | 000,180,293 | —- | M] () – C:Program Filesmozilla firefoxpluginsnpViewpoint.dll
[2011/05/20 17:17:29 | 000,002,252 | —- | M] () – C:Program Filesmozilla firefoxsearchpluginsbing.xml
[2009/09/21 12:24:16 | 000,001,329 | —- | M] () – C:Program Filesmozilla firefoxsearchpluginscrawlersrch.xml

O1 HOSTS File: ([2010/07/31 18:53:39 | 000,000,027 | —- | M]) - C:WindowsSystem32driversetchosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpn0yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ooVoo Toolbar) - {59c6f12b-f004-43e5-9997-08f2123119b6} - C:Program FilesoovootoolbaroovootoolbarX.dll ()
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:Program FilesAVAST SoftwareAvastaswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier5.7.6406.1642swg.dll (Google Inc.)
O2 - BHO: (FlashGetBHO) - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:UserskennyAppDataRoamingFlashGetBHOFlashGetBHO3.dll (Trend Media Group)
O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:Program FilesAIM Toolbaraimtb.dll (AOL LLC.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:Program FilesMSNToolbar3.0.0988.2msneshellx.dll (Microsoft Corp.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:Program FilesYahoo!CompanionInstallscpn0YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM..Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:Program FilesMSNToolbar3.0.0988.2msneshellx.dll (Microsoft Corp.)
O3 - HKLM..Toolbar: (ooVoo Toolbar) - {59c6f12b-f004-43e5-9997-08f2123119b6} - C:Program FilesoovootoolbaroovootoolbarX.dll ()
O3 - HKLM..Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:Program FilesAIM Toolbaraimtb.dll (AOL LLC.)
O3 - HKLM..Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:Program FilesAVAST SoftwareAvastaswWebRepIE.dll (AVAST Software)
O3 - HKLM..Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpn0yt.dll (Yahoo! Inc.)
O3 - HKCU..ToolbarWebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..Run: [] File not found
O4 - HKLM..Run: [avast] C:Program FilesAVAST SoftwareAvastavastUI.exe (AVAST Software)
O4 - HKLM..Run: [HP Health Check Scheduler] c:Program FilesHewlett-PackardHP Health CheckHPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..Run: [LogitechQuickCamRibbon] C:Program FilesLogitechQuickCamQuickcam.exe ()
O4 - HKLM..Run: [Malwarebytes' Anti-Malware] C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe (Malwarebytes Corporation)
O4 - HKLM..Run: [Windows Defender] C:Program FilesWindows DefenderMSASCui.exe (Microsoft Corporation)
O4 - HKCU..Run: [Aim] C:Program FilesAIM7aim.exe (AOL Inc.)
O4 - HKCU..Run: [ooVoo.exe] C:Program FilesooVoooovoo.exe (ooVoo LLC)
O6 - HKLMSoftwarePoliciesMicrosoftInternet ExplorerRestrictions present
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDrives = 0
O7 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O7 - HKCUSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 145
O7 - HKCUSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDrives = 0
O7 - HKCUSOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem: LogonHoursAction = 2
O7 - HKCUSOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Download All By FlashGet3 - C:UserskennyAppDataRoamingFlashGetBHOGetAllUrl.htm ()
O8 - Extra context menu item: Download By FlashGet3 - C:UserskennyAppDataRoamingFlashGetBHOGetUrl.htm ()
O8 - Extra context menu item: Google Sidewiki… - C:Program FilesGoogleGoogle ToolbarComponentGoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll (Google Inc.)
O10 - NameSpace_Catalog5Catalog_Entries\000000000007 [] - C:Program FilesBonjourmdnsNSP.dll (Apple Inc.)
O15 - HKCU..Trusted Domains: kuaiche.com ([software] http in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLMSystemCCSServicesTcpipParameters: DhcpNameServer = 192.168.1.1 [removed]
O18 - ProtocolHandlerbwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:Program FilesLogitechDesktop Messenger8876480ProgramGAPlugProtocol-8876480.dll (Logitech Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:Windowsexplorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:WindowsWebWallpaperimg29.jpg
O24 - Desktop BackupWallPaper: C:WindowsWebWallpaperimg29.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/06/27 14:16:34 | 000,000,074 | —- | M] () - C:autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM..comfile [open] – "%1" %*
O35 - HKLM..exefile [open] – "%1" %*
O37 - HKLM…com [@ = comfile] – "%1" %*
O37 - HKLM…exe [@ = exefile] – "%1" %*
O37 - HKCU…exe [@ = exefile] – Reg Error: Key error. File not found

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:MapleSeal3codeca.acm File not found
Drivers32: msacm.l3codecp - C:WindowsSystem32l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo - C:WindowsSystem32vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:WindowsSystem32vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:WindowsSystem32iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:WindowsSystem32LVCodec2.dll (Logitech Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/08/09 15:29:44 | 000,375,808 | —- | C] (Microsoft Corporation) – C:WindowsSystem32winsrv.dll
[2011/08/09 15:28:51 | 000,025,600 | —- | C] (Microsoft Corporation) – C:WindowsSystem32jsproxy.dll
[2011/08/09 15:28:41 | 000,174,080 | —- | C] (Microsoft Corporation) – C:WindowsSystem32ie4uinit.exe
[2011/08/09 15:28:40 | 000,105,984 | —- | C] (Microsoft Corporation) – C:WindowsSystem32url.dll
[2011/08/09 15:28:39 | 001,469,440 | —- | C] (Microsoft Corporation) – C:WindowsSystem32inetcpl.cpl
[2011/08/09 15:28:39 | 000,611,840 | —- | C] (Microsoft Corporation) – C:WindowsSystem32mstime.dll
[2011/08/09 15:28:39 | 000,602,112 | —- | C] (Microsoft Corporation) – C:WindowsSystem32msfeeds.dll
[2011/08/09 15:28:39 | 000,387,584 | —- | C] (Microsoft Corporation) – C:WindowsSystem32iedkcs32.dll
[2011/08/09 15:28:38 | 000,385,024 | —- | C] (Microsoft Corporation) – C:WindowsSystem32html.iec
[2011/08/09 15:28:38 | 000,184,320 | —- | C] (Microsoft Corporation) – C:WindowsSystem32iepeers.dll
[2011/08/09 15:28:38 | 000,164,352 | —- | C] (Microsoft Corporation) – C:WindowsSystem32ieui.dll
[2011/08/09 15:28:38 | 000,109,056 | —- | C] (Microsoft Corporation) – C:WindowsSystem32iesysprep.dll
[2011/08/09 15:28:37 | 000,133,632 | —- | C] (Microsoft Corporation) – C:WindowsSystem32ieUnatt.exe
[2011/08/09 15:28:37 | 000,071,680 | —- | C] (Microsoft Corporation) – C:WindowsSystem32iesetup.dll
[2011/08/09 15:28:37 | 000,055,808 | —- | C] (Microsoft Corporation) – C:WindowsSystem32iernonce.dll
[2011/08/09 15:28:37 | 000,055,296 | —- | C] (Microsoft Corporation) – C:WindowsSystem32msfeedsbs.dll
[2011/08/09 15:28:37 | 000,043,520 | —- | C] (Microsoft Corporation) – C:WindowsSystem32licmgr10.dll
[2011/08/09 15:28:36 | 001,638,912 | —- | C] (Microsoft Corporation) – C:WindowsSystem32mshtml.tlb
[2011/08/09 15:28:36 | 000,013,312 | —- | C] (Microsoft Corporation) – C:WindowsSystem32msfeedssync.exe
[2011/08/09 15:28:05 | 003,602,832 | —- | C] (Microsoft Corporation) – C:WindowsSystem32ntkrnlpa.exe
[2011/08/09 15:28:04 | 003,550,096 | —- | C] (Microsoft Corporation) – C:WindowsSystem32ntoskrnl.exe
[2011/08/07 21:06:23 | 000,000,000 | —D | C] – C:ProgramDataMicrosoftWindowsStart MenuProgramsQuickTime
[2011/08/07 21:05:52 | 000,000,000 | —D | C] – C:Program FilesQuickTime
[2010/08/25 19:59:08 | 000,004,096 | —- | C] ( ) – C:WindowsSystem32IGFXDEVLib.dll

========== Files - Modified Within 30 Days ==========

[2011/08/12 12:15:00 | 000,000,418 | -H– | M] () – C:WindowstasksUser_Feed_Synchronization-{9FAFAA7E-1051-4934-AB73-B60567FBCA4A}.job
[2011/08/12 12:05:41 | 000,000,422 | -H– | M] () – C:WindowstasksUser_Feed_Synchronization-{36BAD781-23A8-4E6D-9F8B-3F41DB49DF2D}.job
[2011/08/12 11:54:13 | 000,000,886 | —- | M] () – C:WindowstasksGoogleUpdateTaskMachineUA.job
[2011/08/12 11:49:12 | 000,000,284 | —- | M] () – C:UsersPublicDocumentshpqp.ini
[2011/08/12 11:49:10 | 000,000,436 | —- | M] () – C:WindowsSystem32driversetchosts.ics
[2011/08/12 11:48:05 | 000,000,882 | —- | M] () – C:WindowstasksGoogleUpdateTaskMachineCore.job
[2011/08/12 11:47:26 | 000,003,216 | -H– | M] () – C:WindowsSystem327B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/12 11:47:25 | 000,003,216 | -H– | M] () – C:WindowsSystem327B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/12 11:47:12 | 000,067,584 | –S- | M] () – C:Windowsbootstat.dat
[2011/08/11 23:05:45 | 000,000,000 | —- | M] () – C:WindowsSystem32driverslvuvc.hs
[2011/08/11 22:41:16 | 000,000,908 | —- | M] () – C:WindowstasksGoogleUpdateTaskUserS-1-5-21-2974057216-669283323-2720603189-1000UA.job
[2011/08/10 16:10:08 | 000,008,428 | —- | M] () – C:WindowsSystem32hpasset.xml
[2011/08/10 00:07:56 | 000,648,426 | —- | M] () – C:WindowsSystem32perfh009.dat
[2011/08/10 00:07:56 | 000,122,250 | —- | M] () – C:WindowsSystem32perfc009.dat
[2011/08/09 20:43:33 | 000,002,042 | —- | M] () – C:UserskennyDesktopGoogle Chrome.lnk
[2011/08/09 20:43:33 | 000,002,004 | —- | M] () – C:UserskennyApplication DataMicrosoftInternet ExplorerQuick LaunchGoogle Chrome.lnk
[2011/08/07 21:06:24 | 000,001,726 | —- | M] () – C:UsersPublicDesktopQuickTime Player.lnk
[2011/08/05 11:25:34 | 000,131,665 | —- | M] () – C:UserskennyDesktopschedule.jpg
[2011/08/05 01:41:02 | 000,000,856 | —- | M] () – C:WindowstasksGoogleUpdateTaskUserS-1-5-21-2974057216-669283323-2720603189-1000Core.job
[2011/08/03 16:51:11 | 000,008,428 | —- | M] () – C:WindowsSystem32hpasset.xml.bkp
[2011/08/02 21:07:07 | 000,000,930 | —- | M] () – C:UserskennyApplication DataMicrosoftInternet ExplorerQuick LaunchMalwarebytes' Anti-Malware.lnk
[2011/08/02 21:07:07 | 000,000,906 | —- | M] () – C:UsersPublicDesktopMalwarebytes' Anti-Malware.lnk
[2011/08/01 23:14:29 | 000,000,322 | —- | M] () – C:WindowstasksHPCeeScheduleForkenny.job
[2011/08/01 16:35:02 | 000,001,829 | —- | M] () – C:UsersPublicDesktopavast! Free Antivirus.lnk
[2011/08/01 16:34:53 | 000,002,577 | —- | M] () – C:WindowsSystem32config.nt
[2011/07/23 07:04:18 | 000,105,984 | —- | M] (Microsoft Corporation) – C:WindowsSystem32url.dll
[2011/07/23 07:01:07 | 000,611,840 | —- | M] (Microsoft Corporation) – C:WindowsSystem32mstime.dll
[2011/07/23 07:00:36 | 000,602,112 | —- | M] (Microsoft Corporation) – C:WindowsSystem32msfeeds.dll
[2011/07/23 07:00:36 | 000,055,296 | —- | M] (Microsoft Corporation) – C:WindowsSystem32msfeedsbs.dll
[2011/07/23 07:00:05 | 000,043,520 | —- | M] (Microsoft Corporation) – C:WindowsSystem32licmgr10.dll
[2011/07/23 06:59:57 | 000,025,600 | —- | M] (Microsoft Corporation) – C:WindowsSystem32jsproxy.dll
[2011/07/23 06:59:52 | 001,469,440 | —- | M] (Microsoft Corporation) – C:WindowsSystem32inetcpl.cpl
[2011/07/23 06:59:35 | 000,164,352 | —- | M] (Microsoft Corporation) – C:WindowsSystem32ieui.dll
[2011/07/23 06:59:34 | 000,184,320 | —- | M] (Microsoft Corporation) – C:WindowsSystem32iepeers.dll
[2011/07/23 06:59:34 | 000,109,056 | —- | M] (Microsoft Corporation) – C:WindowsSystem32iesysprep.dll
[2011/07/23 06:59:34 | 000,071,680 | —- | M] (Microsoft Corporation) – C:WindowsSystem32iesetup.dll
[2011/07/23 06:59:34 | 000,055,808 | —- | M] (Microsoft Corporation) – C:WindowsSystem32iernonce.dll
[2011/07/23 06:59:29 | 000,387,584 | —- | M] (Microsoft Corporation) – C:WindowsSystem32iedkcs32.dll
[2011/07/23 06:03:47 | 000,385,024 | —- | M] (Microsoft Corporation) – C:WindowsSystem32html.iec
[2011/07/23 05:27:04 | 000,133,632 | —- | M] (Microsoft Corporation) – C:WindowsSystem32ieUnatt.exe
[2011/07/23 05:26:52 | 000,174,080 | —- | M] (Microsoft Corporation) – C:WindowsSystem32ie4uinit.exe
[2011/07/23 05:26:12 | 000,013,312 | —- | M] (Microsoft Corporation) – C:WindowsSystem32msfeedssync.exe
[2011/07/23 05:25:38 | 001,638,912 | —- | M] (Microsoft Corporation) – C:WindowsSystem32mshtml.tlb
[2011/07/17 22:57:54 | 000,001,726 | —- | M] () – C:UsersPublicDesktopooVoo.lnk

========== Files Created - No Company Name ==========

[2011/08/07 21:06:24 | 000,001,726 | —- | C] () – C:UsersPublicDesktopQuickTime Player.lnk
[2011/08/05 11:25:34 | 000,131,665 | —- | C] () – C:UserskennyDesktopschedule.jpg
[2011/06/25 17:03:49 | 000,000,891 | —- | C] () – C:WindowsSystem32secushr.dat
[2011/06/25 17:01:03 | 000,000,025 | —- | C] () – C:Windowslibem.INI
[2010/08/25 20:30:02 | 000,439,308 | —- | C] () – C:WindowsSystem32igcompkrng500.bin
[2010/08/25 20:30:00 | 000,982,240 | —- | C] () – C:WindowsSystem32igkrng500.bin
[2010/08/25 20:30:00 | 000,092,356 | —- | C] () – C:WindowsSystem32igfcg500m.bin
[2010/08/25 19:57:00 | 000,000,151 | —- | C] () – C:WindowsSystem32GfxUI.exe.config
[2010/08/25 19:52:00 | 000,208,896 | —- | C] () – C:WindowsSystem32iglhsip32.dll
[2010/08/25 19:52:00 | 000,143,360 | —- | C] () – C:WindowsSystem32iglhcp32.dll
[2010/01/13 17:56:15 | 000,023,087 | —- | C] () – C:Windowshpqins15.dat
[2009/09/30 16:30:37 | 000,000,321 | —- | C] () – C:WindowsSystem32XMLConfig_SYSID.ini
[2009/08/29 18:17:29 | 000,018,760 | —- | C] () – C:WindowsSystem32QQVistaHelper.dll
[2009/08/18 18:16:29 | 000,107,612 | —- | C] () – C:WindowsSystem32StructuredQuerySchema.bin
[2009/08/18 18:16:28 | 000,117,248 | —- | C] () – C:WindowsSystem32EhStorAuthn.dll
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:WindowsSystem32OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:WindowsSystem32OGAEXEC.exe
[2009/06/11 22:36:47 | 000,000,552 | —- | C] () – C:UserskennyAppDataLocald3d8caps.dat
[2009/04/22 17:38:34 | 000,081,110 | —- | C] () – C:WindowsSystem32lvcoinst.ini
[2009/02/21 23:31:05 | 000,000,056 | -H– | C] () – C:ProgramDataezsidmv.dat
[2009/01/20 20:01:51 | 000,000,132 | —- | C] () – C:UserskennyAppDataRoaming281.cmd
[2009/01/20 19:54:45 | 000,000,132 | —- | C] () – C:UserskennyAppDataRoaming888.cmd
[2009/01/20 19:51:01 | 000,000,132 | —- | C] () – C:UserskennyAppDataRoaming336.cmd
[2009/01/20 18:54:57 | 000,000,132 | —- | C] () – C:UserskennyAppDataRoaming196.cmd
[2008/12/22 20:59:19 | 000,005,972 | —- | C] () – C:UserskennyAppDataLocald3d9caps.dat
[2008/12/16 21:58:54 | 000,025,624 | —- | C] () – C:WindowsSystem32driversLVPr2Mon.sys
[2008/12/16 21:50:56 | 000,013,584 | —- | C] () – C:WindowsSystem32driversiKeyLgFT.dll
[2008/11/07 22:25:07 | 000,018,904 | —- | C] () – C:WindowsSystem32StructuredQuerySchemaTrivial.bin
[2008/11/07 20:30:25 | 000,029,696 | —- | C] () – C:UserskennyAppDataLocalDCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/06/27 14:31:32 | 000,101,605 | —- | C] () – C:Windowshpqins13.dat
[2008/06/12 14:59:22 | 000,147,456 | —- | C] () – C:WindowsSystem32igfxCoIn_v1502.dll
[2008/06/12 14:41:18 | 000,147,172 | —- | C] () – C:WindowsSystem32igfcg550.bin
[2008/06/04 13:54:12 | 000,004,608 | —- | C] () – C:WindowsSystem32HdmiCoin.dll
[2006/11/02 08:57:28 | 000,067,584 | –S- | C] () – C:Windowsbootstat.dat
[2006/11/02 08:47:37 | 002,325,504 | —- | C] () – C:WindowsSystem32FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | —- | C] () – C:WindowsSystem32sysprepMCE.dll
[2006/11/02 06:33:01 | 000,648,426 | —- | C] () – C:WindowsSystem32perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | —- | C] () – C:WindowsSystem32perfi009.dat
[2006/11/02 06:33:01 | 000,122,250 | —- | C] () – C:WindowsSystem32perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | —- | C] () – C:WindowsSystem32perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | —- | C] () – C:WindowsSystem32dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | —- | C] () – C:Windowsmib.bin
[2006/11/02 04:19:00 | 000,000,741 | —- | C] () – C:WindowsSystem32NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | —- | C] () – C:WindowsSystem32pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | —- | C] () – C:WindowsSystem32mlang.dat
[2006/04/30 00:34:04 | 000,049,152 | —- | C] () – C:WindowsSystem32WbxRMenu.dll
[2006/04/13 23:18:24 | 000,196,608 | —- | C] () – C:WindowsSystem32atonres.dll
[2006/04/13 23:18:24 | 000,131,072 | —- | C] () – C:WindowsSystem32WbxMSAI.dll
[2006/04/13 23:18:24 | 000,098,304 | —- | C] () – C:WindowsSystem32atonecli.dll
[2006/03/09 05:58:00 | 001,060,424 | —- | C] () – C:WindowsSystem32WdfCoInstaller01000.dll

========== LOP Check ==========

[2009/06/02 17:24:44 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingacccore
[2011/04/24 08:32:52 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingAIM
[2011/08/05 13:04:59 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingBITS
[2009/02/03 18:53:41 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingcom.raptr.Raptr.848BBC53270CAC248E8FA0F339176201C
DEB525F.1
[2011/06/25 16:59:51 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingFlashGet
[2011/06/25 16:59:30 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingFlashGetBHO
[2009/08/04 23:41:25 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingfunkitron
[2010/05/02 16:13:07 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingGetRightToGo
[2009/04/15 14:22:22 | 000,000,000 | -H-D | M] – C:UserskennyAppDataRoamingijjigame
[2010/07/11 01:20:11 | 000,000,000 | RHSD | M] – C:UserskennyAppDataRoaminginstall
[2010/02/10 13:03:26 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingLimeWire
[2008/11/08 11:44:51 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingNexon
[2010/02/10 23:36:16 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingooVoo Details
[2010/06/13 09:30:41 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingoovooinstaller
[2011/02/05 16:24:38 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingSynthesia
[2010/01/06 19:02:07 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingTeamViewer
[2009/08/29 19:19:18 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingTencent
[2008/11/07 22:43:07 | 000,000,000 | —D | M] – C:UserskennyAppDataRoamingWildTangent
[2011/08/11 23:14:10 | 000,032,562 | —- | M] () – C:WindowsTasksSCHEDLGU.TXT
[2011/08/12 12:05:41 | 000,000,422 | -H– | M] () – C:WindowsTasksUser_Feed_Synchronization-{36BAD781-23A8-4E6D-9F8B-3F41DB49DF2D}.job
[2011/08/12 12:15:00 | 000,000,418 | -H– | M] () – C:WindowsTasksUser_Feed_Synchronization-{9FAFAA7E-1051-4934-AB73-B60567FBCA4A}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%*.* >
[2008/06/27 14:16:34 | 000,000,074 | —- | M] () – C:autoexec.bat
[2009/04/11 02:36:36 | 000,333,257 | RHS- | M] () – C:bootmgr
[2009/07/22 22:43:03 | 000,001,439 | —- | M] () – C:cmdline.txt
[2010/07/31 18:59:58 | 000,016,485 | —- | M] () – C:ComboFix.txt
[2006/09/18 17:43:37 | 000,000,010 | —- | M] () – C:config.sys
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:eula.1028.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:eula.1031.txt
[2007/11/07 09:00:40 | 000,010,134 | —- | M] () – C:eula.1033.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:eula.1036.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:eula.1040.txt
[2007/11/07 09:00:40 | 000,000,118 | —- | M] () – C:eula.1041.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:eula.1042.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:eula.2052.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:eula.3082.txt
[2007/11/07 09:00:40 | 000,001,110 | —- | M] () – C:globdata.ini
[2007/11/07 09:00:40 | 000,000,843 | —- | M] () – C:install.ini
[2007/11/07 09:03:18 | 000,076,304 | —- | M] (Microsoft Corporation) – C:install.res.1028.dll
[2007/11/07 09:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:install.res.1031.dll
[2007/11/07 09:03:18 | 000,091,152 | —- | M] (Microsoft Corporation) – C:install.res.1033.dll
[2007/11/07 09:03:18 | 000,097,296 | —- | M] (Microsoft Corporation) – C:install.res.1036.dll
[2007/11/07 09:03:18 | 000,095,248 | —- | M] (Microsoft Corporation) – C:install.res.1040.dll
[2007/11/07 09:03:18 | 000,081,424 | —- | M] (Microsoft Corporation) – C:install.res.1041.dll
[2007/11/07 09:03:18 | 000,079,888 | —- | M] (Microsoft Corporation) – C:install.res.1042.dll
[2007/11/07 09:03:18 | 000,075,792 | —- | M] (Microsoft Corporation) – C:install.res.2052.dll
[2007/11/07 09:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:install.res.3082.dll
[2011/04/24 08:45:07 | 000,001,117 | -H– | M] () – C:IPH.PH
[2011/08/12 11:47:07 | 2389,123,072 | -HS- | M] () – C:pagefile.sys
[2008/12/19 20:28:14 | 000,000,204 | —- | M] () – C:Plugins
[2007/11/07 09:00:40 | 000,005,686 | —- | M] () – C:vcredist.bmp
[2007/11/07 09:09:22 | 001,442,522 | —- | M] () – C:VC_RED.cab
[2007/11/07 09:12:28 | 000,232,960 | —- | M] () – C:VC_RED.MSI

< %systemroot%Fonts*.com >
[2006/11/02 08:37:12 | 000,026,040 | —- | M] () – C:WindowsFontsGlobalMonospace.CompositeFont
[2006/11/02 08:37:12 | 000,026,489 | —- | M] () – C:WindowsFontsGlobalSansSerif.CompositeFont
[2006/11/02 08:37:12 | 000,029,779 | —- | M] () – C:WindowsFontsGlobalSerif.CompositeFont
[2009/08/19 08:04:13 | 000,037,665 | —- | M] () – C:WindowsFontsGlobalUserInterface.CompositeFont

< %systemroot%Fonts*.dll >

< %systemroot%Fonts*.ini >
[2006/09/18 17:37:34 | 000,000,065 | -H– | M] () – C:WindowsFontsdesktop.ini

< %systemroot%Fonts*.ini2 >

< %systemroot%Fonts*.exe >

< %systemroot%system32spoolprtprocsw32x86*.* >
[2006/11/02 08:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:Windowssystem32spoolprtprocsw32x86jnwppr.dll
[2006/10/26 22:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:Windowssystem32spoolprtprocsw32x86msonpppr.dll

< %systemroot%REPAIR*.bak1 >

< %systemroot%REPAIR*.ini >

< %systemroot%system32*.jpg >

< %systemroot%*.jpg >

< %systemroot%*.png >

< %systemroot%*.scr >
[2011/05/10 08:10:59 | 000,040,112 | —- | M] (AVAST Software) – C:WindowsavastSS.scr
[2010/11/10 02:28:46 | 000,301,936 | —- | M] (Microsoft Corporation) – C:WindowsWLXPGSS.SCR

< %systemroot%*._sy >

< %APPDATA%AdobeUpdate*.* >

< %ALLUSERSPROFILE%Favorites*.* >

< %APPDATA%Microsoft*.* >

< %PROGRAMFILES%*.* >
[2008/01/20 22:43:21 | 000,000,174 | -HS- | M] () – C:Program Filesdesktop.ini

< %APPDATA%Update*.* >

< %systemroot%*. /mp /s >

< %systemroot%System32config*.sav >
[2008/01/20 23:14:18 | 016,846,848 | —- | M] () – C:WindowsSystem32configCOMPONENTS.SAV
[2008/01/20 23:14:08 | 000,106,496 | —- | M] () – C:WindowsSystem32configDEFAULT.SAV
[2008/01/20 23:14:18 | 000,020,480 | —- | M] () – C:WindowsSystem32configSECURITY.SAV
[2006/11/02 06:34:08 | 010,133,504 | —- | M] () – C:WindowsSystem32configSOFTWARE.SAV
[2006/11/02 06:34:08 | 001,826,816 | —- | M] () – C:WindowsSystem32configSYSTEM.SAV

< %PROGRAMFILES%bak. /s >

< %systemroot%system32bak. /s >

< %ALLUSERSPROFILE%Start Menu*.lnk /x >

< %systemroot%system32configsystemprofile*.dat /x >

< %systemroot%*.config >

< %systemroot%system32*.db >

< %PROGRAMFILES%Internet Explorer*.dat >

< %APPDATA%MicrosoftInternet ExplorerQuick Launch*.lnk /x >
[2010/03/06 00:52:50 | 000,000,429 | -HS- | M] () – C:UserskennyAppDataRoamingMicrosoftInternet ExplorerQuick Launchdesktop.ini

< %USERPROFILE%Desktop*.exe >
[2011/07/08 10:52:25 | 000,332,288 | —- | M] (AuraSEA) – C:UserskennyDesktopAuraSea.exe
[2010/12/31 18:25:35 | 000,602,624 | —- | M] (OldTimer Tools) – C:UserskennyDesktopOTL.exe

< %PROGRAMFILES%Common Files*.* >

< %systemroot%*.src >

< %systemroot%install*.* >

< %systemroot%system32DLL*.* >

< %systemroot%system32HelpFiles*.* >

< %systemroot%system32rundll*.* >

< %systemroot%winn32*.* >

< %systemroot%Java*.* >

< %systemroot%system32test*.* >

< %systemroot%system32Rundll32*.* >

< %systemroot%AppPatchCustom*.* >

< HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU >

< HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto UpdateResultsInstall|LastSuccessTime /rs >
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto UpdateResultsInstallLastSuccessTime: 2011-08-12 15:59:48

========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:ProgramDataTEMP:430C6D84
@Alternate Data Stream - 125 bytes -> C:ProgramDataTEMP:DFC5A2B2
@Alternate Data Stream - 111 bytes -> C:ProgramDataTEMP:187F4542
@Alternate Data Stream - 109 bytes -> C:ProgramDataTEMP:A8ADE5D8

< End of report >

For some reason, I never got an Extras. Txt.even though I did the scan 2x. (Am I suppose put the setting for extras on Use Safelist? because when I downloaded it was under "none") So instead heres my HijackThis Scan as well. Thank you


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:52:32 PM, on 8/12/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.19120)
Boot mode: Normal

Running processes:
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Windowssystem32taskeng.exe
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:Program FilesHPQuickPlayQPService.exe
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesHewlett-PackardHP Quick Launch ButtonsQLBCTRL.exe
C:Windowssystem32igfxsrvc.exe
C:WindowsSystem32mobsync.exe
C:Program FilesHewlett-PackardHP Wireless AssistantHPWAMain.exe
C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe
C:Program FilesLogitechQuickCamQuickcam.exe
C:WindowsSystem32hkcmd.exe
C:WindowsSystem32igfxpers.exe
C:Program FilesAVAST SoftwareAvastAvastUI.exe
C:Program FilesHPHP Software Updatehpwuschd2.exe
C:Program FilesCommon FilesJavaJava Updatejusched.exe
C:Program FilesCommon FilesLightScribeLightScribeControlPanel.exe
C:Windowsehomeehtray.exe
C:Program FilesooVooooVoo.exe
C:Windowsehomeehmsas.exe
C:Program FilesAIM7aim.exe
C:Program FilesWindows Media Playerwmpnscfg.exe
C:Program FilesCommon FilesLogishrdLQCVFXCOCIManager.exe
C:Program FilesMicrosoft OfficeOffice12ONENOTEM.EXE
C:Program FilesHewlett-PackardHP wireless AssistantWiFiMsg.EXE
C:Program FilesHewlett-PackardSharedHpqToaster.exe
C:Windowssystem32wbemunsecapp.exe
C:Program FilesSynapticsSynTPSynTPHelper.exe
C:UserskennyAppDataLocalGoogleChromeApplicationchrome.exe
C:Windowssystem32rundll32.exe
C:UserskennyAppDataLocalGoogleChromeApplicationchrome.exe
C:UserskennyAppDataLocalGoogleChromeApplicationchrome.exe
C:UserskennyAppDataLocalGoogleChromeApplicationchrome.exe
C:Program FilesInternet ExplorerIELowutil.exe
C:UserskennyDesktopHiJackThis.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.crawler.com/search/dispatcher.a…&tbid;=60468
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.bing.com/?pc=Z015&form;=ZGAPHP
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…rio&pf;=cnnb
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
O2 - BHO: &Yahoo;! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpn0yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:Program FilesHPDigital ImagingSmart Web Printinghpswp_printenhancer.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: ooVoo Toolbar - {59c6f12b-f004-43e5-9997-08f2123119b6} - C:Program FilesoovootoolbaroovootoolbarX.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:Program FilesMicrosoftSearch Enhancement PackSearch HelperSEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:Program FilesMicrosoft OfficeOffice12GrooveShellExtensions.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:Program FilesAVAST SoftwareAvastaswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:Program FilesWindows LiveCompanioncompanioncore.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier5.7.6406.1642swg.dll
O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:UserskennyAppDataRoamingFlashGetBHOFlashGetBHO3.dll
O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:Program FilesAIM Toolbaraimtb.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:Program FilesMSNToolbar3.0.0988.2msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program FilesJavajre6binjp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:Program FilesYahoo!CompanionInstallscpn0YTSingleInstance.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:Program FilesHPDigital ImagingSmart Web Printinghpswp_BHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpn0yt.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:Program FilesMSNToolbar3.0.0988.2msneshellx.dll
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:Program FilesAIM Toolbaraimtb.dll
O3 - Toolbar: ooVoo Toolbar - {59c6f12b-f004-43e5-9997-08f2123119b6} - C:Program FilesoovootoolbaroovootoolbarX.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:Program FilesAVAST SoftwareAvastaswWebRepIE.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
O4 - HKLM..Run: [SynTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe
O4 - HKLM..Run: [QPService] "C:Program FilesHPQuickPlayQPService.exe"
O4 - HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 - HKLM..Run: [QlbCtrl.exe] C:Program FilesHewlett-PackardHP Quick Launch ButtonsQlbCtrl.exe /Start
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [hpWirelessAssistant] C:Program FilesHewlett-PackardHP Wireless AssistantHPWAMain.exe
O4 - HKLM..Run: [HP Health Check Scheduler] c:Program FilesHewlett-PackardHP Health CheckHPHC_Scheduler.exe
O4 - HKLM..Run: [GrooveMonitor] "C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe"
O4 - HKLM..Run: [LogitechQuickCamRibbon] "C:Program FilesLogitechQuickCamQuickcam.exe" /hide
O4 - HKLM..Run: [IgfxTray] C:Windowssystem32igfxtray.exe
O4 - HKLM..Run: [HotKeysCmds] C:Windowssystem32hkcmd.exe
O4 - HKLM..Run: [Persistence] C:Windowssystem32igfxpers.exe
O4 - HKLM..Run: [avast] "C:Program FilesAVAST SoftwareAvastavastUI.exe" /nogui
O4 - HKLM..Run: [HP Software Update] C:Program FilesHpHP Software UpdateHPWuSchd2.exe
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesCommon FilesJavaJava Updatejusched.exe"
O4 - HKLM..Run: [Malwarebytes' Anti-Malware] "C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe" /starttray
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeQTTask.exe" -atboottime
O4 - HKCU..Run: [LightScribe Control Panel] C:Program FilesCommon FilesLightScribeLightScribeControlPanel.exe -hidden
O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 - HKCU..Run: [ehTray.exe] C:WindowsehomeehTray.exe
O4 - HKCU..Run: [ooVoo.exe] C:Program FilesooVoooovoo.exe /minimized
O4 - HKCU..Run: [Google Update] "C:UserskennyAppDataLocalGoogleUpdateGoogleUpdate.exe" /c
O4 - HKCU..Run: [Aim] "C:Program FilesAIM7aim.exe" /d locale=en-US
O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:Program FilesMicrosoft OfficeOffice12ONENOTEM.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:Program FilesLogitechDesktop Messenger8876480ProgramLogitechDesktopMessenger.exe
O4 - Global Startup: WhiteSmoke Translator.lnk = C:UserskennyDownloadsWhiteSmokeWriterGeo5002_en.exe
O8 - Extra context menu item: Download All By FlashGet3 - C:UserskennyAppDataRoamingFlashGetBHOGetAllUrl.htm
O8 - Extra context menu item: Download By FlashGet3 - C:UserskennyAppDataRoamingFlashGetBHOGetUrl.htm
O8 - Extra context menu item: Google Sidewiki… - res://C:Program FilesGoogleGoogle ToolbarComponentGoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html
O9 - Extra button: @C:Program FilesWindows LiveCompanioncompanionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:Program FilesWindows LiveCompanioncompanioncore.dll
O9 - Extra button: @C:Program FilesWindows LiveWriterWindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:Program FilesWindows LiveWriterWriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:Program FilesWindows LiveWriterWindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:Program FilesWindows LiveWriterWriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~3Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~3Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~3Office12REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:Program FilesHPDigital ImagingSmart Web Printinghpswp_BHO.dll
O15 - Trusted Zone: http://software.kuaiche.com
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:Program FilesLogitechDesktop Messenger8876480ProgramGAPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:Program FilesMicrosoft OfficeOffice12GrooveSystemServices.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:Program FilesWindows LivePhoto GalleryAlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:Windowssystem32browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:Program FilesCommon FilesAppleMobile Device SupportAppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:Program FilesAVAST SoftwareAvastAvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:Program FilesBonjourmDNSResponder.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:Program FilesHewlett-PackardHP Quick Launch ButtonsCom4QLBEx.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:Program FilesHP GamesMy HP Game ConsoleGameConsoleService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:Program FilesGoogleUpdateGoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:Program FilesGoogleUpdateGoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:Program FilesHewlett-PackardHP Health Checkhphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:Program FilesHewlett-PackardSharedhpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:Program FilesCommon FilesLogiShrdLVMVFMLVPrcSrv.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:Windowssystem32GameMon.des.exe (file missing)
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:Program FilesOpenVPNbinopenvpnserv.exe
O23 - Service: Recovery Service for Windows - Unknown owner - C:WindowsSMINSTBLService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:Program FilesCyberLinkShared FilesRichVideo.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:Program FilesViewpointCommonViewpointService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:Windowssystem32DRIVERSxaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:Program FilesYahoo!SoftwareUpdateYahooAUService.exe

–
End of file - 13320 bytes

DO NOT use any TOOLS such as Combofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.


Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:


XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.


If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.




Please do not delete anything unless instructed to.


Next:

Close all browsers before running ATF: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:


Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
  
  Note: If you have SP3, use the SP2 package.
  If Vista or Windows 7, skip the Recovery Console part
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.


Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

Run this and lets see if you have a rootkit infection


Note: if the Cure option is not there, please select 'Skip'.

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Also please describe how your computer behaves at the moment.