Plz help fix my computer, locked out of programs

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:22:28 AM, on 8/25/2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16839)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Program Files\TeamViewer\Version6\TeamViewer.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\ScanSoft\OmniPage15\OpWare15.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\SHARP\Sharpdesk\SharpTray.exe
C:\Program Files\SHARP\Sharpdesk\FTPServer.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Sharp\Sharpdesk\nsapp.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10l_ActiveX.exe
C:\Program Files\Common Files\Oberon Media\Parts\1.0.0.14\OberonParts.exe
C:\Windows\System32\msdt.exe
C:\Windows\System32\sdiagnhost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=fmtoby&s…hTerms}&f=4
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: PriceGong - {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files\PriceGong\2.1.0\PriceGongIE.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Freecause Shopping BHO - {20FEC4E7-F7B7-438B-8191-33D2EFC5EBEA} - C:\Program Files\Shop to Win 2\ShoppingBHO.dll
O2 - BHO: BHO Project - {3fdba1ba-ae28-4045-9048-4ed2f3865629} - C:\Program Files\Object\bho_project.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: DCA - {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} - C:\Program Files\Common Files\FreeCause\DCA\dca-bho.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: GamesBarBHO Class - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Program Files\GamesBar\2.0.1.82\oberontb.dll
O2 - BHO: Freecause Shopping BHO - {D2D09FE0-F451-45F7-A617-FABF9130C4D6} - C:\Program Files\Shop to Win 16\Shop to Win 16.dll
O2 - BHO: WeCareReminder - {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} - C:\ProgramData\WeCareReminder\IEHelperv2.5.0.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: NetAssistantBHO - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files\Freeze.com\NetAssistant\NetAssistant.dll
O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Runtime\YontooIEClient.dll
O3 - Toolbar: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\2.0.1.82\oberontb.dll
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
O4 - HKLM\..\Run: [Opware15] "C:\Program Files\ScanSoft\OmniPage15\Opware15.exe"
O4 - HKLM\..\Run: [ScanSoft OmniPage 15-reminder] "C:\Program Files\ScanSoft\OmniPage15\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\OmniPage15.0\Ereg\Ereg.ini
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [IndexTray] "C:\Program Files\Sharp\Sharpdesk\IndexTray.exe" /n
O4 - HKLM\..\Run: [SharpTray] "C:\Program Files\Sharp\Sharpdesk\SharpTray.exe"
O4 - HKLM\..\Run: [TypeRegChecker] "C:\Program Files\Sharp\Sharpdesk\TypeRegChecker.exe"
O4 - HKLM\..\Run: [FtpServer.exe] "C:\Program Files\Sharp\Sharpdesk\FtpServer.exe" -usedefault
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O9 - Extra button: (no name) - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\2.0.1.82\oberontb.dll
O9 - Extra 'Tools' menuitem: GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\2.0.1.82\oberontb.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O16 - DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} (Crystal Report Viewer Control 9) - https://yardi.pregllc.com/voyager60822sp13/…ivexviewer9.cab
O16 - DPF: {C53EE992-020F-40B8-A1B4-16518D8C7948} (ysiNetClientInstaller.CLRManager) - https://yardi.pregllc.com/voyager60822sp13/…ntInstaller.CAB
O16 - DPF: {CED616F0-2859-4BF8-8538-9DAF544AF2CB} (ysiComm.ysiComm1) - https://yardi.pregllc.com/voyager60822sp13/ysiComm.CAB
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://greystar.webex.com/client/T27LC/nbr/ieatgpc1.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F48DE781-C525-44C9-9529-C5ADE3EF5F70} (GdPicturePro5S.GdViewer) - https://yardi.pregllc.com/voyager60822sp13/gdpicturepro5.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: WebEx Service Host for Support Center (atashost) - Cisco WebEx LLC - C:\Windows\system32\atashost.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: lmab_device - - C:\Windows\system32\LMabcoms.exe
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: OneTouch 4.0 Monitor - Visioneer Inc. - C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe

–
End of file - 9274 bytes

Links still will not open. logs follow

OTL logfile created on: 8/26/2011 9:58:50 AM - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Users\User\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.75 Gb Total Physical Memory | 1.04 Gb Available Physical Memory | 59.24% Memory free
3.50 Gb Paging File | 2.49 Gb Available in Paging File | 71.29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 449.66 Gb Total Space | 400.53 Gb Free Space | 89.07% Space Free | Partition Type: NTFS

Computer Name: AR2 | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\User\Desktop\OTL.com (OldTimer Tools)
PRC - C:\Windows\System32\atashost.exe (Cisco WebEx LLC)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\LogMeIn\x86\ramaint.exe (LogMeIn, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe (LogMeIn, Inc.)
PRC - C:\Program Files\TeamViewer\Version6\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\TeamViewer\Version6\tv_w32.exe (TeamViewer GmbH)
PRC - C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
PRC - C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe (Visioneer Inc.)
PRC - C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Windows\System32\lmabcoms.exe ( )
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\SHARP\Sharpdesk\SharpTray.exe (SHARP CORPORATION)
PRC - C:\Program Files\SHARP\Sharpdesk\FTPServer.exe (SHARP CORPORATION)
PRC - C:\Program Files\SHARP\Sharpdesk\nsapp.exe (SHARP CORPORATION)
PRC - C:\Program Files\ScanSoft\OmniPage15\OpWare15.exe (Nuance Communications, Inc.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
MOD - C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll ()
MOD - C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ()


========== Win32 Services (SafeList) ==========

SRV - (atashost) – C:\Windows\System32\atashost.exe (Cisco WebEx LLC)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (AVG Security Toolbar Service) – C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe ()
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (LMIMaint) – C:\Program Files\LogMeIn\x86\RaMaint.exe (LogMeIn, Inc.)
SRV - (LMIGuardianSvc) – C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe (LogMeIn, Inc.)
SRV - (TeamViewer6) – C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (LogMeIn) – C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
SRV - (OneTouch 4.0 Monitor) – C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe (Visioneer Inc.)
SRV - (Microsoft SharePoint Workspace Audit Service) – C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (lmab_device) – C:\Windows\System32\LMabcoms.exe ( )
SRV - (StorSvc) – C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (AVGIDSDriver) – C:\Windows\System32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) – C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\Windows\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) – C:\Windows\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) – C:\Windows\System32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\Windows\System32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgldx86) – C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (LMIRfsClientNP) – C:\Windows\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (LMIRfsDriver) – C:\Windows\System32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (LMIInfo) – C:\Program Files\LogMeIn\x86\rainfo.sys (LogMeIn, Inc.)
DRV - (vmbus) – C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (WinDriver6) – C:\Windows\System32\drivers\windrvr6.sys (Jungo)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=fmtoby&s;…hTerms}&f;=4


IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-4275901283-1487297572-3712528860-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.greystar.com/Greystar/Index.aspx
IE - HKU\S-1-5-21-4275901283-1487297572-3712528860-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-4275901283-1487297572-3712528860-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-4275901283-1487297572-3712528860-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 72 EE A0 A7 61 CC 01 [binary data]
IE - HKU\S-1-5-21-4275901283-1487297572-3712528860-1005\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-21-4275901283-1487297572-3712528860-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll (Oberon-Media )
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/08/25 09:42:36 | 000,000,000 | —D | M]

[2011/08/18 16:42:36 | 000,002,049 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml

O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (PriceGongBHO Class) - {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files\PriceGong\2.1.0\PriceGongIE.dll (PriceGong)
O2 - BHO: (Shop to Win 2) - {20FEC4E7-F7B7-438B-8191-33D2EFC5EBEA} - C:\Program Files\Shop to Win 2\ShoppingBHO.dll (Freecause Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Facetheme) - {3fdba1ba-ae28-4045-9048-4ed2f3865629} - C:\Program Files\Object\bho_project.dll (InternetEngine)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O2 - BHO: (DCA BHO) - {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} - C:\Program Files\Common Files\FreeCause\DCA\dca-bho.dll (Compete, Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Shop to Win 16) - {D2D09FE0-F451-45F7-A617-FABF9130C4D6} - C:\Program Files\Shop to Win 16\Shop to Win 16.dll (Shop To Win, LLC)
O2 - BHO: (WeCareReminder Class) - {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} - C:\ProgramData\WeCareReminder\IEHelperv2.5.0.dll (We-Care.com)
O2 - BHO: (NetAssistantBHO Class) - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files\Freeze.com\NetAssistant\NetAssistant.dll (W3i, LLC)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKU\S-1-5-21-4275901283-1487297572-3712528860-1005\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [FtpServer.exe] C:\Program Files\Sharp\Sharpdesk\FtpServer.exe (SHARP CORPORATION)
O4 - HKLM..\Run: [IndexTray] C:\Program Files\Sharp\Sharpdesk\IndexTray.exe (SHARP CORPORATION)
O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Opware15] C:\Program Files\ScanSoft\OmniPage15\Opware15.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [ScanSoft OmniPage 15-reminder] C:\Program Files\ScanSoft\OmniPage15\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SharpTray] C:\Program Files\Sharp\Sharpdesk\SharpTray.exe (SHARP CORPORATION)
O4 - HKLM..\Run: [TypeRegChecker] C:\Program Files\Sharp\Sharpdesk\TypeRegChecker.exe (SHARP CORPORATION)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-4275901283-1487297572-3712528860-1005..\RunOnce: [spchecker] C:\Program Files\AVG\AVG10\Notification\SPCheckerTE.exe ()
O4 - Startup: C:\Users\Carlisha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} https://yardi.pregllc.com/voyager60822sp13/…ivexviewer9.cab (Crystal Report Viewer Control 9)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {C53EE992-020F-40B8-A1B4-16518D8C7948} https://yardi.pregllc.com/voyager60822sp13/…ntInstaller.CAB (ysiNetClientInstaller.CLRManager)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CED616F0-2859-4BF8-8538-9DAF544AF2CB} https://yardi.pregllc.com/voyager60822sp13/ysiComm.CAB (ysiComm.ysiComm1)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://greystar.webex.com/client/T27LC/nbr/ieatgpc1.cab (GpcContainer Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F48DE781-C525-44C9-9529-C5ADE3EF5F70} https://yardi.pregllc.com/voyager60822sp13/gdpicturepro5.cab (GdPicturePro5S.GdViewer)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\sds {79E0F14C-9C52-4218-89A7-7C4B0563D121} - C:\Program Files\SHARP\Sharpdesk\ExplorerExtensions.dll (SHARP CORPORATION)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/08/26 09:57:17 | 000,580,096 | —- | C] (OldTimer Tools) – C:\Users\User\Desktop\OTL.com
[2011/08/25 10:10:38 | 000,000,000 | -H-D | C] – C:\$AVG
[2011/08/25 09:44:33 | 000,000,000 | —D | C] – C:\Users\User\AppData\Roaming\AVG10
[2011/08/25 09:42:50 | 000,000,000 | —D | C] – C:\ProgramData\AVG Security Toolbar
[2011/08/25 09:42:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2011
[2011/08/25 09:41:48 | 000,000,000 | —D | C] – C:\ProgramData\AVG10
[2011/08/25 09:41:48 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\AVG
[2011/08/25 09:40:28 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2011/08/25 09:38:08 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2011/08/25 09:37:55 | 000,000,000 | —D | C] – C:\ProgramData\MFAData
[2011/08/25 09:22:51 | 000,000,000 | —D | C] – C:\Users\User\AppData\Local\Diagnostics
[2011/08/25 09:19:54 | 000,000,000 | —D | C] – C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/08/25 09:19:53 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/08/25 09:09:40 | 000,000,000 | —D | C] – C:\Users\User\AppData\Roaming\Malwarebytes
[2011/08/25 08:41:59 | 000,101,720 | —- | C] (Sunbelt Software) – C:\Windows\System32\drivers\SBREDrv.sys
[2011/08/25 08:40:19 | 000,000,000 | —D | C] – C:\Windows\System32\DRVSTORE
[2011/08/25 08:40:15 | 000,000,000 | —D | C] – C:\ProgramData\Lavasoft
[2011/08/24 09:03:23 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2011/08/23 11:16:28 | 000,000,000 | —D | C] – C:\Users\User\AppData\Roaming\Adobe
[2011/08/23 11:15:39 | 000,000,000 | —D | C] – C:\Users\User\AppData\Local\LogMeIn
[2011/08/23 11:15:38 | 000,000,000 | —D | C] – C:\Users\User\AppData\Local\Scansoft
[2011/08/23 11:15:34 | 000,000,000 | R–D | C] – C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011/08/23 11:15:34 | 000,000,000 | R–D | C] – C:\Users\User\Searches
[2011/08/23 11:15:34 | 000,000,000 | R–D | C] – C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/08/23 11:15:34 | 000,000,000 | -H-D | C] – C:\Users\User\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2011/08/23 11:15:30 | 000,000,000 | —D | C] – C:\Users\User\AppData\Roaming\Identities
[2011/08/23 11:15:29 | 000,000,000 | R–D | C] – C:\Users\User\Contacts
[2011/08/23 11:15:23 | 000,000,000 | —D | C] – C:\Users\User\AppData\Local\VirtualStore
[2011/08/23 11:15:22 | 000,000,000 | –SD | C] – C:\Users\User\AppData\Roaming\Microsoft
[2011/08/23 11:15:22 | 000,000,000 | R–D | C] – C:\Users\User\Videos
[2011/08/23 11:15:22 | 000,000,000 | R–D | C] – C:\Users\User\Saved Games
[2011/08/23 11:15:22 | 000,000,000 | R–D | C] – C:\Users\User\Pictures
[2011/08/23 11:15:22 | 000,000,000 | R–D | C] – C:\Users\User\Music
[2011/08/23 11:15:22 | 000,000,000 | R–D | C] – C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011/08/23 11:15:22 | 000,000,000 | R–D | C] – C:\Users\User\Links
[2011/08/23 11:15:22 | 000,000,000 | R–D | C] – C:\Users\User\Favorites
[2011/08/23 11:15:22 | 000,000,000 | R–D | C] – C:\Users\User\Downloads
[2011/08/23 11:15:22 | 000,000,000 | R–D | C] – C:\Users\User\Documents
[2011/08/23 11:15:22 | 000,000,000 | R–D | C] – C:\Users\User\Desktop
[2011/08/23 11:15:22 | 000,000,000 | R–D | C] – C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\AppData\Local\Temporary Internet Files
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\Templates
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\Start Menu
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\SendTo
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\Recent
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\PrintHood
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\NetHood
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\Documents\My Videos
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\Documents\My Pictures
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\Documents\My Music
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\My Documents
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\Local Settings
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\AppData\Local\History
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\Cookies
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\Application Data
[2011/08/23 11:15:22 | 000,000,000 | -HSD | C] – C:\Users\User\AppData\Local\Application Data
[2011/08/23 11:15:22 | 000,000,000 | -H-D | C] – C:\Users\User\AppData
[2011/08/23 11:15:22 | 000,000,000 | —D | C] – C:\Users\User\AppData\Local\Temp
[2011/08/23 11:15:22 | 000,000,000 | —D | C] – C:\Users\User\AppData\Local\Microsoft
[2011/08/23 11:15:22 | 000,000,000 | —D | C] – C:\Users\User\AppData\Roaming\Media Center Programs
[2011/08/23 11:15:22 | 000,000,000 | —D | C] – C:\Users\User\AppData\Roaming\Macromedia
[2011/08/23 10:58:08 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/08/23 10:58:08 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/23 10:58:07 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/08/23 10:58:04 | 000,022,712 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/08/23 10:58:04 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/08/23 10:46:21 | 000,216,888 | —- | C] (Cisco WebEx LLC) – C:\Windows\System32\atsckernel.exe
[2011/08/23 10:46:20 | 000,133,944 | —- | C] (Cisco WebEx LLC) – C:\Windows\System32\atashost.exe
[2011/08/23 09:04:50 | 000,000,000 | —D | C] – C:\Windows\System32\Wat
[2011/08/22 17:37:48 | 000,190,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ks.sys
[2011/08/22 14:25:26 | 000,284,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\usbport.sys
[2011/08/22 14:25:25 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\prevhost.exe
[2011/08/22 14:25:25 | 000,005,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\usbd.sys
[2011/08/22 14:25:22 | 000,146,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\storport.sys
[2011/08/22 14:25:22 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fsutil.exe
[2011/08/22 14:25:13 | 000,465,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisdecd.dll
[2011/08/22 14:25:13 | 000,417,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdri.dll
[2011/08/22 14:25:13 | 000,204,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSNP.ax
[2011/08/22 14:25:07 | 001,553,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tquery.dll
[2011/08/22 14:25:07 | 001,401,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssrch.dll
[2011/08/22 14:25:07 | 000,666,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssvp.dll
[2011/08/22 14:25:07 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssph.dll
[2011/08/22 14:25:07 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssphtb.dll
[2011/08/22 14:25:07 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msscntrs.dll
[2011/08/22 14:25:04 | 000,442,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsPrint.dll
[2011/08/22 14:25:04 | 000,288,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsGdiConverter.dll
[2011/08/22 14:25:03 | 002,614,784 | —- | C] (Microsoft Corporation) – C:\Windows\explorer.exe
[2011/08/22 14:25:00 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2011/08/22 14:24:59 | 001,170,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10warp.dll
[2011/08/22 14:24:58 | 003,181,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mf.dll
[2011/08/22 14:24:58 | 001,619,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMVDECOD.DLL
[2011/08/22 14:24:58 | 001,495,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ExplorerFrame.dll
[2011/08/22 14:24:58 | 001,074,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2011/08/22 14:24:58 | 000,739,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d2d1.dll
[2011/08/22 14:24:58 | 000,218,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1core.dll
[2011/08/22 14:24:58 | 000,196,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfreadwrite.dll
[2011/08/22 14:24:57 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsRasterService.dll
[2011/08/22 14:24:55 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wscapi.dll
[2011/08/22 14:24:55 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\slwga.dll
[2011/08/22 14:24:53 | 000,369,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc.dll
[2011/08/22 14:24:53 | 000,365,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_isv.dll
[2011/08/22 14:24:53 | 000,324,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_isv.exe
[2011/08/22 14:24:53 | 000,320,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate.exe
[2011/08/22 14:24:53 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp_isv.dll
[2011/08/22 14:24:53 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp.dll
[2011/08/22 14:24:52 | 000,280,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp.exe
[2011/08/22 14:24:52 | 000,277,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp_isv.exe
[2011/08/22 14:24:50 | 000,026,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\Diskdump.sys
[2011/08/22 14:22:46 | 000,219,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\dxgmms1.sys
[2011/08/22 14:22:46 | 000,107,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cdd.dll
[2011/08/19 13:15:59 | 000,000,000 | -HSD | C] – C:\Windows\System32\%APPDATA%
[2011/08/19 12:20:43 | 000,295,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHost.exe
[2011/08/19 12:20:43 | 000,099,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHostProxy.dll
[2011/08/19 12:20:43 | 000,049,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netfxperf.dll
[2011/08/19 12:15:22 | 000,000,000 | —D | C] – C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2011/08/19 12:06:47 | 000,000,000 | —D | C] – C:\Program Files\MSXML 4.0
[2011/08/19 11:18:43 | 000,319,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbcjt32.dll
[2011/08/19 11:18:43 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbctrac.dll
[2011/08/19 11:18:43 | 000,122,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbccp32.dll
[2011/08/19 11:18:43 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbccu32.dll
[2011/08/19 11:18:43 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbccr32.dll
[2011/08/19 11:18:42 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\t2embed.dll
[2011/08/19 11:18:33 | 000,191,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FXSCOVER.exe
[2011/08/19 11:18:30 | 000,294,912 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2011/08/19 11:18:30 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2011/08/19 11:18:25 | 002,332,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/08/19 11:18:21 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\poqexec.exe
[2011/08/19 11:18:20 | 000,197,632 | —- | C] (Intel® Corporation) – C:\Windows\System32\ir32_32.dll
[2011/08/19 11:18:20 | 000,082,944 | —- | C] (Radius Inc.) – C:\Windows\System32\iccvid.dll
[2011/08/19 11:18:18 | 001,328,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2011/08/19 11:18:18 | 000,084,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciavi32.dll
[2011/08/19 11:18:01 | 001,137,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42.dll
[2011/08/19 11:18:00 | 001,164,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42u.dll
[2011/08/19 11:17:58 | 000,101,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\consent.exe
[2011/08/19 11:17:55 | 000,738,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpmde.dll
[2011/08/19 11:17:54 | 000,314,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\webio.dll
[2011/08/19 11:17:45 | 000,606,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/08/19 11:17:45 | 000,599,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/08/19 11:17:45 | 000,381,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/08/19 11:17:44 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/08/19 11:17:44 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/08/19 11:17:44 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/08/19 11:17:44 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/08/19 11:17:43 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/08/19 11:17:43 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/08/19 11:17:43 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/08/19 11:17:42 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/08/19 11:17:42 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/08/19 11:17:35 | 001,320,960 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CertEnroll.dll
[2011/08/19 11:17:35 | 000,507,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winload.exe
[2011/08/19 11:17:35 | 000,442,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winresume.exe
[2011/08/19 11:17:31 | 003,957,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/08/19 11:17:31 | 003,902,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/08/19 11:17:28 | 000,954,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40.dll
[2011/08/19 11:17:28 | 000,954,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40u.dll
[2011/08/19 11:17:28 | 000,496,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskschd.dll
[2011/08/19 11:17:28 | 000,351,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmicmiplugin.dll
[2011/08/19 11:17:27 | 000,305,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskcomp.dll
[2011/08/19 11:17:27 | 000,179,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\schtasks.exe
[2011/08/19 11:17:23 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dnscacheugc.exe
[2011/08/19 11:17:19 | 000,271,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\conhost.exe
[2011/08/19 11:17:19 | 000,169,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2011/08/19 11:17:19 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2011/08/19 11:17:19 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2011/08/19 11:17:19 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2011/08/19 11:17:19 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2011/08/19 11:17:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/08/19 11:17:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2011/08/19 11:17:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2011/08/19 11:17:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2011/08/19 11:17:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2011/08/19 11:17:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2011/08/19 11:17:17 | 000,850,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sbe.dll
[2011/08/19 11:17:17 | 000,642,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CPFilters.dll
[2011/08/19 11:17:17 | 000,534,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EncDec.dll
[2011/08/19 11:17:17 | 000,199,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mpg2splt.ax
[2011/08/19 11:17:15 | 012,625,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2011/08/19 11:17:14 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fontsub.dll
[2011/08/19 11:17:14 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\asycfilt.dll
[2011/08/19 10:35:25 | 000,000,000 | —D | C] – C:\ProgramData\PC Optimizer Pro
[2011/08/19 10:30:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LittlePDF
[2011/08/19 10:30:35 | 000,000,000 | —D | C] – C:\Program Files\LittlePDF
[2011/08/19 10:30:29 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Itibiti VoIP Phone
[2011/08/19 10:30:29 | 000,000,000 | —D | C] – C:\Program Files\Itibiti Soft Phone
[2011/08/19 10:30:27 | 000,000,000 | —D | C] – C:\Program Files\Oberon Media
[2011/08/19 10:30:26 | 000,000,000 | —D | C] – C:\ProgramData\Oberon Media
[2011/08/19 10:30:24 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Optimizer Pro
[2011/08/19 10:30:24 | 000,000,000 | —D | C] – C:\Program Files\PC Optimizer Pro
[2011/08/19 10:30:21 | 000,000,000 | —D | C] – C:\Program Files\Yontoo Layers Runtime
[2011/08/19 10:30:20 | 000,000,000 | —D | C] – C:\ProgramData\Tarma Installer
[2011/08/19 10:30:16 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Oberon Media
[2011/08/19 10:30:11 | 000,000,000 | —D | C] – C:\ProgramData\WeCareReminder
[2011/08/18 16:42:36 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2011/08/18 16:42:35 | 000,000,000 | —D | C] – C:\Program Files\NuancePDFReader
[2011/08/18 16:42:26 | 033,001,712 | —- | C] (Nuance Communications, Inc. ) – C:\Program Files\Nuance PDF Reader.exe
[2011/08/18 16:34:13 | 000,000,000 | —D | C] – C:\Program Files\Common Files\FreeCause
[2011/08/18 16:34:10 | 000,000,000 | —D | C] – C:\Program Files\Shop to Win 16
[2011/08/18 16:34:10 | 000,000,000 | —D | C] – C:\Program Files\Shop To Win
[2011/08/18 16:34:03 | 000,000,000 | —D | C] – C:\Program Files\Object
[2011/08/17 15:49:52 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2010/12/02 12:23:20 | 000,401,408 | —- | C] ( ) – C:\Windows\System32\lexlog.dll
[2010/12/02 09:22:23 | 000,643,072 | —- | C] ( ) – C:\Windows\System32\lmabpmui.dll
[2010/12/02 09:22:22 | 000,847,872 | —- | C] ( ) – C:\Windows\System32\lmabusb1.dll
[2010/12/02 09:22:22 | 000,339,968 | —- | C] ( ) – C:\Windows\System32\lmabiesc.dll
[2010/12/02 09:22:21 | 001,040,384 | —- | C] ( ) – C:\Windows\System32\lmabserv.dll
[2010/12/02 09:22:21 | 000,479,232 | —- | C] ( ) – C:\Windows\System32\lmabpar1.dll
[2010/12/02 09:22:20 | 000,569,344 | —- | C] ( ) – C:\Windows\System32\lmablmpm.dll
[2010/12/02 09:22:20 | 000,450,560 | —- | C] ( ) – C:\Windows\System32\lmabiobj.dll
[2010/12/02 09:22:20 | 000,364,544 | —- | C] ( ) – C:\Windows\System32\lmabinpa.dll
[2010/12/02 09:22:19 | 000,905,216 | —- | C] ( ) – C:\Windows\System32\lmabip1.dll
[2010/12/02 09:22:19 | 000,593,920 | —- | C] ( ) – C:\Windows\System32\lmabcoms.exe
[2010/12/02 09:22:19 | 000,356,352 | —- | C] ( ) – C:\Windows\System32\lmabhcp.dll
[2010/12/02 09:22:18 | 000,802,816 | —- | C] ( ) – C:\Windows\System32\lmabcomc.dll
[2010/12/02 09:22:18 | 000,372,736 | —- | C] ( ) – C:\Windows\System32\lmabcomm.dll
[2010/11/24 12:30:11 | 000,630,784 | —- | C] ( ) – C:\Windows\System32\softcoin.dll
[2010/11/24 12:30:10 | 000,425,984 | —- | C] ( ) – C:\Windows\System32\gencoin.dll

========== Files - Modified Within 30 Days ==========

[2011/08/26 09:57:49 | 000,580,096 | —- | M] (OldTimer Tools) – C:\Users\User\Desktop\OTL.com
[2011/08/26 09:49:39 | 000,014,560 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/26 09:49:39 | 000,014,560 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/26 09:34:45 | 129,786,012 | —- | M] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2011/08/25 10:39:07 | 000,623,890 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/08/25 10:39:07 | 000,107,522 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/08/25 10:34:09 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/08/25 10:34:06 | 1408,786,432 | -HS- | M] () – C:\hiberfil.sys
[2011/08/25 09:42:40 | 000,000,932 | —- | M] () – C:\Users\Public\Desktop\AVG 2011.lnk
[2011/08/25 09:19:54 | 000,002,959 | —- | M] () – C:\Users\User\Desktop\HiJackThis.lnk
[2011/08/25 08:41:59 | 000,101,720 | —- | M] (Sunbelt Software) – C:\Windows\System32\drivers\SBREDrv.sys
[2011/08/23 11:16:24 | 000,001,420 | —- | M] () – C:\Users\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/08/23 10:58:08 | 000,001,080 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/23 10:51:55 | 000,000,000 | —- | M] () – C:\install.rdf
[2011/08/23 10:46:05 | 000,133,944 | —- | M] (Cisco WebEx LLC) – C:\Windows\System32\atashost.exe
[2011/08/23 10:46:04 | 000,216,888 | —- | M] (Cisco WebEx LLC) – C:\Windows\System32\atsckernel.exe
[2011/08/23 09:06:06 | 000,550,304 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/08/19 10:30:25 | 000,001,064 | —- | M] () – C:\Users\Public\Desktop\PC Optimizer Pro.lnk
[2011/08/18 16:42:35 | 033,001,712 | —- | M] (Nuance Communications, Inc. ) – C:\Program Files\Nuance PDF Reader.exe
[2011/08/17 15:49:54 | 000,001,998 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader X.lnk

========== Files Created - No Company Name ==========

[2011/08/26 09:34:45 | 129,786,012 | —- | C] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2011/08/25 09:42:40 | 000,000,932 | —- | C] () – C:\Users\Public\Desktop\AVG 2011.lnk
[2011/08/25 09:19:54 | 000,002,959 | —- | C] () – C:\Users\User\Desktop\HiJackThis.lnk
[2011/08/23 11:16:24 | 000,001,420 | —- | C] () – C:\Users\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/08/23 11:15:35 | 000,001,426 | —- | C] () – C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011/08/23 11:15:22 | 000,000,290 | —- | C] () – C:\Users\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2011/08/23 11:15:22 | 000,000,272 | —- | C] () – C:\Users\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2011/08/23 10:58:08 | 000,001,080 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/23 10:51:55 | 000,000,000 | —- | C] () – C:\install.rdf
[2011/08/19 10:30:25 | 000,001,064 | —- | C] () – C:\Users\Public\Desktop\PC Optimizer Pro.lnk
[2011/08/17 15:49:54 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011/08/17 15:49:54 | 000,001,998 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/04/20 22:45:00 | 000,075,776 | —- | C] () – C:\Windows\svers.dll
[2011/04/20 22:45:00 | 000,000,026 | —- | C] () – C:\Windows\refsdm.dll
[2011/03/01 10:28:22 | 000,888,832 | —- | C] () – C:\Windows\System32\PaniniOCR.dll
[2011/02/04 17:55:41 | 000,000,098 | —- | C] () – C:\Windows\System32\SR0ELMON.dat
[2011/02/04 17:55:38 | 000,000,397 | —- | C] () – C:\Windows\System32\SCN2PM.DAT
[2011/02/04 17:55:32 | 000,172,128 | R— | C] () – C:\Windows\_isusr32.dll
[2011/02/04 17:55:32 | 000,045,056 | —- | C] () – C:\Windows\System32\_isusr2k.dll
[2010/12/02 12:38:49 | 000,000,505 | —- | C] () – C:\Windows\pixcache.ini
[2010/12/02 12:35:59 | 000,000,211 | —- | C] () – C:\Windows\kofax200.ini
[2010/12/02 12:32:04 | 000,031,935 | —- | C] () – C:\Windows\maxlink.ini
[2009/07/14 00:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/14 00:33:53 | 000,550,304 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,623,890 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,107,522 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/13 20:19:49 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2009/07/13 19:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/06/10 17:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2005/03/12 04:07:00 | 000,087,040 | —- | C] () – C:\Windows\System32\redmon64.dll

========== LOP Check ==========

[2011/08/19 10:30:47 | 000,000,000 | —D | M] – C:\Users\Carlisha\AppData\Roaming\Itibiti
[2010/12/02 12:34:37 | 000,000,000 | —D | M] – C:\Users\Carlisha\AppData\Roaming\LinkManager 4.0
[2011/08/19 10:30:20 | 000,000,000 | —D | M] – C:\Users\Carlisha\AppData\Roaming\Oberon Media
[2011/02/02 12:39:17 | 000,000,000 | —D | M] – C:\Users\Carlisha\AppData\Roaming\OpenOffice.org
[2010/12/02 12:39:53 | 000,000,000 | —D | M] – C:\Users\Carlisha\AppData\Roaming\ScanSoft
[2011/01/07 12:22:51 | 000,000,000 | —D | M] – C:\Users\Carlisha\AppData\Roaming\TeamViewer
[2011/02/03 18:37:39 | 000,000,000 | —D | M] – C:\Users\Carlisha\AppData\Roaming\Visioneer
[2011/06/24 09:18:19 | 000,000,000 | —D | M] – C:\Users\Carlisha\AppData\Roaming\webex
[2011/08/25 09:44:33 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\AVG10
[2011/06/25 10:13:30 | 000,032,602 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >


OTL Extras logfile created on: 8/26/2011 9:58:50 AM - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Users\User\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.75 Gb Total Physical Memory | 1.04 Gb Available Physical Memory | 59.24% Memory free
3.50 Gb Paging File | 2.49 Gb Available in Paging File | 71.29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 449.66 Gb Total Space | 400.53 Gb Free Space | 89.07% Space Free | Partition Type: NTFS

Computer Name: AR2 | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0AEF384B-610F-4309-8DA3-91834FE4E80E}" = Sharpdesk
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F68C868-B5AF-4836-8A46-C030BBE1EDB3}" = ScanSoft PaperPort 11
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{20EAC554-95F9-4926-8D9A-C4FF3EC44C72}" = AVG 2011
"{223F72BF-0DEB-4953-8D1F-870738804863}" = QuickScan 4.5.1
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 22
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{34466787-FDAE-4B20-8DC0-72E97F39D237}" = OneTouch 4.0 ScanSoft OmniPage OCR Module
"{39F8E2BF-6868-483A-9AC1-7369C1905D7C}" = ASPCA Tri Reminder by We-Care.com v4.0.10.5
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{43ED550A-D813-43F7-B18E-9AD4785C9387}" = ScanSoft OmniPage 15
"{44B2869B-EADD-4FC8-A740-E78E1A3256BA}" = Xerox DocuMate 152 Driver
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5EFA68C8-CFFD-407F-8B17-7D7C61D2F93A}" = InstallIQ Updater
"{68FF4E69-53DC-485C-ADD9-E56FF9A406F8}" = VisionX
"{695B13B2-7919-4EC5-8601-092F0D2DE069}" = AVG 2011
"{6A35E74B-68AD-4054-B93A-FEB7B687114C}" = Kofax VirtualReScan 4.10
"{6EFDBA50-4ABE-4194-86F7-F3BD0A011F5B}_is1" = Shop To Win
"{730E03E4-350E-48E5-9D3E-4329903D454D}" = Itibiti RTC
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo Layers Runtime 1.10.01
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.0)
"{AF8B1525-17EF-4D2E-A018-8D79CE260BA8}" = OneTouch 4.6
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{C792A75A-2A1F-4991-9B85-291745478A79}" = NetAssistant
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D3AE96EE-2876-4B3F-847C-D3A4AD689E43}" = LogMeIn
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{EF58D88F-4E62-4372-9DFA-E1CED7C34986}" = Kofax VRS Update for Visioneer OneTouch OEM
"{F0334E95-4EB0-4996-838A-A628C08720FD}" = Yardi Systems CheckScan Client Tool
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{FB3888EF-464F-489B-A2BF-456CAECA3DC2}" = OneTouch 4.0
"ActiveTouchMeetingClient" = WebEx
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AVG" = AVG 2011
"facetheme" = Facetheme
"InstallShield_{0AEF384B-610F-4309-8DA3-91834FE4E80E}" = Sharpdesk
"Itibiti_is1" = Knctr
"Lexmark_HostCD" = Lexmark Software Uninstall
"LittlePDF" = LittlePDF 1.0.0.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"McAfee Security Scan" = McAfee Security Scan Plus
"Nuance PDF Reader_is1" = NuancePDFReader
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"PC Optimizer Pro" = PC Optimizer Pro
"PriceGong" = PriceGong 2.1.0
"SHARP MX-M283 M363 M423 M453 M503 Series PCL PS Printer Driver" = SHARP MX-M283/M363/M423/M453/M503 Series PCL/PS Printer Driver
"Shop to Win 2" = Shop to Win 2
"TeamViewer 6" = TeamViewer 6
"WinLiveSuite_Wave3" = Windows Live Essentials
"Yardi Payment Processing Videos" = Yardi Payment Processing Videos

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/26/2011 9:53:10 AM | Computer Name = AR2 | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 8.0.7600.16839,
time stamp: 0x4e0015ef Faulting module name: bho_project.dll, version: 1.0.0.1, time
stamp: 0x4e1b41b6 Exception code: 0xc0000417 Fault offset: 0x0000762b Faulting process
id: 0x1460 Faulting application start time: 0x01cc63f77d0ce210 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Program
Files\Object\bho_project.dll Report Id: bb9b8f90-cfea-11e0-89f6-00262d459c21

Error - 8/26/2011 9:53:24 AM | Computer Name = AR2 | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 8.0.7600.16839,
time stamp: 0x4e0015ef Faulting module name: bho_project.dll, version: 1.0.0.1, time
stamp: 0x4e1b41b6 Exception code: 0xc0000417 Fault offset: 0x0000762b Faulting process
id: 0x1ac Faulting application start time: 0x01cc63f7855cef50 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Program
Files\Object\bho_project.dll Report Id: c3cf0c50-cfea-11e0-89f6-00262d459c21

Error - 8/26/2011 9:53:31 AM | Computer Name = AR2 | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 8.0.7600.16839,
time stamp: 0x4e0015ef Faulting module name: bho_project.dll, version: 1.0.0.1, time
stamp: 0x4e1b41b6 Exception code: 0xc0000417 Fault offset: 0x0000762b Faulting process
id: 0xba4 Faulting application start time: 0x01cc63f789046bb0 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Program
Files\Object\bho_project.dll Report Id: c7fe3710-cfea-11e0-89f6-00262d459c21

Error - 8/26/2011 9:53:36 AM | Computer Name = AR2 | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 8.0.7600.16839,
time stamp: 0x4e0015ef Faulting module name: bho_project.dll, version: 1.0.0.1, time
stamp: 0x4e1b41b6 Exception code: 0xc0000417 Fault offset: 0x0000762b Faulting process
id: 0x1348 Faulting application start time: 0x01cc63f78c1ab430 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Program
Files\Object\bho_project.dll Report Id: cb063750-cfea-11e0-89f6-00262d459c21

Error - 8/26/2011 9:53:41 AM | Computer Name = AR2 | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 8.0.7600.16839,
time stamp: 0x4e0015ef Faulting module name: bho_project.dll, version: 1.0.0.1, time
stamp: 0x4e1b41b6 Exception code: 0xc0000417 Fault offset: 0x0000762b Faulting process
id: 0x1208 Faulting application start time: 0x01cc63f78f016130 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Program
Files\Object\bho_project.dll Report Id: cdf1a710-cfea-11e0-89f6-00262d459c21

Error - 8/26/2011 9:53:45 AM | Computer Name = AR2 | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 8.0.7600.16839,
time stamp: 0x4e0015ef Faulting module name: bho_project.dll, version: 1.0.0.1, time
stamp: 0x4e1b41b6 Exception code: 0xc0000417 Fault offset: 0x0000762b Faulting process
id: 0x360 Faulting application start time: 0x01cc63f7912c0190 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Program
Files\Object\bho_project.dll Report Id: d01784b0-cfea-11e0-89f6-00262d459c21

Error - 8/26/2011 9:53:48 AM | Computer Name = AR2 | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 8.0.7600.16839,
time stamp: 0x4e0015ef Faulting module name: bho_project.dll, version: 1.0.0.1, time
stamp: 0x4e1b41b6 Exception code: 0xc0000417 Fault offset: 0x0000762b Faulting process
id: 0xa90 Faulting application start time: 0x01cc63f7935dc610 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Program
Files\Object\bho_project.dll Report Id: d252ceb0-cfea-11e0-89f6-00262d459c21

Error - 8/26/2011 9:53:52 AM | Computer Name = AR2 | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 8.0.7600.16839,
time stamp: 0x4e0015ef Faulting module name: bho_project.dll, version: 1.0.0.1, time
stamp: 0x4e1b41b6 Exception code: 0xc0000417 Fault offset: 0x0000762b Faulting process
id: 0x1764 Faulting application start time: 0x01cc63f795cd6e50 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Program
Files\Object\bho_project.dll Report Id: d4b8f170-cfea-11e0-89f6-00262d459c21

Error - 8/26/2011 9:53:56 AM | Computer Name = AR2 | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 8.0.7600.16839,
time stamp: 0x4e0015ef Faulting module name: bho_project.dll, version: 1.0.0.1, time
stamp: 0x4e1b41b6 Exception code: 0xc0000417 Fault offset: 0x0000762b Faulting process
id: 0xd94 Faulting application start time: 0x01cc63f797c611d0 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Program
Files\Object\bho_project.dll Report Id: d6bfdd30-cfea-11e0-89f6-00262d459c21

Error - 8/26/2011 9:54:00 AM | Computer Name = AR2 | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 8.0.7600.16839,
time stamp: 0x4e0015ef Faulting module name: bho_project.dll, version: 1.0.0.1, time
stamp: 0x4e1b41b6 Exception code: 0xc0000417 Fault offset: 0x0000762b Faulting process
id: 0x1088 Faulting application start time: 0x01cc63f79a713c70 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Program
Files\Object\bho_project.dll Report Id: d9664510-cfea-11e0-89f6-00262d459c21

[ System Events ]
Error - 8/9/2011 12:11:36 PM | Computer Name = AR2 | Source = DCOM | ID = 10016
Description =

Error - 8/12/2011 3:54:57 PM | Computer Name = AR2 | Source = DCOM | ID = 10005
Description =

Error - 8/12/2011 3:54:57 PM | Computer Name = AR2 | Source = Service Control Manager | ID = 7038
Description = The upnphost service was unable to log on as NT AUTHORITY\LocalService
with the currently configured password due to the following error: %%50 To ensure
that the service is configured properly, use the Services snap-in in Microsoft
Management Console (MMC).

Error - 8/12/2011 3:54:57 PM | Computer Name = AR2 | Source = Service Control Manager | ID = 7000
Description = The UPnP Device Host service failed to start due to the following
error: %%1069

Error - 8/19/2011 12:07:51 PM | Computer Name = AR2 | Source = DCOM | ID = 10010
Description =

Error - 8/19/2011 12:07:56 PM | Computer Name = AR2 | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80080005: Security Update for Windows 7 (KB979688).

Error - 8/19/2011 1:13:03 PM | Computer Name = AR2 | Source = Service Control Manager | ID = 7034
Description = The QuestBrowse Service service terminated unexpectedly. It has done
this 1 time(s).

Error - 8/22/2011 12:51:54 PM | Computer Name = AR2 | Source = DCOM | ID = 10010
Description =

Error - 8/22/2011 2:33:04 PM | Computer Name = AR2 | Source = EventLog | ID = 6008
Description = The previous system shutdown at 2:30:50 PM on ?8/?22/?2011 was unexpected.

Error - 8/23/2011 11:05:50 AM | Computer Name = AR2 | Source = DCOM | ID = 10010
Description =


< End of report >



aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-08-26 10:14:30
—————————–
10:14:30.390 OS Version: Windows 6.1.7600
10:14:30.390 Number of processors: 1 586 0x603
10:14:30.406 ComputerName: AR2 UserName:
10:14:32.964 Initialize success
10:15:30.426 AVAST engine defs: 11082600
10:15:43.546 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000061
10:15:43.561 Disk 0 Vendor: Hitachi_ JP2O Size: 476940MB BusType: 3
10:15:45.589 Disk 0 MBR read successfully
10:15:45.589 Disk 0 MBR scan
10:15:45.605 Disk 0 Windows 7 default MBR code
10:15:45.621 Disk 0 scanning sectors +976771120
10:15:45.730 Disk 0 scanning C:\Windows\system32\drivers
10:15:52.687 Service scanning
10:15:53.795 Modules scanning
10:15:59.941 Disk 0 trace - called modules:
10:15:59.957 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll storport.sys nvstor.sys amdppm.sys
10:15:59.957 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85685030]
10:15:59.957 3 CLASSPNP.SYS[87fda59e] -> nt!IofCallDriver -> [0x846e8700]
10:16:00.472 5 ACPI.sys[87c173b2] -> nt!IofCallDriver -> \Device\00000061[0x84fd57b8]
10:16:01.720 AVAST engine scan C:\Windows
10:16:04.575 AVAST engine scan C:\Windows\system32
10:17:09.330 File: C:\Windows\system32\ssblinkx.scr **INFECTED** Win32:Dropper-gen [Drp]
10:17:32.418 AVAST engine scan C:\Windows\system32\drivers
10:17:46.146 AVAST engine scan C:\Users\User
10:19:18.420 AVAST engine scan C:\ProgramData
10:19:59.495 Scan finished successfully
10:20:26.639 Disk 0 MBR has been saved successfully to "C:\Users\User\Desktop\MBR.dat"
10:20:26.655 The log file has been saved successfully to "C:\Users\User\Desktop\aswMBR.txt"

All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully! HKU\S-1-5-21-4275901283-1487297572-3712528860-1005\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1631550F-191D-4826-B069-D9439253D926}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1631550F-191D-4826-B069-D9439253D926}\ not found. C:\Program Files\PriceGong\2.1.0\PriceGongIE.dll moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{20FEC4E7-F7B7-438B-8191-33D2EFC5EBEA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20FEC4E7-F7B7-438B-8191-33D2EFC5EBEA}\ not found. File C:\Program Files\Shop to Win 2\ShoppingBHO.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3fdba1ba-ae28-4045-9048-4ed2f3865629}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3fdba1ba-ae28-4045-9048-4ed2f3865629}\ not found. C:\Program Files\Object\bho_project.dll moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}\ not found. File C:\Program Files\Common Files\FreeCause\DCA\dca-bho.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2D09FE0-F451-45F7-A617-FABF9130C4D6}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2D09FE0-F451-45F7-A617-FABF9130C4D6}\ not found. File C:\Program Files\Shop to Win 16\Shop to Win 16.dll (Shop To Win, LL not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Carlisha ->Temp folder emptied: 241571686 bytes ->Temporary Internet Files folder emptied: 517686841 bytes ->Java cache emptied: 1896016 bytes ->Google Chrome cache emptied: 6455025 bytes ->Flash cache emptied: 35796 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 56502 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public User: User ->Temp folder emptied: 49170074 bytes ->Temporary Internet Files folder emptied: 20619352 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 58072 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 347071537 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 1,130.00 mb OTL by OldTimer - Version 3.2.26.5 log created on 08302011_083350 Files\Folders moved on Reboot… File\Folder C:\Users\User\AppData\Local\Temp\~DF0C9D2E7870BE505C.TMP not found! File\Folder C:\Users\User\AppData\Local\Temp\~DF4A1B1CC0849E08F6.TMP not found! File\Folder C:\Users\User\AppData\Local\Temp\~DF5D2FB2ED83FE072D.TMP not found! File\Folder C:\Users\User\AppData\Local\Temp\~DF5DE659907D40F7DA.TMP not found! File\Folder C:\Users\User\AppData\Local\Temp\~DF9DB95CBEFD956178.TMP not found! File\Folder C:\Users\User\AppData\Local\Temp\~DFC0891F175F763C4F.TMP not found! C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\RYKCQQKZ\iframe[1].htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\QJSMCH5O\ads[2].htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\FI0THPP9\like[1].htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DINSLTUI\ads[3].htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DINSLTUI\index[1].htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully. C:\Windows\temp\wbxtra_08302011_081703.wbt moved successfully. Registry entries deleted on Reboot… ComboFix 11-08-30.01 - User 08/30/2011 8:47.1.1 - x86 Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.1791.1044 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\Blinkx c:\program files\Blinkx\blinkx.ico c:\program files\Blinkx\blinkxss.exe c:\program files\Blinkx\blinkxstop.exe c:\program files\Blinkx\lang.dll c:\program files\Blinkx\templates\beat.ico c:\program files\Blinkx\templates\index.html c:\program files\Blinkx\templates\noflash.html c:\program files\Blinkx\templates\offline.html c:\program files\Blinkx\templates\offline.swf c:\program files\Blinkx\templates\uninstall.exe c:\programdata\Tarma Installer c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico c:\windows\refsdm.dll c:\windows\svers.dll c:\windows\system32\comct332.ocx . . ((((((((((((((((((((((((( Files Created from 2011-07-28 to 2011-08-30 ))))))))))))))))))))))))))))))) . . 2011-08-30 12:54 . 2011-08-30 12:54 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-08-30 12:54 . 2011-08-30 12:54 ——– d—–w- c:\users\Carlisha\AppData\Local\temp 2011-08-30 12:33 . 2011-08-30 12:33 ——– d—–w- C:\_OTL 2011-08-30 12:17 . 2011-08-30 12:17 ——– d—–w- c:\users\Carlisha\AppData\Roaming\AVG10 2011-08-25 14:10 . 2011-08-25 14:10 ——– d—–w- C:\$AVG 2011-08-25 13:42 . 2011-08-25 13:43 ——– d—–w- c:\programdata\AVG Security Toolbar 2011-08-25 13:41 . 2011-08-30 12:22 ——– d—–w- c:\windows\system32\drivers\AVG 2011-08-25 13:41 . 2011-08-25 13:43 ——– d—–w- c:\programdata\AVG10 2011-08-25 13:40 . 2011-08-25 13:40 ——– d—–w- c:\program files\AVG 2011-08-25 13:38 . 2011-08-25 13:38 ——– d–h–w- c:\programdata\Common Files 2011-08-25 13:37 . 2011-08-25 13:44 ——– d—–w- c:\programdata\MFAData 2011-08-25 13:19 . 2011-08-25 13:19 ——– d—–w- c:\program files\Trend Micro 2011-08-25 12:41 . 2011-08-25 12:41 101720 —-a-w- c:\windows\system32\drivers\SBREDrv.sys 2011-08-25 12:40 . 2011-08-25 12:40 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\Sunbelt Software 2011-08-25 12:40 . 2011-08-25 13:36 ——– dc—-w- c:\windows\system32\DRVSTORE 2011-08-25 12:40 . 2011-08-25 13:36 ——– d—–w- c:\programdata\Lavasoft 2011-08-24 13:03 . 2011-07-09 04:30 2048 —-a-w- c:\windows\system32\tzres.dll 2011-08-23 15:15 . 2011-08-23 15:15 ——– d—–w- c:\users\User 2011-08-23 14:58 . 2011-08-23 14:58 ——– d—–w- c:\users\Carlisha\AppData\Roaming\Malwarebytes 2011-08-23 14:58 . 2011-07-06 23:52 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-08-23 14:58 . 2011-08-23 14:58 ——– d—–w- c:\programdata\Malwarebytes 2011-08-23 14:58 . 2011-08-23 14:58 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2011-08-23 14:58 . 2011-07-06 23:52 22712 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-08-23 14:46 . 2011-08-23 14:46 216888 —-a-w- c:\windows\system32\atsckernel.exe 2011-08-23 14:46 . 2011-08-23 14:46 133944 —-a-w- c:\windows\system32\atashost.exe 2011-08-23 13:12 . 2011-08-16 12:48 7152464 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{78D5B2C2-4B8F-4262-8B3F-91CE8FED7F46}\mpengine.dll 2011-08-23 13:04 . 2011-08-23 13:04 ——– d—–w- c:\windows\system32\Wat 2011-08-22 21:37 . 2010-03-04 03:57 190976 —-a-w- c:\windows\system32\drivers\ks.sys 2011-08-22 21:37 . 2010-09-14 06:07 276992 —-a-w- c:\windows\system32\wcncsvc.dll 2011-08-22 18:24 . 2010-11-02 04:35 1170944 —-a-w- c:\windows\system32\d3d10warp.dll 2011-08-22 18:22 . 2011-02-03 05:45 219008 —-a-w- c:\windows\system32\drivers\dxgmms1.sys 2011-08-22 18:22 . 2010-11-02 04:46 728448 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys 2011-08-22 18:22 . 2010-11-02 04:23 107520 —-a-w- c:\windows\system32\cdd.dll 2011-08-19 17:15 . 2011-08-19 17:15 ——– d-sh–w- c:\windows\system32\%APPDATA% 2011-08-19 16:24 . 2009-09-10 05:52 257024 —-a-w- c:\windows\system32\msv1_0.dll 2011-08-19 16:20 . 2009-11-25 16:47 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll 2011-08-19 16:20 . 2009-11-25 16:47 49472 —-a-w- c:\windows\system32\netfxperf.dll 2011-08-19 16:20 . 2009-11-25 16:47 297808 —-a-w- c:\windows\system32\mscoree.dll 2011-08-19 16:20 . 2009-11-25 16:47 295264 —-a-w- c:\windows\system32\PresentationHost.exe 2011-08-19 16:20 . 2009-11-25 16:47 1130824 —-a-w- c:\windows\system32\dfshim.dll 2011-08-19 16:15 . 2011-08-19 16:15 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2 2011-08-19 16:06 . 2011-08-19 16:06 ——– d—–w- c:\program files\MSXML 4.0 2011-08-19 15:17 . 2009-12-08 11:32 292864 —-a-w- c:\windows\system32\apphelp.dll 2011-08-19 14:35 . 2011-08-19 14:35 ——– d—–w- c:\programdata\PC Optimizer Pro 2011-08-19 14:30 . 2011-08-19 14:30 ——– d—–w- c:\users\Carlisha\AppData\Roaming\Itibiti 2011-08-19 14:30 . 2011-08-19 14:30 ——– d—–w- c:\program files\LittlePDF 2011-08-19 14:30 . 2011-08-19 14:30 ——– d—–w- c:\program files\Itibiti Soft Phone 2011-08-19 14:30 . 2011-08-19 14:30 ——– d—–w- c:\program files\Oberon Media 2011-08-19 14:30 . 2011-08-19 14:30 ——– d—–w- c:\programdata\Oberon Media 2011-08-19 14:30 . 2011-08-19 14:35 ——– d—–w- c:\program files\PC Optimizer Pro 2011-08-19 14:30 . 2011-08-25 13:46 ——– d—–w- c:\program files\Yontoo Layers Runtime 2011-08-19 14:30 . 2011-08-19 14:30 ——– d—–w- c:\users\Carlisha\AppData\Roaming\Oberon Media 2011-08-19 14:30 . 2011-08-19 14:30 ——– d—–w- c:\program files\Common Files\Oberon Media 2011-08-19 14:30 . 2011-08-19 14:30 ——– d—–w- c:\programdata\WeCareReminder 2011-08-18 20:42 . 2011-08-18 20:42 ——– d—–w- c:\users\Carlisha\AppData\Local\Downloaded Installations 2011-08-18 20:42 . 2011-08-18 20:42 ——– d—–w- c:\program files\NuancePDFReader 2011-08-18 20:42 . 2011-08-18 20:42 33001712 —-a-w- c:\program files\Nuance PDF Reader.exe 2011-08-18 20:34 . 2011-08-30 12:29 ——– d—–w- c:\program files\Common Files\FreeCause 2011-08-18 20:34 . 2011-08-30 12:29 ——– d—–w- c:\program files\Shop To Win 2011-08-18 20:34 . 2011-08-30 12:34 ——– d—–w- c:\program files\Object 2011-08-17 19:49 . 2011-08-17 19:49 ——– d—–w- c:\program files\Common Files\Adobe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-07-26 2532680] . [HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}] . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2011-07-26 14:15 2532680 —-a-w- c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}] 2010-11-09 15:21 371320 —-a-w- c:\program files\Freeze.com\NetAssistant\NetAssistant.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-07-26 2532680] . [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-07-26 2532680] . [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472] "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-05-14 30248] "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-05-14 46632] "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528] "Opware15"="c:\program files\ScanSoft\OmniPage15\Opware15.exe" [2007-05-11 79400] "ScanSoft OmniPage 15-reminder"="c:\program files\ScanSoft\OmniPage15\Ereg\Ereg.exe" [2007-02-01 255528] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "IndexTray"="c:\program files\Sharp\Sharpdesk\IndexTray.exe" [2008-09-20 106496] "SharpTray"="c:\program files\Sharp\Sharpdesk\SharpTray.exe" [2008-09-20 32768] "TypeRegChecker"="c:\program files\Sharp\Sharpdesk\TypeRegChecker.exe" [2008-09-20 57344] "FtpServer.exe"="c:\program files\Sharp\Sharpdesk\FtpServer.exe" [2008-06-13 704512] "LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2010-09-17 63048] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-01-21 91520] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-07-06 1047656] "AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-04-18 2334560] . c:\users\Carlisha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart . R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-07-26 1025352] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4640000] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-22 1343400] S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-02-22 22992] S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2011-03-16 32592] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2011-01-07 248656] S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2011-04-05 297168] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952] S2 atashost;WebEx Service Host for Support Center;c:\windows\system32\atashost.exe [2011-08-23 133944] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2011-04-18 7398752] S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [2011-02-08 269520] S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [2010-12-08 374152] S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2010-09-17 12856] S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2010-11-30 2222376] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-04-15 134480] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-02-10 24144] S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [2011-02-10 21968] . . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.greystar.com/Greystar/Index.aspx TCP: DhcpNameServer = [removed] [removed] Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll DPF: {C53EE992-020F-40B8-A1B4-16518D8C7948} - hxxps://yardi.pregllc.com/voyager60822sp13/ysiNetClientInstaller.CAB DPF: {CED616F0-2859-4BF8-8538-9DAF544AF2CB} - hxxps://yardi.pregllc.com/voyager60822sp13/ysiComm.CAB DPF: {F48DE781-C525-44C9-9529-C5ADE3EF5F70} - hxxps://yardi.pregllc.com/voyager60822sp13/gdpicturepro5.cab . - - - - ORPHANS REMOVED - - - - . AddRemove-{889DF117-14D1-44EE-9F31-C5FB5D47F68B} - c:\progra~3\TARMAI~1\{889DF~1\Setup.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-08-30 09:08:06 ComboFix-quarantined-files.txt 2011-08-30 13:08 . Pre-Run: 432,232,669,184 bytes free Post-Run: 432,342,540,288 bytes free . - - End Of File - - 66F40E2EFE0D3E8406C0D7698FF42A42