Spyware / Malware / Virus Removal

Hidden Desktop

21 min read

Looking for the outcome? Ask AI

amitemurray Topic Starter

Post #1September 4, 2011, 1:20 PM UTC

Also possible ReDirect Virus.Downloaded McAfee AntiVirus Trial, which didn't help. Ran ComboFix, which helped. Had problems getting rid of McAfee, wireless quit working, ran MCPR.exe. Thank you.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:04:24 AM, on 9/4/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17098)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Update\1.3.21.65\GoogleCrashHandler.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\PC Tools Security\pctsAuxs.exe
C:\Program Files\PC Tools Security\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\PC Tools Security\pctsGui.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\PC Tools Security\BDT\FGuard.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Moo0\Magnifier 1.10\Magnifier.exe
C:\Program Files\WinDates\WinDates.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Murray Quin\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: PC Tools Browser Guard - {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SMART Notebook Download Plugin - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Program Files\SMART Technologies\SMART Notebook\NotebookPlugin.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\PC Tools Security\pctsGui.exe" /hideGUI
O4 - HKLM\..\Run: [PCTools FGuard] C:\Program Files\PC Tools Security\BDT\FGuard.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Moo0 Magnifier 1.10.lnk = C:\Program Files\Moo0\Magnifier 1.10\Magnifier.exe
O4 - Startup: Shortcut to WinDates.exe.lnk = C:\Program Files\WinDates\WinDates.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} - http://echat.bellsouth.net/sdccommon/download/tgctlcm.cab
O16 - DPF: {0FAA926E-2AF4-11D3-9995-00A0CC3A27A9} (Infragistics ComboBox Control) - http://tcapps.selu.edu/timecentre/Common/pvcombo.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} - http://h30155.www3.hp.com/ediags/dd/instal…llMgr_v01_5.cab
O16 - DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} (PopupMenu Object) - http://tcapps.selu.edu/timecentre/Common/iemenu.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://tcapps.selu.edu/viewer/activeXViewe…tivexviewer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - file:///C:/Documents%20and%20Settings/Patrick%20Quin/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/swflash.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Update Service (gupdate1c999ed12312ca2) (gupdate1c999ed12312ca2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Activation Service (McAWFwk) - Unknown owner - (no file)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\PC Tools Security\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\PC Tools Security\pctsSvc.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 8614 bytes

oldman960

Post #2September 5, 2011, 5:47 AM UTC

Hi amitemurray, welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Combofix is a very powerful tool and should not be used without supervision.

Please post the combofix log, it can be found at C:\Combofix.txt.

Also please post Add-Remove Programs.txt it can be found in C:\Qoobox

Please discribe any symptoms or problems you are having. Is the desktop back, any missing icons?

Thanks

amitemurray

Post #3September 5, 2011, 1:19 PM UTC

Hi oldman960,
Thanks for helping. Desktop and icons are back. Machine seems to be operating normally. I read on this site that just because a machine seems clean doesn't mean it is.

ComboFix 11-09-01.03 - Murray Quin 09/01/2011 18:07:41.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.218 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Murray Quin\RegClean.exe
C:\readme.txt
C:\RegClean.exe
c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\bwUnin-7.2.0.137-8876480SL.exe
c:\windows\bwUnin-7.2.0.157-8876480SL.exe
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\iun6002.exe
c:\windows\kb913800.exe
c:\windows\system32\AutoRun.inf
c:\windows\system32\ccrpTmr6.dll
c:\windows\system32\comct332.ocx
.
.
((((((((((((((((((((((((( Files Created from 2011-08-01 to 2011-09-01 )))))))))))))))))))))))))))))))
.
.
2011-09-01 22:16 . 2011-09-01 22:16 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2011-09-01 10:38 . 2011-09-01 21:58 ——– d—–w- c:\program files\Common Files\Mcafee
2011-09-01 10:38 . 2011-09-01 21:58 ——– d—–w- c:\program files\McAfee
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-07 00:52 . 2010-11-07 01:59 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-07 00:52 . 2010-11-07 01:59 22712 —-a-w- c:\windows\system32\drivers\mbam(2).sys
2011-06-28 11:57 . 2011-06-28 11:57 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2006-11-23 03:04 . 2005-06-19 00:47 231258 —-a-w- c:\program files\pikachu.exe
2011-09-01 22:03 . 2011-05-04 11:04 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Murray Quin\Start Menu\Programs\Startup\
Moo0 Magnifier 1.10.lnk - c:\program files\Moo0\Magnifier 1.10\Magnifier.exe [2011-2-23 1556480]
Shortcut to WinDates.exe.lnk - c:\program files\WinDates\WinDates.exe [2007-6-29 1589248]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 18:37 932288 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-24 09:15 40368 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2005-08-06 03:05 344064 —-a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
2006-11-01 17:48 1392640 —-a-w- c:\windows\system32\WLTRAY.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-09-08 11:20 122940 —-a-w- c:\windows\system32\DLA\DLACTRLW.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 23:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 16:43 248040 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\rundisabled]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"Dell Wireless Manager UI"=c:\windows\system32\WLTRAY
"SunJavaUpdateSched"=c:\program files\Java\jre1.5.0_03\bin\jusched.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BrooksCole\\jre\\bin\\java.exe"=
"c:\\Program Files\\BrooksCole\\server\\mysql\\bin\\mysqld.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
.
S1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys –> c:\windows\system32\drivers\mfetdi2k.sys [?]
S2 gupdate1c999ed12312ca2;Google Update Service (gupdate1c999ed12312ca2);c:\program files\Google\Update\GoogleUpdate.exe [2/28/2009 4:39 PM 133104]
S2 mfefire;McAfee Firewall Core Service;"c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe" –> c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [?]
S2 mfevtp;McAfee Validation Trust Protection Service;"c:\windows\system32\mfevtps.exe" –> c:\windows\system32\mfevtps.exe [?]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys –> c:\windows\system32\drivers\cfwids.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/28/2009 4:39 PM 133104]
S3 McAWFwk;McAfee Activation Service;c:\progra~1\mcafee\msc\mcawfwk.exe –> c:\progra~1\mcafee\msc\mcawfwk.exe [?]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys –> c:\windows\system32\drivers\mfefirek.sys [?]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\DRIVERS\mfendisk.sys –> c:\windows\system32\DRIVERS\mfendisk.sys [?]
S3 mfendiskmp;mfendiskmp;c:\windows\system32\DRIVERS\mfendisk.sys –> c:\windows\system32\DRIVERS\mfendisk.sys [?]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys –> c:\windows\system32\drivers\mferkdet.sys [?]
S4 McOobeSv;McAfee OOBE Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc –> c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [?]
.
— Other Services/Drivers In Memory —
.
*Deregistered* - MBAMSwissArmy
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
.
2011-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-28 21:39]
.
2011-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-28 21:39]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: motive.com\pattta.att
Trusted Zone: motive.com\patttbc.att
TCP: DhcpNameServer = 192.168.2.1
DPF: {0FAA926E-2AF4-11D3-9995-00A0CC3A27A9} - hxxp://tcapps.selu.edu/timecentre/Common/pvcombo.cab
DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} - hxxp://tcapps.selu.edu/timecentre/Common/iemenu.cab
FF - ProfilePath - c:\documents and settings\Murray Quin\Application Data\Mozilla\Firefox\Profiles\xjnvebmq.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{D187A56B-A33F-4CBE-9D77-459FC0BAE012} - (no file)
Toolbar-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - (no file)
WebBrowser-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - (no file)
HKLM-Run-mcui_exe - c:\program files\McAfee.com\Agent\mcagent.exe
Notify-avgrsstarter - (no file)
MSConfigStartUp-AVG_TRAY - c:\program files\AVG\AVG10\avgtray.exe
AddRemove-MSC - c:\program files\McAfee\MSC\mcuihost.exe
AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-01 18:50
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(428)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll
.
Completion time: 2011-09-01 19:08:11
ComboFix-quarantined-files.txt 2011-09-02 00:07
.
Pre-Run: 10,749,292,544 bytes free
Post-Run: 11,104,743,424 bytes free
.
- - End Of File - - EDEFFE8194458E835DC62EF9C2BFDE2C

Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.2.5
Adobe Shockwave Player 11.5
ALPS Touch Pad Driver
AOLIcon
Apple Application Support
Apple Software Update
ArcSoft PhotoStudio 5.5
ATI Control Panel
ATI Display Driver
Atomic Clock Sync
Auslogics Duplicate File Finder
AutoUpdate
BackgroundCMD Shell Extension
Bonjour
Broadcom Management Programs 2
Burn4Free CD and DVD
Business Contact Manager for Outlook 2003
Canon CanoScan 4400F User Registration
Canon CanoScan Toolbox 5.0
CanoScan 4400F
CCleaner
Compatibility Pack for the 2007 Office system
Conexant D110 MDC V.9x Modem
Cool Timer 3.6
Critical Update for Windows Media Player 11 (KB959772)
Defraggler
Dell CinePlayer
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell System Restore
Dell Wireless WLAN Card
DellSupport
Digital Content Portal
Digital Line Detect
DivX Codec
DivX Converter
DivX Player
DivX Web Player
dj_sf_software
Easy Video Downloader v. 1.2
eDrawings 2008
EducateU
ELIcon
ESPNMotion
Eusing Free Registry Cleaner
Expstudio Audio Editor FREE
FastStone Photo Resizer 2.7
File Scavenger 3.1
Free Internet Eraser 3.0
Free Registry Defrag
Geo CS Test Gen
Google
Google Earth
Google SketchUp 6
Google Update Helper
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Internal Network Card Power Management
iPod for Windows 2006-03-23
J2SE Runtime Environment 5.0 Update 3
Java 2 Runtime Environment, SE v1.4.2_03
Java Auto Updater
Java™ 6 Update 20
Java™ 6 Update 7
KeePass Password Safe 1.06
Learn2 Player (Uninstall Only)
Malwarebytes' Anti-Malware version 1.51.1.1800
McAfee AntiVirus Plus
Microsoft .NET Framework 1.0 Hotfix (KB953295)
Microsoft .NET Framework 1.0 Hotfix (KB979904)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office File Validation Add-In
Microsoft Office Small Business Edition 2003
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
ML Geo Test Gen
Modem Helper
Moo0 Magnifier 1.10
Mozilla Firefox 6.0.1 (x86 en-US)
MSN
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
My Wal-Mart Digital Photo Center
NetWaiting
Opera 9.27
Otto
PhotoVidShow
Presto! PageManager 7.15.13
QuickTime
Roxio DLA
Roxio MyDVD LE
Roxio RecordNow Audio
Roxio RecordNow Copy
Roxio RecordNow Data
SAMSUNG Mobile Composite Device Software
SAMSUNG Mobile Modem Driver Set
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio 3
ScanSoft OmniPage SE 4.0
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB2183461)
Security Update for Windows Internet Explorer 7 (KB2360131)
Security Update for Windows Internet Explorer 7 (KB2416400)
Security Update for Windows Internet Explorer 7 (KB2497640)
Security Update for Windows Internet Explorer 7 (KB2530548)
Security Update for Windows Internet Explorer 7 (KB2544521)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2491683)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2510581)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Sibelius Scorch (ActiveX Only)
SMART Notebook
Solero Music Viewer
Sonic Activation Module
Sonic Encoders
Sonic Update Manager
Speccy
TreeSize Free V2.2.1
Tweak UI
UnloadSupport
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows Media Player 10 (KB910393)
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2541763)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update Rollup 2 for Windows XP Media Center Edition 2005
URL Assistant
ViceVersa Free 1.0.5
Viewpoint Media Player
WebCyberCoach 3.2 Dell
WebFldrs XP
Windows Driver Package - MobileTop (sshpmdm) Modem (02/23/2007 2.5.0.0)
Windows Driver Package - MobileTop (sshpusb) USB (02/23/2007 2.5.0.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 10 Hotfix [See EmeraldQFE2 for more information]
Windows Media Player 11
Windows Media Player Firefox Plugin
Windows XP Media Center Edition 2005 KB2502898
Windows XP Media Center Edition 2005 KB908246
Windows XP Media Center Edition 2005 KB925766
Windows XP Media Center Edition 2005 KB973768
Windows XP Service Pack 3
Yahoo! Browser Services
Yahoo! Internet Mail

oldman960

Post #4September 5, 2011, 4:12 PM UTC

Hi amitemurray,

There doesn't appear to be an antivirus program installed on this computer. Please limit your internet activity to downloading tools and posting in this topic.

I need some information on some unidentified files. We will use Virustotal Please submit these files for analysis

To submit a file to virustotal, please click on this link

VirusTotal

copy and paste the following into the upload a file box

c:\program files\pikachu.exe

scroll down a bit and click "send file", wait for the results and post them in your next reply.

Please note that sometimes the scans take a few minutes. Please ensure that the scan has completed and the results are complete .

Thanks

amitemurray

Post #5September 5, 2011, 4:57 PM UTC

Hi oldman960, Pikachu.exe is a Tetris-style game. Regarding, I had previously installed PC Tools AntiVirus Free. Here is the analysis from VirusTotal on c:\program files\pikachu.exe. File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis: MD5: a5719ee234d177c2e56765aeebb95625 Date first seen: 2006-06-27 05:54:59 (UTC) Date last seen: 2011-02-21 03:49:29 (UTC) Detection ratio: 5/43 What do you wish to do?

amitemurray

Post #6September 5, 2011, 5:00 PM UTC

correction: should have been "Regarding antivirus not being installed…". "What do you wish to do?" was from VirusTotal.

oldman960

Post #7September 6, 2011, 5:14 AM UTC

Hi amitemurray,

When VirusTotal asks it wants to know is you want to accept the current analysis or rescan. I think the file is ok.

Let's try to get the rest of McAfee removed as well as some old vunerable java. Once you do that I'll give you some link to good free antvirus programs.

Go to add/remove programs and uninstall the following

J2SE Runtime Environment 5.0 Update 3
Java 2 Runtime Environment, SE v1.4.2_03
Java™ 6 Update 7
McAfee AntiVirus Plus

Do not uninstall Java™ 6 Update 20

Next

Rerun MCPR.exe.

Next

Download OTL to your desktop.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, check the box beside Scan all users
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Please post back with

both OTL log

Computer still ok?

Thanks

amitemurray

Post #8September 6, 2011, 10:39 AM UTC

Hi oldman960, I uninstalled the three Java items, but McAfee AntiVirus Plus is not listed in Add or Remove Programs. Am I overlooking it, somehow? I haven't yet rerun MCPR.exe, or run OTL. Computer still seems to be okay. Thanks.

oldman960

Post #9September 6, 2011, 12:25 PM UTC

Hi amitemurray, Go ahead with the rest.

amitemurray

Post #10September 7, 2011, 12:18 AM UTC

Here's the OTL.txt
OTL logfile created on: 9/6/2011 7:09:16 PM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Documents and Settings\Murray Quin\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.37 Mb Total Physical Memory | 222.75 Mb Available Physical Memory | 43.56% Memory free
1.22 Gb Paging File | 0.99 Gb Available in Paging File | 81.16% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 32.55 Gb Total Space | 11.57 Gb Free Space | 35.56% Space Free | Partition Type: NTFS

Computer Name: DCCB7L91 | User Name: Murray Quin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/09/06 19:01:16 | 000,581,120 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Murray Quin\Desktop\OTL.exe
PRC - [2011/08/03 15:52:23 | 000,140,952 | —- | M] (Google Inc.) – C:\Program Files\Google\Update\1.3.21.65\GoogleCrashHandler.exe
PRC - [2011/07/01 15:36:48 | 000,247,760 | —- | M] (Threat Expert Ltd.) – C:\Program Files\PC Tools Security\BDT\FGuard.exe
PRC - [2011/07/01 15:36:44 | 000,337,872 | —- | M] (Threat Expert Ltd.) – C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2005/10/07 07:13:38 | 000,176,128 | R— | M] (Alps Electric Co., Ltd.) – C:\Program Files\Apoint\Apoint.exe
PRC - [2005/07/27 09:41:08 | 000,045,056 | R— | M] (Alps Electric Co., Ltd.) – C:\Program Files\Apoint\ApntEx.exe
PRC - [2004/06/28 16:56:12 | 000,045,056 | R— | M] (Alps Electric Co., Ltd.) – C:\Program Files\Apoint\hidfind.exe

========== Modules (No Company Name) ==========

MOD - [2011/02/04 17:48:30 | 000,291,840 | —- | M] () – C:\WINDOWS\system32\sbe.dll
MOD - [2010/02/05 13:27:45 | 001,291,776 | —- | M] () – C:\WINDOWS\system32\quartz.dll
MOD - [2008/04/13 19:11:59 | 000,014,336 | —- | M] () – C:\WINDOWS\system32\msdmo.dll
MOD - [2008/04/13 19:11:51 | 000,059,904 | —- | M] () – C:\WINDOWS\system32\devenum.dll
MOD - [2006/11/01 12:48:02 | 000,757,760 | —- | M] () – C:\WINDOWS\system32\bcm1xsup.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] – – (McAWFwk)
SRV - [2011/07/01 15:36:44 | 000,337,872 | —- | M] (Threat Expert Ltd.) [Auto | Running] – C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe – (Browser Defender Update Service)
SRV - [2011/04/06 16:53:36 | 001,117,144 | —- | M] (PC Tools) [On_Demand | Stopped] – C:\Program Files\PC Tools Security\pctsSvc.exe – (sdCoreService)
SRV - [2011/02/18 11:14:04 | 000,371,472 | —- | M] (PC Tools) [On_Demand | Stopped] – C:\Program Files\PC Tools Security\pctsAuxs.exe – (sdAuxService)
SRV - [2007/11/19 13:11:43 | 000,079,360 | —- | M] (SolidWorks) [On_Demand | Stopped] – C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe – (SolidWorks Licensing Service)
SRV - [2007/03/07 15:47:46 | 000,076,848 | —- | M] () [On_Demand | Stopped] – C:\Program Files\DellSupport\brkrsvc.exe – (DSBrokerService)

========== Driver Services (SafeList) ==========

DRV - [2011/07/11 12:02:34 | 000,263,888 | —- | M] (PC Tools) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\PCTCore.sys – (PCTCore)
DRV - [2011/03/10 09:08:22 | 000,233,976 | —- | M] (PC Tools) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\PCTSD.sys – (PCTSD)
DRV - [2010/07/16 14:59:54 | 000,656,320 | —- | M] (PC Tools) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\pctEFA.sys – (pctEFA)
DRV - [2010/07/16 14:59:54 | 000,338,880 | —- | M] (PC Tools) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\pctDS.sys – (pctDS)
DRV - [2008/12/05 21:15:39 | 000,005,632 | —- | M] () [File_System | System | Running] – C:\WINDOWS\System32\drivers\StarOpen.sys – (StarOpen)
DRV - [2008/02/22 16:33:02 | 000,114,304 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\sscdmdm.sys – (sscdmdm)
DRV - [2008/02/22 16:33:02 | 000,014,976 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\sscdmdfl.sys – (sscdmdfl)
DRV - [2008/02/22 16:33:00 | 000,087,936 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\sscdbus.sys – (sscdbus) SAMSUNG USB Composite Device driver (WDM)
DRV - [2007/02/25 12:10:48 | 000,005,376 | –S- | M] (Gteko Ltd.) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\dsunidrv.sys – (dsunidrv)
DRV - [2006/10/12 15:28:42 | 000,604,928 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\BCMWL5.SYS – (BCM43XX)
DRV - [2006/10/05 16:07:28 | 000,004,736 | —- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys – (DSproct)
DRV - [2005/09/28 13:57:18 | 000,113,847 | R— | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Apfiltr.sys – (ApfiltrService)
DRV - [2005/09/08 06:20:00 | 000,094,332 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS – (DLAUDFAM)
DRV - [2005/09/08 06:20:00 | 000,087,036 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS – (DLAUDF_M)
DRV - [2005/09/08 06:20:00 | 000,086,524 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS – (DLAIFS_M)
DRV - [2005/09/08 06:20:00 | 000,025,628 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLABOIOM.SYS – (DLABOIOM)
DRV - [2005/09/08 06:20:00 | 000,014,684 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS – (DLAOPIOM)
DRV - [2005/09/08 06:20:00 | 000,006,364 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAPoolM.SYS – (DLAPoolM)
DRV - [2005/09/08 06:20:00 | 000,002,496 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLADResN.SYS – (DLADResN)
DRV - [2005/08/25 13:16:52 | 000,005,628 | —- | M] (Sonic Solutions) [File_System | System | Stopped] – C:\WINDOWS\system32\drivers\DLACDBHM.SYS – (DLACDBHM)
DRV - [2005/08/25 13:16:16 | 000,022,684 | —- | M] (Sonic Solutions) [File_System | System | Running] – C:\WINDOWS\system32\drivers\DLARTL_N.SYS – (DLARTL_N)
DRV - [2005/08/04 05:10:18 | 001,273,344 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2005/03/10 23:56:06 | 000,273,168 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\STAC97.sys – (STAC97)
DRV - [2004/06/30 11:39:36 | 000,016,128 | —- | M] (Dell Inc) [Kernel | On_Demand | Running] – C:\Program Files\Dell\NicConfigSvc\Appdrv.sys – (Appdrv)
DRV - [2004/06/17 21:57:02 | 000,200,064 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSFHWICH.sys – (HSFHWICH)
DRV - [2004/06/17 21:55:38 | 000,685,056 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2004/06/17 21:55:04 | 001,041,536 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_DP.sys – (HSF_DP)
DRV - [2004/05/26 21:18:18 | 000,044,928 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\bcm4sbxp.sys – (bcm4sbxp)
DRV - [2004/02/13 17:46:00 | 000,017,153 | —- | M] (Dell Inc) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\omci.sys – (omci)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&client;=dell
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://www.google.com/ig/dell?hl=en&client;=dell

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&client;=dell
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&client;=dell
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
IE - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com"
FF - prefs.js..extensions.enabledItems: {D6D05E6F-D5C1-4e03-8E33-73F92B05E262}:10.2
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\[removed]/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\PC Tools Security\BDT\Firefox\ [2011/09/03 12:29:50 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/01 17:03:45 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/28 21:08:50 | 000,000,000 | —D | M]

[2010/11/06 08:43:13 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Murray Quin\Application Data\Mozilla\Extensions
[2011/04/05 15:48:57 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Murray Quin\Application Data\Mozilla\Firefox\Profiles\xjnvebmq.default\extensions
[2011/09/06 05:26:13 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/10/05 18:55:42 | 000,000,000 | —D | M] (SMART Notebook Extension) – C:\Program Files\Mozilla Firefox\extensions\{D6D05E6F-D5C1-4e03-8E33-73F92B05E262}
[2010/09/01 05:59:23 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/09/01 17:03:44 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/09/01 05:59:22 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2008/06/20 08:52:33 | 000,151,552 | —- | M] (PopCap Games) – C:\Program Files\mozilla firefox\plugins\nppopcaploader.dll
[2011/05/04 06:04:28 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/09/01 18:49:33 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (CIEDownload Object) - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Program Files\SMART Technologies\SMART Notebook\NotebookPlugin.dll (SMART Technologies ULC.)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll (Google)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [PCTools FGuard] C:\Program Files\PC Tools Security\BDT\FGuard.exe (Threat Expert Ltd.)
O4 - HKLM..\Run: [SunJavaUpdateSched] File not found
O4 - Startup: C:\Documents and Settings\Murray Quin\Start Menu\Programs\Startup\Moo0 Magnifier 1.10.lnk = C:\Program Files\Moo0\Magnifier 1.10\Magnifier.exe (Moo0)
O4 - Startup: C:\Documents and Settings\Murray Quin\Start Menu\Programs\Startup\Shortcut to WinDates.exe.lnk = C:\Program Files\WinDates\WinDates.exe (Rockin' Software)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuPinnedList = 1
O7 - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_20.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O15 - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\..Trusted Domains: motive.com ([pattta.att] https in Trusted sites)
O15 - HKU\S-1-5-21-3118275848-1251842026-3893926077-1010\..Trusted Domains: motive.com ([patttbc.att] https in Trusted sites)
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} http://echat.bellsouth.net/sdccommon/download/tgctlcm.cab (Reg Error: Key error.)
O16 - DPF: {0FAA926E-2AF4-11D3-9995-00A0CC3A27A9} http://tcapps.selu.edu/timecentre/Common/pvcombo.cab (Infragistics ComboBox Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} http://h30155.www3.hp.com/ediags/dd/instal…llMgr_v01_5.cab (Reg Error: Key error.)
O16 - DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} http://tcapps.selu.edu/timecentre/Common/iemenu.cab (PopupMenu Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} http://www.sibelius.com/download/software/…tiveXPlugin.cab (ScorchPlugin Class)
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} http://tcapps.selu.edu/viewer/activeXViewe…tivexviewer.cab (Crystal Report Viewer Control)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} file:///C:/Documents%20and%20Settings/Patrick%20Quin/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0C75F722-BA34-4F0E-9CA2-D13847D96EA2}: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/16 05:43:04 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/09/06 19:01:16 | 000,581,120 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Murray Quin\Desktop\OTL.exe
[2011/09/04 10:14:47 | 000,000,000 | –SD | C] – C:\32788R22FWJFW
[2011/09/04 07:54:31 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Murray Quin\Desktop\HijackThis.exe
[2011/09/03 18:11:46 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Murray Quin\Recent
[2011/09/03 16:41:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Murray Quin\Local Settings\Application Data\NPE
[2011/09/03 16:41:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Norton
[2011/09/03 12:29:46 | 000,149,456 | —- | C] (PC Tools) – C:\WINDOWS\SGDetectionTool.dll
[2011/09/03 12:29:45 | 002,029,520 | —- | C] (Threat Expert Ltd.) – C:\WINDOWS\PCTBDCore.dll
[2011/09/03 12:29:44 | 001,533,904 | —- | C] (Threat Expert Ltd.) – C:\WINDOWS\PCTBDRes.dll
[2011/09/03 12:24:14 | 000,656,320 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctEFA.sys
[2011/09/03 12:24:14 | 000,338,880 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctDS.sys
[2011/09/03 12:24:10 | 000,253,096 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctgntdi.sys
[2011/09/03 12:23:57 | 000,263,888 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTCore.sys
[2011/09/03 12:23:57 | 000,160,576 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTAppEvent.sys
[2011/09/03 12:23:51 | 000,233,976 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTSD.sys
[2011/09/03 12:23:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\PC Tools Security
[2011/09/03 12:23:39 | 000,070,664 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctplsg.sys
[2011/09/03 12:23:26 | 000,000,000 | —D | C] – C:\Program Files\PC Tools Security
[2011/09/03 12:23:26 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PC Tools
[2011/09/03 12:20:20 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/09/03 09:58:31 | 001,832,544 | —- | C] (McAfee, Inc.) – C:\Documents and Settings\Murray Quin\Desktop\MCPR.exe
[2011/09/01 17:56:34 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/09/01 17:56:34 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/09/01 17:56:34 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/09/01 17:56:34 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/09/01 17:55:21 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/09/01 17:52:21 | 004,192,529 | R— | C] (Swearware) – C:\Documents and Settings\Murray Quin\Desktop\ComboFix.exe
[2011/09/01 17:51:51 | 000,000,000 | —D | C] – C:\Qoobox
[2011/09/01 17:51:32 | 000,000,000 | R–D | C] – C:\Documents and Settings\Murray Quin\Start Menu\Programs\Administrative Tools
[2011/08/31 18:38:31 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Murray Quin\Recent(3)
[2011/08/11 18:50:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Murray Quin\Desktop\khms
[2011/08/11 18:49:43 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Murray Quin\My Documents\katie
[2005/06/18 19:47:28 | 000,231,258 | —- | C] (克洛奇工作坊) – C:\Program Files\pikachu.exe
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/06 19:08:35 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/09/06 19:08:08 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/09/06 19:07:56 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/09/06 19:07:53 | 536,281,088 | -HS- | M] () – C:\hiberfil.sys
[2011/09/06 19:01:16 | 000,581,120 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Murray Quin\Desktop\OTL.exe
[2011/09/06 18:58:04 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/09/04 07:54:27 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Murray Quin\Desktop\HijackThis.exe
[2011/09/03 18:23:55 | 000,001,580 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Defraggler.lnk
[2011/09/03 18:07:22 | 000,000,740 | —- | M] () – C:\Documents and Settings\Murray Quin\Desktop\Eusing Free Registry Cleaner.lnk
[2011/09/03 17:25:58 | 000,000,209 | RHS- | M] () – C:\boot.ini
[2011/09/03 12:24:24 | 000,686,052 | —- | M] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/09/03 12:23:54 | 000,001,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\PC Tools AntiVirus Free.lnk
[2011/09/02 14:23:34 | 001,832,544 | —- | M] (McAfee, Inc.) – C:\Documents and Settings\Murray Quin\Desktop\MCPR.exe
[2011/09/01 18:49:33 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/09/01 17:46:36 | 004,192,529 | R— | M] (Swearware) – C:\Documents and Settings\Murray Quin\Desktop\ComboFix.exe
[2011/09/01 05:37:08 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2011/08/31 21:06:38 | 000,014,440 | —- | M] () – C:\Documents and Settings\Murray Quin\My Documents\cc_20110831_210632.reg
[2011/08/26 20:00:20 | 000,000,426 | -H– | M] () – C:\Documents and Settings\Murray Quin\My Documents\Memento.notes
[2011/08/21 17:19:49 | 001,448,166 | —- | M] () – C:\Documents and Settings\Murray Quin\Desktop\Algebra _II.pdf
[2011/08/16 19:45:55 | 004,351,869 | —- | M] () – C:\Documents and Settings\Murray Quin\Desktop\witness_20110816-0906a.mp3
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/03 17:35:28 | 536,281,088 | -HS- | C] () – C:\hiberfil.sys
[2011/09/03 12:29:47 | 000,767,952 | —- | C] () – C:\WINDOWS\BDTSupport.dll
[2011/09/03 12:29:46 | 000,000,882 | —- | C] () – C:\WINDOWS\RegSDImport.xml
[2011/09/03 12:29:46 | 000,000,879 | —- | C] () – C:\WINDOWS\RegISSImport.xml
[2011/09/03 12:29:46 | 000,000,131 | —- | C] () – C:\WINDOWS\IDB.zip
[2011/09/03 12:29:45 | 000,002,125 | —- | C] () – C:\WINDOWS\UDB.zip
[2011/09/03 12:23:54 | 000,001,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\PC Tools AntiVirus Free.lnk
[2011/09/01 17:56:34 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/09/01 17:56:34 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/09/01 17:56:34 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/09/01 17:56:34 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/09/01 17:56:34 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/08/31 21:06:35 | 000,014,440 | —- | C] () – C:\Documents and Settings\Murray Quin\My Documents\cc_20110831_210632.reg
[2011/08/16 19:45:41 | 004,351,869 | —- | C] () – C:\Documents and Settings\Murray Quin\Desktop\witness_20110816-0906a.mp3
[2010/09/30 05:06:24 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/02/08 16:52:10 | 000,161,274 | —- | C] () – C:\WINDOWS\Expstudio Audio Editor FREE Uninstaller.exe
[2009/03/07 11:52:41 | 000,000,025 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2008/12/25 18:05:37 | 000,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2008/12/05 21:15:48 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2008/12/05 21:12:15 | 000,005,632 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2008/07/12 16:17:42 | 000,000,160 | —- | C] () – C:\WINDOWS\NetChess.INI
[2008/06/10 19:07:20 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/06/07 22:03:39 | 000,001,160 | —- | C] () – C:\WINDOWS\mozver.dat
[2008/05/22 17:18:54 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/05/17 11:40:20 | 000,000,010 | —- | C] () – C:\WINDOWS\popcinfo.dat
[2008/04/03 17:05:31 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2008/04/03 17:05:22 | 000,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2008/03/14 00:53:22 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\JPeg32.dll
[2008/03/04 18:26:05 | 000,000,120 | —- | C] () – C:\WINDOWS\B&ARROW.INI;
[2007/12/01 08:12:50 | 000,000,621 | —- | C] () – C:\WINDOWS\tlknw3.ini
[2007/11/19 13:11:42 | 000,000,000 | —- | C] () – C:\WINDOWS\eDrawingOfficeAutomator.INI
[2007/11/14 12:42:27 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2007/11/09 06:01:59 | 000,000,164 | —- | C] () – C:\WINDOWS\System32\psyswin32.dll
[2007/11/04 22:10:59 | 000,000,559 | —- | C] () – C:\WINDOWS\System32\Shortcut to sol.exe.lnk
[2007/09/05 18:16:26 | 000,001,351 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/08/12 20:40:53 | 000,000,035 | —- | C] () – C:\WINDOWS\A4W.INI
[2007/07/07 09:55:16 | 000,000,089 | —- | C] () – C:\WINDOWS\fontviewer.ini
[2007/07/03 20:49:08 | 000,000,151 | —- | C] () – C:\WINDOWS\MetroTimer.ini
[2007/07/03 20:47:20 | 000,000,033 | —- | C] () – C:\WINDOWS\UnitConverter.ini
[2007/07/01 18:53:58 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\OctaneARM.dll
[2007/07/01 16:50:33 | 000,007,168 | —- | C] () – C:\Documents and Settings\Murray Quin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/03/15 12:47:48 | 000,053,760 | —- | C] () – C:\WINDOWS\System32\BuEResNT.dll
[2007/01/13 19:24:51 | 000,000,305 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\addr_file.html
[2007/01/13 18:43:50 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\IPPCPUID.DLL
[2007/01/13 18:43:21 | 000,011,776 | —- | C] () – C:\WINDOWS\System32\pmsbfn32.dll
[2007/01/13 18:41:39 | 000,000,419 | —- | C] () – C:\WINDOWS\MAXLINK.INI
[2006/08/06 13:11:09 | 000,003,072 | -H– | C] () – C:\Documents and Settings\Murray Quin\Application Data\dvd.bmk
[2006/07/03 17:57:44 | 000,000,251 | —- | C] () – C:\Program Files\wt3d.ini
[2006/06/17 21:31:01 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/06/17 18:26:37 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\iyvu9_32.dll
[2006/06/17 18:21:46 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2006/06/17 18:13:37 | 000,001,766 | —- | C] () – C:\WINDOWS\ASTBLAST.INI
[2006/06/17 15:31:38 | 000,021,840 | —- | C] () – C:\WINDOWS\System32\SIntfNT.dll
[2006/06/17 15:31:37 | 000,017,212 | —- | C] () – C:\WINDOWS\System32\SIntf32.dll
[2006/06/17 15:31:37 | 000,012,067 | —- | C] () – C:\WINDOWS\System32\SIntf16.dll
[2006/06/17 15:25:47 | 000,000,025 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2006/04/21 21:57:55 | 000,005,642 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2006/04/21 21:57:55 | 000,000,104 | RHS- | C] () – C:\WINDOWS\System32\751EA791A1.sys
[2006/04/10 21:36:29 | 000,000,134 | -H– | C] () – C:\Documents and Settings\Murray Quin\Local Settings\Application Data\fusioncache.dat
[2006/03/06 01:54:10 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/03/06 01:47:11 | 000,000,126 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/03/06 01:43:09 | 000,149,504 | —- | C] () – C:\WINDOWS\UNWISE.EXE
[2006/03/06 01:37:54 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/03/06 01:29:20 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/03/06 01:25:35 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2006/03/06 01:25:35 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2006/03/06 01:25:28 | 000,000,004 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare
[2006/03/06 00:59:24 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\stac97co.dll
[2006/03/06 00:59:22 | 000,000,200 | —- | C] () – C:\WINDOWS\System32\dlbcplc.ini
[2006/03/06 00:59:08 | 000,049,152 | —- | C] () – C:\WINDOWS\setpwrcg.exe
[2006/03/06 00:58:52 | 000,095,617 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2006/03/06 00:58:28 | 000,000,391 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/11/10 09:56:34 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/08/16 05:48:31 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2005/08/16 05:38:45 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2005/08/16 05:37:24 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2005/08/16 05:33:38 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2005/08/16 05:27:59 | 000,340,240 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/08/16 05:18:35 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2005/08/16 05:18:33 | 001,288,192 | —- | C] () – C:\WINDOWS\System32\quartz(2).dll
[2005/08/16 05:18:33 | 000,400,090 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2005/08/16 05:18:33 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2005/08/16 05:18:33 | 000,061,488 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2005/08/16 05:18:33 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2005/08/16 05:18:32 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2005/08/16 05:18:30 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/08/16 05:18:28 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2005/08/16 05:18:23 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2005/08/16 05:18:23 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2005/08/16 05:18:15 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2005/08/16 05:18:08 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2005/08/05 15:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/01/07 16:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/12/01 16:34:46 | 000,001,024 | —- | C] () – C:\WINDOWS\System32\atsdrve.dll

========== LOP Check ==========

[2011/09/01 05:37:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/10/30 08:47:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2010/10/01 22:41:47 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2005/08/16 21:54:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DIGStream
[2010/02/18 19:08:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2010/10/01 22:38:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2010/02/06 15:13:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2008/07/11 20:34:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NeoEdge Networks
[2006/07/03 17:57:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Otto
[2010/08/18 17:39:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Renaissance Learning
[2007/01/13 18:41:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2010/02/18 19:08:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SMART Technologies
[2011/09/06 19:08:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2007/09/22 08:45:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/12/20 00:24:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2006/12/17 16:11:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Margaret Quin\Application Data\Leadertech
[2010/10/01 22:44:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\AVG10
[2007/01/13 20:06:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\Canon
[2007/01/14 13:26:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\COWON
[2007/07/03 17:26:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\ESBCalc
[2007/06/29 18:16:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\Inspiration Software
[2009/04/16 12:23:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\IObit
[2008/06/23 07:26:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\JAM Software
[2008/06/08 10:16:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\Launchy
[2009/04/13 07:12:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\Leadertech
[2007/07/06 08:50:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\Memento
[2007/01/14 12:16:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\NewSoft
[2008/12/06 14:11:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\Samsung
[2007/01/13 18:41:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\ScanSoft
[2010/02/18 19:15:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\SMART Technologies
[2010/02/18 18:44:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\SMART Technologies Inc
[2008/07/13 13:34:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\Uniblue
[2007/09/22 08:45:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\Viewpoint
[2008/01/23 20:53:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Murray Quin\Application Data\wsInspector
[2008/06/07 21:14:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Patrick Quin\Application Data\Launchy
[2008/06/07 23:20:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Patrick Quin\Application Data\Opera
[2006/07/03 17:57:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Patrick Quin\Application Data\Otto
[2008/12/05 21:28:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Patrick Quin\Application Data\Samsung
[2011/09/06 19:06:53 | 000,032,600 | —- | M] () – C:\WINDOWS\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 148 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:430C6D84
@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7E95B6FD

< End of report >

amitemurray

Post #11September 7, 2011, 12:19 AM UTC

Here's the Extras.txt
OTL Extras logfile created on: 9/6/2011 7:09:16 PM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Documents and Settings\Murray Quin\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.37 Mb Total Physical Memory | 222.75 Mb Available Physical Memory | 43.56% Memory free
1.22 Gb Paging File | 0.99 Gb Available in Paging File | 81.16% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 32.55 Gb Total Space | 11.57 Gb Free Space | 35.56% Space Free | Partition Type: NTFS

Computer Name: DCCB7L91 | User Name: Murray Quin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-3118275848-1251842026-3893926077-1010\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04DB4871-BC1D-44BF-AADB-47326365EB8C}" = Opera 9.27
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{075473F5-846A-448B-BCB3-104AA1760205}" = Roxio RecordNow Data
"{0A0719F0-AD56-42BA-B68C-EFFC330B6F13}" = SMART Notebook
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{0FAAA044-04CF-4766-84A2-A6A95CE196BD}" = Samsung PC Studio 3
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4803" = CanoScan 4400F
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Roxio DLA
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F528948-0E80-4C96-B455-DE4167CB1DF7}" = Internal Network Card Power Management
"{2070F79D-46BC-4EEA-8F02-9B4DCABAE7CB}" = iPod for Windows 2006-03-23
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Roxio MyDVD LE
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{29D851C2-048C-4B5E-8D1F-25D473342BB5}" = ScanSoft OmniPage SE 4.0
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{307B9D04-A1F4-48EA-809C-DF7FA9C4BB6D}" = Presto! PageManager 7.15.13
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{4245C022-0A7C-436D-99A8-50D6549260CF}" = ML Geo Test Gen
"{43CAC9A1-1993-4F65-9096-7C9AFC2BBF54}" = Dell CinePlayer
"{4667B940-BB01-428B-986E-A0CC46497BF7}" = ELIcon
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5B6BE547-21E2-49CA-B2E2-6A5F470593B1}" = Sonic Activation Module
"{5EAE9465-BBEE-4C33-8A87-49A8380F9897}" = PhotoVidShow
"{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon
"{64A77F14-0E08-4A97-A859-E93CFF428756}" = Broadcom Management Programs 2
"{66563AD8-637B-407F-BCA7-0233A16891AB}" = Business Contact Manager for Outlook 2003
"{6845255F-15CC-4DD1-94D5-D38F370118B3}_is1" = Auslogics Duplicate File Finder
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B8512B9-A3FC-42BB-B782-A77874B87CC2}" = eDrawings 2008
"{6D5FCA42-1486-4E32-AFE8-1B7E2AA59D33}" = Digital Content Portal
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{98736A65-3C79-49EC-B7E9-A3C77774B0E6}" = Google SketchUp 6
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A683A2C0-821C-486F-858C-FA634DB5E864}" = EducateU
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Roxio RecordNow Audio
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.5
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Roxio RecordNow Copy
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B3D8B2F8-3C2C-45BC-933E-8B60E78F6684}" = Google SketchUp 6
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B639110D-747F-40DC-9682-95D94EF73790}" = dj_sf_software
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C8E4455F-0F70-4DA2-A9F9-2D56C80E10AD}" = Sibelius Scorch (ActiveX Only)
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{DAF8B012-D559-4B8D-95C0-D98E1172E5C3}" = My Wal-Mart Digital Photo Center
"{DF6A589A-7A1A-430C-9FF2-A0BDB42669DC}" = Google
"{E4144962-A9C5-4898-9252-ED59BC5A4F15}" = Geo CS Test Gen
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"6194C28A8F62DD817EA1B918E6E46E806A21B452" = Windows Driver Package - MobileTop (sshpmdm) Modem (02/23/2007 2.5.0.0)
"65B6FE5418CE28F4D72543FB2D964C3CEC83F161" = Windows Driver Package - MobileTop (sshpusb) USB (02/23/2007 2.5.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"ATI Display Driver" = ATI Display Driver
"Atomic Clock Sync" = Atomic Clock Sync
"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto
"BackgroundCMD" = BackgroundCMD Shell Extension
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"Browser Defender_is1" = Browser Defender 3.0
"Burn4Free" = Burn4Free CD and DVD
"Canon CanoScan 4400F User Registration" = Canon CanoScan 4400F User Registration
"CanoScan Toolbox 5.0" = Canon CanoScan Toolbox 5.0
"CCleaner" = CCleaner
"CNXT_MODEM_PCI_VEN_8086&DEV_24x6&SUBSYS_542214F1" = Conexant D110 MDC V.9x Modem
"Cool Timer_is1" = Cool Timer 3.6
"Defraggler" = Defraggler
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"Easy Video Downloader_is1" = Easy Video Downloader v. 1.2
"EmeraldQFE2" = Windows Media Player 10 Hotfix [See EmeraldQFE2 for more information]
"ESPNMotion" = ESPNMotion
"Eusing Free Registry Cleaner" = Eusing Free Registry Cleaner
"Expstudio Audio Editor FREE" = Expstudio Audio Editor FREE
"FastStone Photo Resizer" = FastStone Photo Resizer 2.7
"Free Internet Eraser_is1" = Free Internet Eraser 3.0
"Free Registry Defrag_is1" = Free Registry Defrag
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{2070F79D-46BC-4EEA-8F02-9B4DCABAE7CB}" = iPod for Windows 2006-03-23
"InstallShield_{4245C022-0A7C-436D-99A8-50D6549260CF}" = ML Geo Test Gen
"InstallShield_{64A77F14-0E08-4A97-A859-E93CFF428756}" = Broadcom Management Programs 2
"InstallShield_{E4144962-A9C5-4898-9252-ED59BC5A4F15}" = Geo CS Test Gen
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Moo0 Magnifier" = Moo0 Magnifier 1.10
"Mozilla Firefox 6.0.1 (x86 en-US)" = Mozilla Firefox 6.0.1 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Solero Music Viewer_is1" = Solero Music Viewer
"Speccy" = Speccy
"Spyware Doctor" = PC Tools AntiVirus Free 8.0
"StreetPlugin" = Learn2 Player (Uninstall Only)
"TreeSize Free_is1" = TreeSize Free V2.2.1
"Tweak UI 2.10" = Tweak UI
"V3.1_is1" = File Scavenger 3.1
"ViceVersa FREE_is1" = ViceVersa Free 1.0.5
"ViewpointMediaPlayer" = Viewpoint Media Player
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Customizations" = Yahoo! Browser Services
"Yahoo! Internet Mail" = Yahoo! Internet Mail

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3118275848-1251842026-3893926077-1010\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9/1/2011 9:41:21 PM | Computer Name = DCCB7L91 | Source = Media Center Scheduler | ID = 0
Description =

Error - 9/2/2011 7:01:28 AM | Computer Name = DCCB7L91 | Source = Media Center Scheduler | ID = 0
Description =

Error - 9/3/2011 11:04:30 AM | Computer Name = DCCB7L91 | Source = Media Center Scheduler | ID = 0
Description =

Error - 9/3/2011 5:45:50 PM | Computer Name = DCCB7L91 | Source = Media Center Scheduler | ID = 0
Description =

Error - 9/3/2011 6:35:41 PM | Computer Name = DCCB7L91 | Source = Media Center Scheduler | ID = 0
Description =

Error - 9/3/2011 7:26:34 PM | Computer Name = DCCB7L91 | Source = Media Center Scheduler | ID = 0
Description =

Error - 9/4/2011 9:00:47 AM | Computer Name = DCCB7L91 | Source = Media Center Scheduler | ID = 0
Description =

Error - 9/4/2011 11:20:06 AM | Computer Name = DCCB7L91 | Source = Media Center Scheduler | ID = 0
Description =

Error - 9/5/2011 8:16:55 PM | Computer Name = DCCB7L91 | Source = Application Error | ID = 1000
Description = Faulting application Update.exe, version 7.0.0.106, faulting module
kernel32.dll, version 5.1.2600.5781, fault address 0x00012afb.

Error - 9/6/2011 8:08:16 PM | Computer Name = DCCB7L91 | Source = Media Center Scheduler | ID = 0
Description =

[ System Events ]
Error - 9/6/2011 7:49:27 PM | Computer Name = DCCB7L91 | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 9/6/2011 7:49:27 PM | Computer Name = DCCB7L91 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 9/6/2011 7:55:20 PM | Computer Name = DCCB7L91 | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 9/6/2011 7:55:20 PM | Computer Name = DCCB7L91 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 15 minutes. NtpClient has no source of accurate
time.

Error - 9/6/2011 7:55:24 PM | Computer Name = DCCB7L91 | Source = PSched | ID = 14103
Description = QoS [Adapter {7975319B-FEFF-4C82-BAF7-944726655610}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 9/6/2011 7:55:25 PM | Computer Name = DCCB7L91 | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 9/6/2011 7:55:25 PM | Computer Name = DCCB7L91 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 15 minutes. NtpClient has no source of accurate
time.

Error - 9/6/2011 7:55:25 PM | Computer Name = DCCB7L91 | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 9/6/2011 7:55:25 PM | Computer Name = DCCB7L91 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 15 minutes. NtpClient has no source of accurate
time.

Error - 9/6/2011 8:03:09 PM | Computer Name = DCCB7L91 | Source = Service Control Manager | ID = 7034
Description = The PC Tools Security Service service terminated unexpectedly. It
has done this 1 time(s).

< End of report >

oldman960

Post #12September 7, 2011, 1:12 AM UTC

Hi amitemurray,

Well clean up the folders from some antivirus programs you have tried then install a new one.

Are you certain all the items that were previously missing have been restored? Click your start button, highlight All programs, do you see the list of programs?

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Reg

:Services
McAWFwk

:Files
C:\Documents and Settings\All Users\Application Data\Norton
C:\Documents and Settings\Murray Quin\Local Settings\Application Data\NPE
C:\Documents and Settings\All Users\Desktop\PC Tools AntiVirus Free.lnk
C:\Documents and Settings\All Users\Application Data\Alwil Software
C:\Documents and Settings\All Users\Application Data\AVG10


:Commands
[createrestorepoint]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.
Reboot your computer

Please post the OTL fix log.

Avast
Help and support can be found here Avast Forum
AVG
Help and support can be found here AVG Forum
Antivir PersonalEditionClassic
Help and support can be found here Avira Personal Support Forum
Microsoft Security Essentials
Support

Please post back with the OTL fix log.

Thanks

amitemurray

Post #13September 7, 2011, 1:38 AM UTC

Hi oldman960, When I highlight All Programs, not only do I see my complete list of programs, but also some that weren't there before, such as Windows Catalog, and Windows Catalog (2). Here is the OTL fix log. ========== REGISTRY ========== ========== SERVICES/DRIVERS ========== Service McAWFwk stopped successfully! Service McAWFwk deleted successfully! ========== FILES ========== C:\Documents and Settings\All Users\Application Data\Norton\{086A63F0-6B13-4F29-9695-134E7A01E963} folder moved successfully. C:\Documents and Settings\All Users\Application Data\Norton\NPE folder moved successfully. C:\Documents and Settings\All Users\Application Data\Norton folder moved successfully. C:\Documents and Settings\Murray Quin\Local Settings\Application Data\NPE\LocalDumps folder moved successfully. C:\Documents and Settings\Murray Quin\Local Settings\Application Data\NPE\ErrorInstances\BD92500D folder moved successfully. C:\Documents and Settings\Murray Quin\Local Settings\Application Data\NPE\ErrorInstances folder moved successfully. C:\Documents and Settings\Murray Quin\Local Settings\Application Data\NPE\ErrMgmt\Tasks folder moved successfully. C:\Documents and Settings\Murray Quin\Local Settings\Application Data\NPE\ErrMgmt\Queue\Staging folder moved successfully. C:\Documents and Settings\Murray Quin\Local Settings\Application Data\NPE\ErrMgmt\Queue\Incoming folder moved successfully. C:\Documents and Settings\Murray Quin\Local Settings\Application Data\NPE\ErrMgmt\Queue folder moved successfully. C:\Documents and Settings\Murray Quin\Local Settings\Application Data\NPE\ErrMgmt folder moved successfully. C:\Documents and Settings\Murray Quin\Local Settings\Application Data\NPE folder moved successfully. C:\Documents and Settings\All Users\Desktop\PC Tools AntiVirus Free.lnk moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\sounds\1033 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\sounds folder moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\report folder moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\moved folder moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\log folder moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\journal folder moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\integ folder moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\HtmlData folder moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\fw folder moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\chest folder moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\backup folder moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\arpot\TEMP folder moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\arpot folder moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Alwil Software folder moved successfully. C:\Documents and Settings\All Users\Application Data\AVG10\SetupBackup folder moved successfully. C:\Documents and Settings\All Users\Application Data\AVG10\scanlogs folder moved successfully. C:\Documents and Settings\All Users\Application Data\AVG10\log folder moved successfully. C:\Documents and Settings\All Users\Application Data\AVG10\Chjw\501080d61080c506 folder moved successfully. C:\Documents and Settings\All Users\Application Data\AVG10\Chjw folder moved successfully. C:\Documents and Settings\All Users\Application Data\AVG10\cfgall folder moved successfully. C:\Documents and Settings\All Users\Application Data\AVG10\Cfg folder moved successfully. C:\Documents and Settings\All Users\Application Data\AVG10 folder moved successfully. ========== COMMANDS ========== Restore point Set: OTL Restore Point (0) OTL by OldTimer - Version 3.2.27.0 log created on 09062011_203141

oldman960

Post #14September 7, 2011, 3:47 AM UTC last edited September 7, 2011, 3:48 AM UTC

Hi amitemurray,

Ok the Windows Catalogue is normal. It's a link to products made for Windows.

Let's do a couple of scans and see if there is anything left. Are you experiencing any problems with the computer?

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

Click the Update tab
Click Check for Updates
If an update is found, it will download and install the latest version.
The program will close to update and reopen.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Next

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
Click Start
Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
Click Scan.
Wait for the scan to finish.
Re-enable your Antivirus software.
A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txtWe will need this later.

Please post back with the ESET log.

Please post back with

MBAM log
ESET log

Thanks

amitemurray

Post #15September 7, 2011, 10:53 AM UTC

Hi oldman960, I was just about to tell you I am not experiencing any problems, when the computer suddenly went to the Blue Screen of Death, and showed this error message: "PFN_LIST_CORRUPT". It went on about a memory dump, and told me to restart. I did, and now I can't load MBAM! I'm getting this message from Malwarebytes: "PROGRAM_ERROR_LOAD_DATABASE(0, 13, CreateSDK). I haven't run ESET yet. Thanks.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Hidden Desktop

✨ Ask AI

Ask AI