What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Bearshare issues

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17
Hi dreux,

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield
  • Do not copy the word CODE , please note the script starts with the :
    :filefind
Bearshare.*
:folderfind
Bearshare
:regfind
Bearshare
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #18
Hi oldman960, here is the SystemLook result that showed up in notepad: SystemLook 30.07.11 by jpshortstuff Log created at 00:18 on 21/09/2011 by Owner Administrator - Elevation successful ========== filefind ========== Searching for "Bearshare.*" No files found. ========== folderfind ========== Searching for "Bearshare" C:\Documents and Settings\Owner\My Documents\My Music\BearShare d—— [04:20 04/09/2011] ========== regfind ========== Searching for "Bearshare" No data found. -= EOF =-
Post #19 last edited
Hi dreux,

Please delete this folder C:\Documents and Settings\Owner\My Documents\My Music\BearShare

Next

Close FireFox and reopen it like this
  • click your start button and hilight All programs
  • hilight Mozillz FireFox
  • click Mozilla FireFox (save mode)
Does the problem still exist?

Thanks
Post #20
Hi oldman960, I deleted that file and then reopened firefox as dexcribed but I did not see the (save mode) in the last line. I tried right clicking but that didn't work. so I tried the main search screen and got the usual result, the bearshare screen shows up. I rebooted and got the same thing. then I got curious and used search to find firefox and found this: FirefoxExtension which is a File Folder. the name is: C:\Program Files\BearShare Applications\MediaBar\Datamngr under date modifed it shows: 9/4/2011 10:59 AM I think I accessed bearshare late the previous night, around 11 pm, not in the morning. I did find this with windows explorer too. Datamngr has two forders, Firefox Extension and ToolBar(2). I'm not going to delete anything at this point until instructed to.
Post #21 last edited
Hi dreux,

Thanks for the info. We'll remove the folder and the other folder that contains the shockwave file.

click Mozilla FireFox (save mode)

That should have been Mozilla FireFox (safe mode), which is just a way of running FireFox without any addons.

Seems they changed it a bit in the newer versions.

In Firefox click on Help and select Restart with Add-ons Disabled .Firefox should now open in what is called safe mode. You should recieve a warning, please press the button Continue in Safe Mode. Try doing the search from the addressbar again. This will tell us if there is an addon associated with the problem.

Next, Double click on OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:Files
C:\Program Files\BearShare Applications
C:\Documents and Settings\All Users\Application Data\29290\

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.

Let me know how you make out.

Thanks
Post #22
Hi oldman960, I thought you meant safe instead of save but I wasn't sure. I did open firefox in the safe mode and used the addressbar for a search and didn't see the bearshare icon. by the way, I don't usually use the address bar for a search, so that's new to me. I tried using the search field in the middle of screen and the bearshare search page shows up. I ran OTL.exe as prescribed and here is the log file: ========== SERVICES/DRIVERS ========== ========== FILES ========== C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\components folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\searchbar folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\options folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\weatherbutton\panels\images folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\weatherbutton\panels folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\weatherbutton\icons folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\weatherbutton folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\uwa folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\radio\images folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\radio\css folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\radio folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\panels\images folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\panels\default\scripts folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\panels\default\images folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\panels\default\css folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\panels\default folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\panels\css folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\panels folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.PPCBully folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\scripts folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\css folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook\js folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook\images folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook\css folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\scripts folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\images folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\css folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2\skin folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2\js folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2\images folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2\css folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2 folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\com.djboxservice.dj.DJBox\thumbs folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\com.djboxservice.dj.DJBox folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\modules folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\lib folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\data\search folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\data folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2) folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\FirefoxExtension\content folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\FirefoxExtension\components folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr\FirefoxExtension folder moved successfully. C:\Program Files\BearShare Applications\MediaBar\Datamngr folder moved successfully. C:\Program Files\BearShare Applications\MediaBar folder moved successfully. C:\Program Files\BearShare Applications folder moved successfully. C:\Documents and Settings\All Users\Application Data\29290 folder moved successfully. OTL by OldTimer - Version 3.2.27.0 log created on 09222011_004256 by the way, I first was directed by avast to open OTL in a sandbox, which I did, and that did not generate a log file. I redid it by opening it normally and that produced the log file above. thanks
Post #23 last edited
Hi dreux,

I tried using the search field in the middle of screen and the bearshare search page shows up.

Seems we have the address bar and the google search box sorted out. Can you post a screenshot so I can see the search box you are having problems with.

Thanks
Post #24
Hi oldman960, I'm not sure why but youtube does not work in firefox now. neither do graphics like stock charts. I was informed that I needed to download the latest adobe app for these functions in firefox. this just happened in the last couple of days. this is exclusive to firefox, not internet explorer, so those functions are available there. I'm attaching two screenshots. the first is the firefox home page. the second is the bearshare search screen that shows up when I enter a value in the main search field in the middle of the firefox home screen. if this isn't successful please let me know. thanks

Attachments:

Post #25
Hi dreux,

The 2 screenshots look the same to me unless I'm missing something.

Let's see if we can find where bearshare search is coming from.

Please rerun OTL and get a new scan log. Make sure the box beside scan all users is checked.

We'll see what we can do about uTube after we remove bearshare.

Thanks
Post #26
Hi oldman960,

no, you didn't miss anything, I sent the same screenshot for both attachments. I resent the correct bearshare screenshot. you can see the bearshare icon at the left end of the address bar and the field right above ir.

I ran the OTL scan with the scan all users checked, as well as LOP check and Purity Check boxes checked. here is that log:

OTL logfile created on: 9/24/2011 12:37:51 AM - Run 2
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Documents and Settings\Owner\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.29 Gb Available Physical Memory | 64.77% Memory free
3.84 Gb Paging File | 3.29 Gb Available in Paging File | 85.73% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 57.01 Gb Free Space | 76.50% Space Free | Partition Type: NTFS

Computer Name: OWNER-D67H3 | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Documents and Settings\Owner\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)
PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
PRC - C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Dell Inc.)
PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\hidfind.exe (Alps Electric Co., Ltd.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Alwil Software\Avast5\defs\11092301\algo.dll ()
MOD - C:\Program Files\Alwil Software\Avast5\defs\11092301\aswRep.dll ()
MOD - C:\Program Files\Alwil Software\Avast5\defs\11092300\algo.dll ()
MOD - C:\Program Files\Alwil Software\Avast5\defs\11092300\aswRep.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
MOD - C:\Program Files\Dell\QuickSet\dadkeyb.dll ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (NMSAccess) – C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (NICCONFIGSVC) – C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Dell Inc.)


========== Driver Services (SafeList) ==========

DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (StarOpen) – C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (w29n51) Intel® – C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (GTIPCI21) – C:\WINDOWS\system32\drivers\gtipci21.sys (Texas Instruments)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (APPDRV) – C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.SYS (Conexant Systems, Inc.)
DRV - (HSFHWICH) – C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (STAC97) – C:\WINDOWS\system32\drivers\STAC97.sys (SigmaTel, Inc.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 2C 11 42 68 05 B4 CB 01 [binary data]
IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "http://www.google.com/search?ie=UTF-8&sourceid=navclient&gfns=1&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011/09/22 01:07:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/07 09:18:55 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/13 23:56:16 | 000,000,000 | —D | M]

[2011/09/13 17:01:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2011/09/07 10:45:43 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\l3m6oc5z.default\extensions
[2011/01/29 14:33:30 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\l3m6oc5z.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/09/03 23:20:28 | 000,002,507 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\l3m6oc5z.default\searchplugins\SearchResults.xml
[2011/09/13 17:01:31 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/01/28 01:40:02 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/28 01:57:57 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/03/07 15:59:19 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/06/21 23:54:12 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/09/07 09:18:55 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/05/04 04:52:23 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/08/30 14:41:02 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/09/03 23:20:28 | 000,002,507 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\SearchResults.xml

O1 HOSTS File: ([2004/08/04 04:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
O4 - HKU\S-1-5-21-583907252-861567501-1801674531-500..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{13C53539-FD1B-4735-B970-B68FCA0CCC19}: DhcpNameServer = 192.168.1.1 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{29CA763A-BC94-4B50-A823-0D2C7359BB90}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2A1AB345-B17F-4FD1-99DF-101DE26E158A}: DhcpNameServer = 10.0.0.5 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5989D1B5-155C-4AE8-9430-3EE806A9816E}: DhcpNameServer = 10.0.0.5 [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/02/23 14:37:29 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/09/22 01:04:57 | 000,000,000 | —D | C] – C:\Program Files\BearShare Applications
[2011/09/07 10:45:37 | 000,000,000 | —D | C] – C:\_OTL
[2011/09/05 00:35:15 | 000,000,000 | —D | C] – C:\WINDOWS\CSC
[2011/09/04 10:40:53 | 000,000,000 | —D | C] – C:\Config.Msi
[2011/09/04 10:31:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2011/09/03 23:20:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\29290
[2011/09/03 23:20:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\mediabarbs
[2011/09/03 23:20:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\My Received Files

========== Files - Modified Within 30 Days ==========

[2011/09/24 00:25:00 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/09/24 00:23:38 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/09/22 01:12:01 | 000,001,700 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/09/22 01:11:52 | 000,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2011/09/06 23:58:22 | 000,000,491 | —- | M] () – C:\Documents and Settings\Owner\Desktop\MBR.zip
[2011/09/06 23:56:52 | 000,000,512 | —- | M] () – C:\Documents and Settings\Owner\Desktop\MBR.dat
[2011/09/06 15:45:29 | 000,199,304 | —- | M] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2011/09/06 15:45:29 | 000,041,184 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2011/09/06 15:38:05 | 000,442,200 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2011/09/06 15:37:53 | 000,320,856 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2011/09/06 15:36:38 | 000,034,392 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/09/06 15:36:36 | 000,052,568 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/09/06 15:36:23 | 000,110,552 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/09/06 15:36:20 | 000,104,536 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2011/09/06 15:36:12 | 000,020,568 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/09/06 15:33:11 | 000,030,808 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/09/04 11:24:59 | 000,000,742 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/09/04 11:24:59 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/09/04 10:45:16 | 000,110,992 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/09/03 22:02:10 | 000,433,270 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/09/03 22:02:10 | 000,068,060 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/09/03 21:59:02 | 000,001,355 | —- | M] () – C:\WINDOWS\imsins.BAK

========== Files Created - No Company Name ==========

[2011/09/06 23:58:22 | 000,000,491 | —- | C] () – C:\Documents and Settings\Owner\Desktop\MBR.zip
[2011/09/06 23:56:52 | 000,000,512 | —- | C] () – C:\Documents and Settings\Owner\Desktop\MBR.dat
[2011/01/27 23:36:32 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/03/23 14:30:43 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2009/03/11 14:10:38 | 000,168,448 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/02/23 15:41:58 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\stac97co.dll
[2009/02/23 14:37:55 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/02/23 14:33:51 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/02/23 07:06:22 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2009/02/23 07:05:03 | 000,110,992 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/04/14 06:55:28 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2006/12/31 08:57:08 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2005/03/21 17:48:05 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/21 17:48:05 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 04:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 04:00:00 | 000,433,270 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 04:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 04:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 04:00:00 | 000,068,060 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 04:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 04:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 04:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2011/09/03 23:20:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\29290
[2011/01/27 23:44:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2011/09/04 10:31:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2011/04/23 01:30:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\LeapingBrain
[2011/09/04 10:59:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mediabarbs

========== Purity Check ==========



< End of report >


I hope everything is correct, if not let me know.

thanks

Attachments:

Post #27
Hi dreux,

Ok let's see if we can get it this time.

Next, Double click on OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:OTL
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.order.1: "Web Search"

:Reg

:Files
C:\Program Files\BearShare Applications
C:\Documents and Settings\All Users\Application Data\29290
C:\Documents and Settings\Owner\Application Data\mediabarbs

:Commands

[emptytemp]
[createrestorepoint]
[Reboot]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.
Please post the OTL fix log.

Next

Open FireFox
  • In the address bar (not the search field) type about:config and hit enter. When the window opens click "I promise to be careful"
  • Scroll down to browser.search,defaultenginename,
    • if the value is blank right click and click reset
    • if it has anything other than Google in it, right click and click modify
    • type Google and click ok
  • scroll down to browser.search.order.1
    • if the value is blank right click and click reset
    • if it has anything other than Google in it, right click and click modify
    • type Google and click ok
  • scroll down to browser.search.searchenginesURL
  • right click and click reset

Next reboot your computer. After the computer has restarted get a new OTL scan log.

Please post back with
  • OTL fix log
  • OTL.txt
How is the search now?
Post #28
Hi oldman960,

I tried the search field in the center of the screen and still got the bearshare search screen. I think it might have to do with the fact that I could not reset the value for browser.search.searchenginesURL. the reset option was dim and therefor not availbale. the value shown is as follows:

https://addons.mozilla.org/%LOCALE%/firefox/search-engines

here is the OTl fix log:


All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Prefs.js: "Web Search" removed from browser.search.defaultenginename
Prefs.js: "Web Search" removed from browser.search.order.1
========== REGISTRY ==========
========== FILES ==========
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\components folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\searchbar folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\options folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\weatherbutton\panels folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\weatherbutton\icons folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\weatherbutton folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\uwa folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\radio\images folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\radio\css folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\radio folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\panels\images folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\panels\default\scripts folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\panels\default\images folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\panels\default\css folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\panels\default folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\panels\css folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib\panels folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin\lib folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\skin folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.PPCBully folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\scripts folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\css folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook\js folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook\images folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook\css folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.MyStartFacebook folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\scripts folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\images folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\css folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2\skin folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2\js folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2\images folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2\css folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\net.vmn.www.Coupons_v2 folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\com.djboxservice.dj.DJBox\thumbs folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets\com.djboxservice.dj.DJBox folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\widgets folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\modules folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\lib folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\data\search folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content\data folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome\content folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2)\chrome folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar(2) folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\FirefoxExtension\content folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\FirefoxExtension\components folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr\FirefoxExtension folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar\Datamngr folder moved successfully.
C:\Program Files\BearShare Applications\MediaBar folder moved successfully.
C:\Program Files\BearShare Applications folder moved successfully.
C:\Documents and Settings\All Users\Application Data\29290 folder moved successfully.
C:\Documents and Settings\Owner\Application Data\mediabarbs\weather folder moved successfully.
C:\Documents and Settings\Owner\Application Data\mediabarbs\coupons folder moved successfully.
C:\Documents and Settings\Owner\Application Data\mediabarbs folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Owner
->Temp folder emptied: 600828 bytes
->Temporary Internet Files folder emptied: 79141755 bytes
->Java cache emptied: 12604 bytes
->FireFox cache emptied: 38136791 bytes
->Flash cache emptied: 10469 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16867 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 4098150 bytes

Total Files Cleaned = 116.00 mb

Restore point Set: OTL Restore Point (0)

OTL by OldTimer - Version 3.2.27.0 log created on 09242011_175151

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF74F8.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF751E.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF75D5.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF75EE.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF7882.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF78E5.tmp not found!
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\SHEA5EQI\ads[5].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\SHEA5EQI\ads[6].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\SHEA5EQI\like[3].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\QVI291G3\ads[3].htm moved successfully.OTL logfile created on: 9/24/2011 6:22:32 PM - Run 3
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Documents and Settings\Owner\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.58 Gb Available Physical Memory | 79.36% Memory free
3.84 Gb Paging File | 3.58 Gb Available in Paging File | 93.28% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 57.50 Gb Free Space | 77.15% Space Free | Partition Type: NTFS

Computer Name: OWNER-D67H3 | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
PRC - C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Dell Inc.)
PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\hidfind.exe (Alps Electric Co., Ltd.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Alwil Software\Avast5\defs\11092401\algo.dll ()
MOD - C:\Program Files\Alwil Software\Avast5\defs\11092401\aswRep.dll ()
MOD - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
MOD - C:\Program Files\Dell\QuickSet\dadkeyb.dll ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (NMSAccess) – C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (NICCONFIGSVC) – C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Dell Inc.)


========== Driver Services (SafeList) ==========

DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (StarOpen) – C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (w29n51) Intel® – C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (GTIPCI21) – C:\WINDOWS\system32\drivers\gtipci21.sys (Texas Instruments)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (APPDRV) – C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.SYS (Conexant Systems, Inc.)
DRV - (HSFHWICH) – C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (STAC97) – C:\WINDOWS\system32\drivers\STAC97.sys (SigmaTel, Inc.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 2C 11 42 68 05 B4 CB 01 [binary data]
IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "http://www.google.com/search?ie=UTF-8&sourceid=navclient&gfns=1&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011/09/22 01:07:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/07 09:18:55 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/13 23:56:16 | 000,000,000 | —D | M]

[2011/09/13 17:01:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2011/09/07 10:45:43 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\l3m6oc5z.default\extensions
[2011/01/29 14:33:30 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\l3m6oc5z.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/09/03 23:20:28 | 000,002,507 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\l3m6oc5z.default\searchplugins\SearchResults.xml
[2011/09/13 17:01:31 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/01/28 01:40:02 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/28 01:57:57 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/03/07 15:59:19 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/06/21 23:54:12 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/09/07 09:18:55 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/05/04 04:52:23 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/08/30 14:41:02 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/09/03 23:20:28 | 000,002,507 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\SearchResults.xml

O1 HOSTS File: ([2004/08/04 04:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
O4 - HKU\S-1-5-21-583907252-861567501-1801674531-500..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{13C53539-FD1B-4735-B970-B68FCA0CCC19}: DhcpNameServer = 192.168.1.1 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{29CA763A-BC94-4B50-A823-0D2C7359BB90}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2A1AB345-B17F-4FD1-99DF-101DE26E158A}: DhcpNameServer = 10.0.0.5 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5989D1B5-155C-4AE8-9430-3EE806A9816E}: DhcpNameServer = 10.0.0.5 [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/02/23 14:37:29 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/09/24 03:31:53 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Owner\IECompatCache
[2011/09/07 10:45:37 | 000,000,000 | —D | C] – C:\_OTL
[2011/09/05 00:35:15 | 000,000,000 | —D | C] – C:\WINDOWS\CSC
[2011/09/04 10:40:53 | 000,000,000 | —D | C] – C:\Config.Msi
[2011/09/04 10:31:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2011/09/03 23:20:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\My Received Files

========== Files - Modified Within 30 Days ==========

[2011/09/24 18:20:24 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/09/24 18:19:06 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/09/22 01:12:01 | 000,001,700 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/09/22 01:11:52 | 000,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2011/09/06 23:58:22 | 000,000,491 | —- | M] () – C:\Documents and Settings\Owner\Desktop\MBR.zip
[2011/09/06 23:56:52 | 000,000,512 | —- | M] () – C:\Documents and Settings\Owner\Desktop\MBR.dat
[2011/09/06 15:45:29 | 000,199,304 | —- | M] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2011/09/06 15:45:29 | 000,041,184 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2011/09/06 15:38:05 | 000,442,200 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2011/09/06 15:37:53 | 000,320,856 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2011/09/06 15:36:38 | 000,034,392 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/09/06 15:36:36 | 000,052,568 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/09/06 15:36:23 | 000,110,552 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/09/06 15:36:20 | 000,104,536 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2011/09/06 15:36:12 | 000,020,568 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/09/06 15:33:11 | 000,030,808 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/09/04 11:24:59 | 000,000,742 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/09/04 11:24:59 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/09/04 10:45:16 | 000,110,992 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/09/03 22:02:10 | 000,433,270 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/09/03 22:02:10 | 000,068,060 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/09/03 21:59:02 | 000,001,355 | —- | M] () – C:\WINDOWS\imsins.BAK

========== Files Created - No Company Name ==========

[2011/09/06 23:58:22 | 000,000,491 | —- | C] () – C:\Documents and Settings\Owner\Desktop\MBR.zip
[2011/09/06 23:56:52 | 000,000,512 | —- | C] () – C:\Documents and Settings\Owner\Desktop\MBR.dat
[2011/01/27 23:36:32 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/03/23 14:30:43 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2009/03/11 14:10:38 | 000,168,448 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/02/23 15:41:58 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\stac97co.dll
[2009/02/23 14:37:55 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/02/23 14:33:51 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/02/23 07:06:22 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2009/02/23 07:05:03 | 000,110,992 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/04/14 06:55:28 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2006/12/31 08:57:08 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2005/03/21 17:48:05 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/21 17:48:05 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 04:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 04:00:00 | 000,433,270 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 04:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 04:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 04:00:00 | 000,068,060 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 04:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 04:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 04:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2011/01/27 23:44:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2011/09/04 10:31:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2011/04/23 01:30:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\LeapingBrain

========== Purity Check ==========



< End of report >

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\QVI291G3\ads[4].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\QVI291G3\iframe[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\8UBCQC1J\ads[4].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\8UBCQC1J\index[2].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6W2HWJDD\search[1].htm moved successfully.
File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot…


I waited about ten minutes for the computer to reboot and when it didn't I rebooted it myself, which generated the log.

here is the OTL text (with the boxes for Scan All Users, LOP and Purity check checked):


OTL logfile created on: 9/24/2011 6:22:32 PM - Run 3
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Documents and Settings\Owner\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.58 Gb Available Physical Memory | 79.36% Memory free
3.84 Gb Paging File | 3.58 Gb Available in Paging File | 93.28% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 57.50 Gb Free Space | 77.15% Space Free | Partition Type: NTFS

Computer Name: OWNER-D67H3 | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
PRC - C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Dell Inc.)
PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\hidfind.exe (Alps Electric Co., Ltd.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Alwil Software\Avast5\defs\11092401\algo.dll ()
MOD - C:\Program Files\Alwil Software\Avast5\defs\11092401\aswRep.dll ()
MOD - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
MOD - C:\Program Files\Dell\QuickSet\dadkeyb.dll ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (NMSAccess) – C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (NICCONFIGSVC) – C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Dell Inc.)


========== Driver Services (SafeList) ==========

DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (StarOpen) – C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (w29n51) Intel® – C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (GTIPCI21) – C:\WINDOWS\system32\drivers\gtipci21.sys (Texas Instruments)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (APPDRV) – C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.SYS (Conexant Systems, Inc.)
DRV - (HSFHWICH) – C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (STAC97) – C:\WINDOWS\system32\drivers\STAC97.sys (SigmaTel, Inc.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 2C 11 42 68 05 B4 CB 01 [binary data]
IE - HKU\S-1-5-21-583907252-861567501-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "http://www.google.com/search?ie=UTF-8&sourceid=navclient&gfns=1&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011/09/22 01:07:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/07 09:18:55 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/13 23:56:16 | 000,000,000 | —D | M]

[2011/09/13 17:01:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2011/09/07 10:45:43 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\l3m6oc5z.default\extensions
[2011/01/29 14:33:30 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\l3m6oc5z.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/09/03 23:20:28 | 000,002,507 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\l3m6oc5z.default\searchplugins\SearchResults.xml
[2011/09/13 17:01:31 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/01/28 01:40:02 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/28 01:57:57 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/03/07 15:59:19 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/06/21 23:54:12 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/09/07 09:18:55 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/05/04 04:52:23 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/08/30 14:41:02 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/09/03 23:20:28 | 000,002,507 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\SearchResults.xml

O1 HOSTS File: ([2004/08/04 04:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
O4 - HKU\S-1-5-21-583907252-861567501-1801674531-500..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-583907252-861567501-1801674531-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{13C53539-FD1B-4735-B970-B68FCA0CCC19}: DhcpNameServer = 192.168.1.1 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{29CA763A-BC94-4B50-A823-0D2C7359BB90}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2A1AB345-B17F-4FD1-99DF-101DE26E158A}: DhcpNameServer = 10.0.0.5 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5989D1B5-155C-4AE8-9430-3EE806A9816E}: DhcpNameServer = 10.0.0.5 [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/02/23 14:37:29 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/09/24 03:31:53 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Owner\IECompatCache
[2011/09/07 10:45:37 | 000,000,000 | —D | C] – C:\_OTL
[2011/09/05 00:35:15 | 000,000,000 | —D | C] – C:\WINDOWS\CSC
[2011/09/04 10:40:53 | 000,000,000 | —D | C] – C:\Config.Msi
[2011/09/04 10:31:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2011/09/03 23:20:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\My Received Files

========== Files - Modified Within 30 Days ==========

[2011/09/24 18:20:24 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/09/24 18:19:06 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/09/22 01:12:01 | 000,001,700 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/09/22 01:11:52 | 000,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2011/09/06 23:58:22 | 000,000,491 | —- | M] () – C:\Documents and Settings\Owner\Desktop\MBR.zip
[2011/09/06 23:56:52 | 000,000,512 | —- | M] () – C:\Documents and Settings\Owner\Desktop\MBR.dat
[2011/09/06 15:45:29 | 000,199,304 | —- | M] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2011/09/06 15:45:29 | 000,041,184 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2011/09/06 15:38:05 | 000,442,200 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2011/09/06 15:37:53 | 000,320,856 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2011/09/06 15:36:38 | 000,034,392 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/09/06 15:36:36 | 000,052,568 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/09/06 15:36:23 | 000,110,552 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/09/06 15:36:20 | 000,104,536 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2011/09/06 15:36:12 | 000,020,568 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/09/06 15:33:11 | 000,030,808 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/09/04 11:24:59 | 000,000,742 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/09/04 11:24:59 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/09/04 10:45:16 | 000,110,992 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/09/03 22:02:10 | 000,433,270 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/09/03 22:02:10 | 000,068,060 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/09/03 21:59:02 | 000,001,355 | —- | M] () – C:\WINDOWS\imsins.BAK

========== Files Created - No Company Name ==========

[2011/09/06 23:58:22 | 000,000,491 | —- | C] () – C:\Documents and Settings\Owner\Desktop\MBR.zip
[2011/09/06 23:56:52 | 000,000,512 | —- | C] () – C:\Documents and Settings\Owner\Desktop\MBR.dat
[2011/01/27 23:36:32 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/03/23 14:30:43 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2009/03/11 14:10:38 | 000,168,448 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/02/23 15:41:58 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\stac97co.dll
[2009/02/23 14:37:55 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/02/23 14:33:51 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/02/23 07:06:22 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2009/02/23 07:05:03 | 000,110,992 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/04/14 06:55:28 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2006/12/31 08:57:08 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2005/03/21 17:48:05 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/21 17:48:05 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 04:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 04:00:00 | 000,433,270 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 04:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 04:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 04:00:00 | 000,068,060 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 04:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 04:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 04:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2011/01/27 23:44:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2011/09/04 10:31:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2011/04/23 01:30:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\LeapingBrain

========== Purity Check ==========



< End of report >



thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI