redirects, sent emails today,

I got this a few weeks ago, it started out as Zentom System Guard. I think I got that, but it disabled the firewall and nothing can catch whats going on now. Not Mbam, Trend Micro, or mcafee. I tried AVG but it just caused the computer to freeze up about every 10 minutes or so. The firewall is on at this point.

What is going on now is sometimes when i open firefox i get a second window that shows a ad type site trying to sell me junk. Today it sent about 25 emails out of my yahoo account offering viagra and cialis.

it also messes with my sound by turning it off and to get it back on i have to reboot.

I hope you guys can help. Here is a log file #1 on the list of what to do. I have the other 2 completed as well and will post as you need them.

Thank you

========== Files/Folders - Created Within 30 Days ==========

[2011/09/15 15:41:17 | 000,581,632 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Admin\Desktop\OTL.exe
[2011/09/15 15:40:53 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Admin\Desktop\HiJackThis.exe
[2011/09/15 10:23:00 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2011/09/14 12:38:36 | 000,000,000 | —D | C] – C:\WINDOWS\System32\Adobe
[2011/09/14 07:51:45 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/09/12 14:29:06 | 000,000,000 | —D | C] – C:\Program Files\Common Files\McAfee
[2011/09/12 14:28:58 | 000,000,000 | —D | C] – C:\Program Files\McAfee
[2011/09/12 12:38:02 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Application Data\Roxio
[2011/09/09 15:40:59 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Apple Computer
[2011/09/09 15:16:41 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Windows Search
[2011/09/09 15:15:54 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\McAfee
[2011/09/09 15:15:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee Security Scan Plus
[2011/09/09 15:14:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee Security Scan
[2011/09/09 15:14:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2011/09/09 15:14:37 | 000,000,000 | —D | C] – C:\Program Files\McAfee Security Scan
[2011/09/09 06:51:31 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Temp
[2011/09/09 06:51:31 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2011/09/09 06:51:31 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/09/06 08:25:43 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Minit-Charger
[2011/09/06 08:25:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Minit-Charger
[2011/09/06 08:25:40 | 000,000,000 | —D | C] – C:\Program Files\Minit-Charger
[2011/09/06 07:37:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/09/06 07:36:25 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/09/06 07:36:22 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/09/03 06:17:37 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\crypt32.dll
[2011/09/01 07:26:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Application Data\AVG10
[2011/09/01 07:24:34 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/09/01 07:24:34 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\AVG
[2011/09/01 07:23:39 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2011/09/01 06:41:33 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/09/01 06:41:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/08/30 10:31:27 | 000,000,000 | —D | C] – C:\Config.Msi
[2011/08/30 10:31:24 | 000,000,000 | —D | C] – C:\Program Files\Yontoo Layers Runtime
[2011/08/30 10:31:24 | 000,000,000 | —D | C] – C:\Program Files\STMicroelectronics
[2011/08/29 15:06:12 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Intel Corporation
[2011/08/29 15:04:13 | 000,000,000 | —D | C] – C:\Program Files\Intel
[2011/08/29 12:17:39 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/08/29 11:52:36 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2011/08/26 14:57:03 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2011/08/26 14:55:24 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2011/08/26 14:54:48 | 000,000,000 | —D | C] – C:\b8ed71244db11b877a
[2011/08/25 08:07:02 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Sun
[2011/08/25 06:46:37 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/08/24 20:11:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Start Menu\Programs\Google Chrome
[2011/08/24 19:17:21 | 000,000,000 | —D | C] – C:\WINDOWS\ServicePackFiles
[2011/08/24 18:58:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2011/08/24 15:13:54 | 000,954,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40.dll
[2011/08/24 15:13:54 | 000,953,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40u.dll
[2011/08/24 15:13:41 | 000,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comctl32.dll
[2011/08/24 15:13:37 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2011/08/24 15:13:29 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndproxy.sys
[2011/08/24 15:13:05 | 000,139,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpwd.sys
[2011/08/24 15:13:04 | 000,105,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mup.sys
[2011/08/24 14:51:24 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Application Data\Malwarebytes
[2011/08/24 14:51:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/24 14:51:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/08/24 14:51:14 | 000,022,216 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/08/24 14:51:14 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/08/24 14:42:30 | 000,852,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vgx.dll
[2011/08/24 14:42:20 | 000,010,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndistapi.sys
[2011/08/24 14:42:18 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab.exe
[2011/08/23 15:08:27 | 000,000,000 | —D | C] – C:\WINDOWS\System32\PreInstall
[2011/08/23 15:04:39 | 000,000,000 | —D | C] – C:\WINDOWS\System32\SoftwareDistribution
[2011/08/23 15:00:39 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/08/23 14:49:53 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2011/08/23 14:49:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Application Data\A3EAC15C3C5C76B49A332F5DD87897E6
[2011/08/23 14:38:16 | 000,000,000 | —D | C] – C:\WINDOWS\Sun
[2011/08/17 06:29:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Local Settings\Application Data\PowerDVD DX
[2011/08/17 06:29:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\CyberLink
[2010/09/05 01:38:11 | 000,004,096 | —- | C] ( ) – C:\WINDOWS\System32\IGFXDEVLib.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/15 15:42:11 | 000,625,664 | —- | M] () – C:\Documents and Settings\Admin\Desktop\dds.scr
[2011/09/15 15:41:17 | 000,581,632 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Admin\Desktop\OTL.exe
[2011/09/15 15:40:53 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Admin\Desktop\HiJackThis.exe
[2011/09/15 10:18:50 | 000,002,497 | —- | M] () – C:\Documents and Settings\Admin\Desktop\Microsoft Office Word 2003.lnk
[2011/09/15 07:40:23 | 000,000,786 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/15 06:37:04 | 000,016,201 | —- | M] () – C:\WINDOWS\cfgall.ini
[2011/09/15 06:36:14 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/09/15 06:33:46 | 000,000,000 | —- | M] () – C:\Documents and Settings\Admin\Local Settings\Application Data\WavXMapDrive.bat
[2011/09/15 06:33:40 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/09/15 06:33:37 | 3076,427,776 | -HS- | M] () – C:\hiberfil.sys
[2011/09/15 02:48:26 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/09/13 07:19:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/09/12 12:48:37 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/09/09 15:15:45 | 000,001,619 | —- | M] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2011/09/09 15:15:45 | 000,001,611 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/09/08 06:40:05 | 000,475,520 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/09/08 06:40:05 | 000,083,118 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/09/06 08:25:54 | 000,000,942 | —- | M] () – C:\Documents and Settings\All Users\Desktop\BICC-Tool 2008.lnk
[2011/09/06 07:47:17 | 000,000,744 | —- | M] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/09/06 07:47:16 | 000,000,726 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/09/06 07:37:42 | 000,001,544 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/09/03 06:17:37 | 000,599,040 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\crypt32.dll
[2011/08/31 17:00:50 | 000,022,216 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/08/31 10:31:35 | 000,000,376 | —- | M] () – C:\WINDOWS\ODBC.INI
[2011/08/29 13:48:56 | 000,002,352 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/08/25 08:07:20 | 000,102,400 | —- | M] () – C:\WINDOWS\RegBootClean.exe
[2011/08/24 20:13:09 | 000,002,286 | —- | M] () – C:\Documents and Settings\Admin\Desktop\Google Chrome.lnk
[2011/08/24 20:13:09 | 000,002,264 | —- | M] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/08/24 20:00:47 | 000,266,208 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/08/23 06:27:19 | 000,002,187 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/08/22 10:18:08 | 000,131,137 | —- | M] () – C:\Documents and Settings\Admin\My Documents\arzoo head pic..php
[2011/08/22 10:14:38 | 000,133,923 | —- | M] () – C:\Documents and Settings\Admin\My Documents\zora head pic..php
[2011/08/22 10:12:12 | 000,194,147 | —- | M] () – C:\Documents and Settings\Admin\My Documents\farah.html
[2011/08/22 08:05:22 | 000,000,806 | —- | M] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/08/22 08:05:22 | 000,000,788 | —- | M] () – C:\Documents and Settings\Admin\Desktop\Windows Media Player.lnk
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/15 15:42:10 | 000,625,664 | —- | C] () – C:\Documents and Settings\Admin\Desktop\dds.scr
[2011/09/09 15:14:38 | 000,001,619 | —- | C] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2011/09/09 15:14:38 | 000,001,611 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/09/06 08:25:54 | 000,000,942 | —- | C] () – C:\Documents and Settings\All Users\Desktop\BICC-Tool 2008.lnk
[2011/09/06 07:47:16 | 000,000,744 | —- | C] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/09/06 07:47:16 | 000,000,732 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/09/06 07:47:16 | 000,000,726 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/09/06 07:37:42 | 000,001,544 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/08/30 10:32:22 | 3076,427,776 | -HS- | C] () – C:\hiberfil.sys
[2011/08/29 12:17:39 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/08/24 20:20:47 | 000,158,464 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/08/24 20:13:09 | 000,002,286 | —- | C] () – C:\Documents and Settings\Admin\Desktop\Google Chrome.lnk
[2011/08/24 20:13:09 | 000,002,264 | —- | C] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/08/24 14:51:19 | 000,000,786 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/23 14:50:11 | 000,102,400 | —- | C] () – C:\WINDOWS\RegBootClean.exe
[2011/08/22 10:18:08 | 000,131,137 | —- | C] () – C:\Documents and Settings\Admin\My Documents\arzoo head pic..php
[2011/08/22 10:14:38 | 000,133,923 | —- | C] () – C:\Documents and Settings\Admin\My Documents\zora head pic..php
[2011/08/22 10:12:12 | 000,194,147 | —- | C] () – C:\Documents and Settings\Admin\My Documents\farah.html
[2011/08/22 08:05:22 | 000,000,806 | —- | C] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/06/28 10:16:26 | 000,055,304 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/06/16 14:04:17 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2011/06/16 13:42:59 | 000,016,201 | —- | C] () – C:\WINDOWS\cfgall.ini
[2011/06/16 13:36:12 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2011/06/16 13:27:53 | 000,000,000 | —- | C] () – C:\Documents and Settings\Admin\Local Settings\Application Data\WavXMapDrive.bat
[2010/09/05 01:38:16 | 000,077,824 | —- | C] () – C:\WINDOWS\setpwr32.exe
[2010/09/05 01:38:11 | 000,870,560 | —- | C] () – C:\WINDOWS\System32\igkrng575.bin
[2010/09/05 01:38:11 | 000,127,868 | —- | C] () – C:\WINDOWS\System32\igcompkrng575.bin
[2010/09/05 01:38:11 | 000,000,151 | —- | C] () – C:\WINDOWS\System32\GfxUI.exe.config
[2010/09/04 23:11:25 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2010/09/04 22:58:31 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2010/09/04 22:58:30 | 000,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2010/09/04 22:58:30 | 000,025,088 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2010/09/04 22:56:47 | 000,080,368 | —- | C] () – C:\WINDOWS\System32\pbadrvdll.dll
[2010/09/04 22:56:24 | 000,000,206 | —- | C] () – C:\WINDOWS\hbcikrnl.ini
[2010/07/31 07:04:03 | 000,001,156 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2010/03/02 13:46:38 | 000,010,752 | —- | C] () – C:\WINDOWS\System32\Wavx_ESC_Logging.dll
[2010/02/25 22:59:02 | 002,860,384 | —- | C] () – C:\WINDOWS\System32\btwicons.dll
[2010/02/04 12:18:22 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\Internationalization_th.dll
[2010/02/04 12:18:22 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-HK.dll
[2010/02/04 12:18:20 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_sl.dll
[2010/02/04 12:18:18 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_sk.dll
[2010/02/04 12:18:18 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_hr.dll
[2010/02/04 12:18:12 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_ro.dll
[2010/02/04 12:18:12 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_tr.dll
[2010/02/04 12:18:10 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_pt-BR.dll
[2010/02/04 12:18:10 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_hu.dll
[2010/02/04 12:18:08 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_fi.dll
[2010/02/04 12:18:08 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\Internationalization_he.dll
[2010/02/04 12:18:06 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\Internationalization_el.dll
[2010/02/04 12:18:06 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_cs.dll
[2010/02/04 12:18:04 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\Internationalization_ar.dll
[2010/02/04 12:18:04 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-CHT.dll
[2010/02/04 12:18:02 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-CHS.dll
[2010/02/04 12:18:00 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_sv.dll
[2010/02/04 12:18:00 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_ru.dll
[2010/02/04 12:17:58 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_pt.dll
[2010/02/04 12:17:58 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_pl.dll
[2010/02/04 12:17:56 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\Internationalization_nl.dll
[2010/02/04 12:17:56 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_no.dll
[2010/02/04 12:17:54 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\Internationalization_ko.dll
[2010/02/04 12:17:54 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\Internationalization_ja.dll
[2010/02/04 12:17:52 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_it.dll
[2010/02/04 12:17:50 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_fr.dll
[2010/02/04 12:17:50 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_es.dll
[2010/02/04 12:17:48 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_de.dll
[2010/02/04 12:17:46 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_da.dll
[2010/01/19 13:44:30 | 000,249,856 | —- | C] () – C:\WINDOWS\System32\wxvault.dll
[2009/11/06 16:27:22 | 000,839,680 | —- | C] () – C:\WINDOWS\System32\DemoLicense.dll
[2009/08/26 17:25:08 | 000,917,504 | —- | C] () – C:\WINDOWS\System32\lmgr10.dll
[2009/01/20 13:32:04 | 000,024,056 | —- | C] () – C:\WINDOWS\System32\providers.bin
[2008/05/26 22:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 22:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2008/04/25 17:31:41 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2008/04/25 17:27:18 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2008/04/25 17:26:32 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2008/04/25 12:16:24 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2008/04/25 12:16:22 | 000,475,520 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2008/04/25 12:16:22 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2008/04/25 12:16:22 | 000,083,118 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2008/04/25 12:16:22 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2008/04/25 12:16:22 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2008/04/25 12:16:21 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2008/04/25 12:16:20 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2008/04/25 12:16:18 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2008/04/25 12:16:18 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2008/04/25 12:16:13 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2008/04/25 12:16:11 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2008/04/25 05:22:39 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2008/04/25 05:21:52 | 000,266,208 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/03/25 10:46:00 | 000,077,536 | —- | C] () – C:\WINDOWS\System32\xltZlib.dll
[2007/09/27 11:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 11:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 11:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2006/06/30 13:58:44 | 000,176,128 | —- | C] () – C:\WINDOWS\System32\bioapi_mds300.dll
[2006/06/30 13:58:44 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\bioapi100.dll
[2006/04/27 12:43:28 | 000,000,125 | —- | C] () – C:\WINDOWS\System32\EMCUsbUn.ini
[2005/09/02 15:44:04 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\EMCUsbUn.exe
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2001/11/14 13:56:00 | 001,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll

< End of report >

Thank you Satchfan for helping me. I just got a new window pop up and it sent me here: http://www.superiorcheckingonline.com/en/c…djbCaBCmz3gIis=

here is the information you asked for:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 6.0.2900.5512
Run by [removed] at 6:37:46 on 2011-09-16
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2934.2170 [GMT -4:00]
.
AV: Trend Micro OfficeScan Antivirus *Enabled/Updated* {6F4E13B8-5D50-46FD-B5B1-A4397754D80C}
.
============== Running Processes ===============
.
C:\Program Files\Fingerprint Sensor\AtService.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IDT\WDM\stacsv.exe
C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe
C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe
C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
c:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINDOWS\system32\SearchIndexer.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe
c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe
C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.bing.com
uSearch Bar = hxxp://www.bing.com/sphome.aspx
mDefault_Page_URL = hxxp://www.dell.com
mStart Page = hxxp://www.dell.com
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = hxxp://www.bing.com/sphome.aspx
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Apoint] c:\program files\delltpad\Apoint.exe
mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
mRun: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [DellControlPoint] "c:\program files\dell\dell controlpoint\Dell.ControlPoint.exe"
mRun: [WavXMgr] c:\program files\wave systems corp\services manager\docmgr\bin\WavXDocMgr.exe
mRun: [USCService] c:\program files\dell\dell controlpoint\security manager\BcmDeviceAndTaskStatusService.exe
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [OfficeScanNT Monitor] "c:\program files\trend micro\officescan client\pccntmon.exe" -HideWindow
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [IAStorIcon] c:\program files\intel\intel® rapid storage technology\IAStorIcon.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dellco~1.lnk - c:\program files\dell\dell controlpoint\system manager\DCPSysMgr.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\tdmnot~1.lnk - c:\program files\wave systems corp\trusted drive manager\TdmNotify.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL
DPF: {00134F72-5284-44F7-95A8-52A619F70751} - hxxps://officescan.swisher.com:4343/officescan/console/html/ClientInstall/WinNTChk.cab
DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} - hxxps://officescan.swisher.com:4343/officescan/console/html/ClientInstall/setup.cab
DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} - hxxps://officescan.swisher.com:4343/officescan/console/html/root/AtxEnc.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 10.1.1.5 10.1.1.6
TCP: Interfaces\{07386250-4791-4543-9A76-B8140BB75FF3} : DhcpNameServer = 10.1.1.5 10.1.1.6
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: igfxcui - igfxdev.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
LSA: Authentication Packages = msv1_0 wvauth
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\admin\application data\mozilla\firefox\profiles\cxq2vfmb.default\
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mcafee\siteadvisor\NPMcFFPlg32.dll
FF - plugin: c:\program files\microsoft silverlight\3.0.40624.0\npctrlui.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
.
============= SERVICES / DRIVERS ===============
.
R2 ATService;AuthenTec Fingerprint Service;c:\program files\fingerprint sensor\AtService.exe [2010-5-10 1803584]
R2 BrcmMgmtAgent;Broadcom Management Agent;c:\program files\broadcom\mgmtagent\BrcmMgmtAgent.exe [2009-11-4 114688]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\dell\dell controlpoint\DCPButtonSvc.exe [2009-11-20 278304]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\dell\dell controlpoint\system manager\DCPSysMgrSvc.exe [2009-12-10 376608]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\sitead~1\mcsacore.exe [2011-9-12 94880]
R2 risdpcie;risdpcie;c:\windows\system32\drivers\risdpe86.sys [2010-9-5 59904]
R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2011-6-16 51792]
R2 TmFilter;Trend Micro Filter;c:\program files\trend micro\officescan client\TmXpflt.sys [2010-10-20 249424]
R2 TmPreFilter;Trend Micro PreFilter;c:\program files\trend micro\officescan client\TmPreflt.sys [2010-10-20 36432]
R3 Acceler;Accelerometer Service;c:\windows\system32\drivers\Accelern.sys [2010-9-4 42672]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2010-9-5 113664]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2010-9-5 132480]
R3 IntcDAud;Intel® Display Audio;c:\windows\system32\drivers\IntcDAud.sys [2010-9-5 235520]
R3 TmProxy;OfficeScan NT Proxy Service;c:\program files\trend micro\officescan client\TmProxy.exe [2009-7-15 689416]
S1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\mpfilter.sys –> c:\windows\system32\drivers\MpFilter.sys [?]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;"c:\program files\intel\intel® rapid storage technology\iastordatamgrsvc.exe" –> c:\program files\intel\intel® rapid storage technology\IAStorDataMgrSvc.exe [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-25 14336]
.
=============== Created Last 30 ================
.
2011-09-14 16:38:36 ——– d—–w- c:\windows\system32\Adobe
2011-09-12 18:29:06 ——– d—–w- c:\program files\common files\McAfee
2011-09-12 18:28:58 ——– d—–w- c:\program files\McAfee
2011-09-09 19:14:40 ——– d—–w- c:\documents and settings\all users\application data\McAfee Security Scan
2011-09-09 19:14:37 ——– d—–w- c:\program files\McAfee Security Scan
2011-09-06 12:25:43 ——– d—–w- c:\program files\common files\Minit-Charger
2011-09-06 12:25:40 ——– d—–w- c:\program files\Minit-Charger
2011-09-06 11:36:25 ——– d—–w- c:\program files\iPod
2011-09-06 11:36:22 ——– d—–w- c:\program files\iTunes
2011-09-05 17:04:56 183696 —-a-w- c:\program files\internet explorer\plugins\nppdf32.dll
2011-09-03 10:17:37 599040 -c—-w- c:\windows\system32\dllcache\crypt32.dll
2011-09-01 11:26:59 ——– d—–w- c:\documents and settings\admin\application data\AVG10
2011-09-01 11:24:34 ——– d—–w- c:\windows\system32\drivers\AVG
2011-09-01 11:24:34 ——– d—–w- c:\documents and settings\all users\application data\AVG10
2011-09-01 11:23:39 ——– d—–w- c:\program files\AVG
2011-09-01 10:41:33 ——– d–h–w- c:\documents and settings\all users\application data\Common Files
2011-09-01 10:41:07 ——– d—–w- c:\documents and settings\all users\application data\MFAData
2011-08-30 14:31:24 ——– d—–w- c:\program files\Yontoo Layers Runtime
2011-08-30 14:31:24 ——– d—–w- c:\program files\STMicroelectronics
2011-08-29 19:06:12 ——– d—–w- c:\program files\common files\Intel Corporation
2011-08-26 18:55:24 ——– d—–w- c:\program files\Microsoft Security Client
2011-08-26 18:54:48 ——– d—–w- C:\b8ed71244db11b877a
2011-08-24 23:17:21 ——– d—–w- c:\windows\ServicePackFiles
2011-08-24 19:13:54 954368 -c—-w- c:\windows\system32\dllcache\mfc40.dll
2011-08-24 19:13:54 953856 -c—-w- c:\windows\system32\dllcache\mfc40u.dll
2011-08-24 19:13:41 617472 -c—-w- c:\windows\system32\dllcache\comctl32.dll
2011-08-24 19:13:37 744448 -c—-w- c:\windows\system32\dllcache\helpsvc.exe
2011-08-24 19:13:29 40960 -c—-w- c:\windows\system32\dllcache\ndproxy.sys
2011-08-24 19:13:05 139656 -c—-w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-24 19:13:04 105472 -c—-w- c:\windows\system32\dllcache\mup.sys
2011-08-24 18:51:24 ——– d—–w- c:\documents and settings\admin\application data\Malwarebytes
2011-08-24 18:51:18 ——– d—–w- c:\documents and settings\all users\application data\Malwarebytes
2011-08-24 18:51:14 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-24 18:51:14 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-08-24 18:42:30 852480 -c—-w- c:\windows\system32\dllcache\vgx.dll
2011-08-24 18:42:20 10496 -c—-w- c:\windows\system32\dllcache\ndistapi.sys
2011-08-24 18:42:18 45568 -c—-w- c:\windows\system32\dllcache\wab.exe
2011-08-23 19:08:27 ——– d—–w- c:\windows\system32\PreInstall
2011-08-23 19:04:39 ——– d—–w- c:\windows\system32\SoftwareDistribution
2011-08-23 18:50:11 102400 —-a-w- c:\windows\RegBootClean.exe
2011-08-23 18:49:53 ——– d—–w- c:\documents and settings\all users\application data\Tarma Installer
2011-08-23 18:49:36 ——– d—–w- c:\documents and settings\admin\application data\A3EAC15C3C5C76B49A332F5DD87897E6
.
==================== Find3M ====================
.
2011-09-12 16:48:37 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-09 09:12:13 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-07-15 13:29:31 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-12 15:20:54 83816 —-a-w- c:\windows\system32\dns-sd.exe
2011-07-12 15:20:54 73064 —-a-w- c:\windows\system32\dnssd.dll
2011-07-12 15:20:54 50536 —-a-w- c:\windows\system32\jdns_sd.dll
2011-07-12 15:20:54 178536 —-a-w- c:\windows\system32\dnssdX.dll
2011-07-08 14:02:00 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-05 22:37:00 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-05 22:37:00 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-06-24 14:10:36 139656 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-21 18:18:34 81920 —-a-w- c:\windows\system32\ieencode.dll
2011-06-21 18:18:34 667136 —-a-w- c:\windows\system32\wininet.dll
2011-06-21 18:18:34 61952 —-a-w- c:\windows\system32\tdc.ocx
2011-06-21 12:58:45 369664 —-a-w- c:\windows\system32\html.iec
2011-06-20 17:44:52 293376 —-a-w- c:\windows\system32\winsrv.dll
.
============= FINISH: 6:39:08.76 ===============


.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 6/16/2011 1:27:40 PM
System Uptime: 9/16/2011 6:30:21 AM (0 hours ago)
.
Motherboard: Dell Inc. | | 023HKR
Processor: Intel® Core™ i5 CPU M 450 @ 2.40GHz | CPU 1 | 2393/533mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 298 GiB total, 272.709 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP6: 6/18/2011 10:20:29 AM - System Checkpoint
RP7: 6/19/2011 11:08:29 AM - System Checkpoint
RP8: 6/20/2011 12:45:27 PM - System Checkpoint
RP9: 6/21/2011 1:12:11 PM - System Checkpoint
RP10: 6/22/2011 4:00:49 PM - System Checkpoint
RP11: 6/23/2011 4:39:36 PM - System Checkpoint
RP12: 6/24/2011 6:34:33 PM - System Checkpoint
RP13: 6/25/2011 10:33:27 PM - System Checkpoint
RP14: 6/27/2011 2:33:27 AM - System Checkpoint
RP15: 6/28/2011 7:01:27 AM - System Checkpoint
RP16: 6/28/2011 9:12:05 AM - Installed iTunes
RP17: 6/29/2011 10:37:48 AM - System Checkpoint
RP18: 6/30/2011 2:34:36 PM - System Checkpoint
RP19: 7/1/2011 10:04:23 PM - System Checkpoint
RP20: 7/3/2011 12:46:29 AM - System Checkpoint
RP21: 7/4/2011 4:46:29 AM - System Checkpoint
RP22: 7/5/2011 7:01:08 AM - System Checkpoint
RP23: 7/6/2011 10:28:17 AM - System Checkpoint
RP24: 7/7/2011 10:29:13 AM - System Checkpoint
RP25: 7/8/2011 11:02:27 AM - System Checkpoint
RP26: 7/9/2011 11:18:52 AM - System Checkpoint
RP27: 7/10/2011 11:57:07 AM - System Checkpoint
RP28: 7/11/2011 3:17:46 PM - System Checkpoint
RP29: 7/12/2011 7:17:46 PM - System Checkpoint
RP30: 7/13/2011 7:35:19 PM - System Checkpoint
RP31: 7/14/2011 3:20:22 PM - Printer Driver KX DRIVER for Universal Printing Installed
RP32: 7/15/2011 4:36:10 PM - System Checkpoint
RP33: 7/18/2011 7:00:25 AM - System Checkpoint
RP34: 7/19/2011 7:01:03 AM - System Checkpoint
RP35: 7/19/2011 8:41:27 AM - Installed is CAN Multidriver
RP36: 7/20/2011 8:46:08 AM - System Checkpoint
RP37: 7/21/2011 10:36:28 AM - System Checkpoint
RP38: 7/22/2011 10:41:20 AM - System Checkpoint
RP39: 7/23/2011 2:35:23 PM - System Checkpoint
RP40: 7/24/2011 6:35:23 PM - System Checkpoint
RP41: 7/25/2011 6:36:28 PM - System Checkpoint
RP42: 7/26/2011 10:35:23 PM - System Checkpoint
RP43: 7/28/2011 2:35:23 AM - System Checkpoint
RP44: 7/28/2011 1:21:17 PM - Installed OBD-PC Link
RP45: 7/29/2011 2:44:43 PM - System Checkpoint
RP46: 8/1/2011 7:00:08 AM - System Checkpoint
RP47: 8/2/2011 10:37:21 AM - System Checkpoint
RP48: 8/3/2011 10:38:26 AM - System Checkpoint
RP49: 8/4/2011 2:38:26 PM - System Checkpoint
RP50: 8/6/2011 9:02:59 AM - System Checkpoint
RP51: 8/7/2011 11:50:48 AM - System Checkpoint
RP52: 8/8/2011 4:33:18 PM - System Checkpoint
RP53: 8/9/2011 5:41:09 PM - System Checkpoint
RP54: 8/10/2011 6:40:23 PM - System Checkpoint
RP55: 8/11/2011 10:39:21 PM - System Checkpoint
RP56: 8/15/2011 7:01:23 AM - System Checkpoint
RP57: 8/16/2011 10:38:42 AM - System Checkpoint
RP58: 8/17/2011 11:07:15 AM - System Checkpoint
RP59: 8/18/2011 2:38:03 PM - System Checkpoint
RP60: 8/22/2011 7:01:18 AM - System Checkpoint
RP61: 8/23/2011 11:20:58 AM - System Checkpoint
RP62: 8/23/2011 3:08:14 PM - Software Distribution Service 3.0
RP63: 8/24/2011 5:42:16 PM - System Checkpoint
RP64: 8/24/2011 6:57:46 PM - Software Distribution Service 3.0
RP65: 8/24/2011 7:00:15 PM - Software Distribution Service 3.0
RP66: 8/24/2011 8:02:35 PM - Installed Windows XP WgaNotify.
RP67: 8/26/2011 7:00:57 AM - System Checkpoint
RP68: 8/30/2011 10:33:03 AM - Restore Operation
RP69: 8/30/2011 10:33:41 AM - Unsigned driver install
RP70: 9/1/2011 6:57:44 AM - System Checkpoint
RP71: 9/1/2011 7:23:29 AM - Installed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
RP72: 9/1/2011 7:23:37 AM - Installed AVG 2011
RP73: 9/1/2011 7:24:18 AM - Installed AVG 2011
RP74: 9/1/2011 5:16:02 PM - Removed AVG 2011
RP75: 9/1/2011 5:17:10 PM - Removed AVG 2011
RP76: 9/1/2011 5:18:28 PM - Removed AVG 2011
RP77: 9/6/2011 7:03:51 AM - System Checkpoint
RP78: 9/7/2011 8:14:06 AM - System Checkpoint
RP79: 9/7/2011 5:25:54 PM - Software Distribution Service 3.0
RP80: 9/9/2011 12:56:46 PM - System Checkpoint
RP81: 9/12/2011 7:00:37 AM - System Checkpoint
RP82: 9/14/2011 7:00:28 AM - System Checkpoint
RP83: 9/15/2011 7:00:49 AM - System Checkpoint
RP84: 9/15/2011 8:42:22 AM - Software Distribution Service 3.0
RP85: 9/15/2011 5:16:52 PM - Software Distribution Service 3.0
.
==== Installed Programs ======================
.
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.1.1)
Adobe Shockwave Player 11.6
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AuthenTec Fingerprint Software
BioAPI Framework
Bonjour
Broadcom NetXtreme-I Netlink Driver and Management Installer
Broadcom TPM Driver Installer
Compatibility Pack for the 2007 Office system
Dell Backup and Recovery Manager
Dell Control Point
Dell ControlPoint Security Manager
Dell ControlPoint System Manager
Dell Embassy Trust Suite by Wave Systems
Dell Security Device Driver Pack
Dell Touchpad
Document Manager Lite
DW WLAN Card Utility
EMBASSY Security Center
EMBASSY Security Setup
ESC Home Page Plugin
ETACC YALE 2.10
Gemalto
Google Chrome
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB932716-v2)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB953955)
Hotfix for Windows XP (KB954434)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB958347)
Hotfix for Windows XP (KB959252)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB968764)
Hotfix for Windows XP (KB969084)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Intel® Rapid Storage Technology
is CAN Multidriver
iTunes
Java Auto Updater
Java™ 6 Update 20
Junk Mail filter update
Kyocera Product Library
Ligos Indeo® Codecs
Malwarebytes' Anti-Malware version 1.51.2.1300
McAfee Security Scan Plus
McAfee SiteAdvisor
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Office Professional Edition 2003
Microsoft Search Enhancement Pack
Microsoft Security Client
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Minit-Charger Software Tools 2008-2009 ([removed])
Mozilla Firefox 6.0.2 (x86 en-US)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP3 Parser (KB973685)
MSXML 6.0 Parser (KB927977)
NTRU TCG Software Stack
O2Micro OZ776 SCR Driver
OBD-PC Link
PowerDVD DX
Preboot Manager
Private Information Manager
QuickTime
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE 10.3
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
Safari
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2483614)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2491683)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2510581)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2544521)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2559049)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB976325)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982381)
Security Update for Windows XP (KB982665)
Security Wizards
Segoe UI
swMSM
Trend Micro OfficeScan Client
Trusted Drive Manager
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB898461)
Update for Windows XP (KB951618-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB980182)
UPEK TouchChip Fingerprint Reader
Wave Infrastructure Installer
Wave Support Software
WebFldrs XP
WIDCOMM Bluetooth Software
Windows Driver Package - AuthenTec Inc. (ATSwpWDF) Biometric (05/13/2009 8.4.2.0)
Windows Driver Package - Dell Inc. PBADRV System (09/11/2009 1.0.1.6)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
Windows Management Framework Core
Windows Presentation Foundation
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
Windows Search 4.0
XML Paper Specification Shared Components Pack 1.0
.
==== Event Viewer Messages From Past Week ========
.
9/9/2011 3:17:44 PM, error: Service Control Manager [7023] - The Windows Firewall/Internet Connection Sharing (ICS) service terminated with the following error: Access is denied.
9/15/2011 8:56:51 AM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 8 for Windows XP.
9/13/2011 8:24:23 AM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
9/12/2011 8:23:51 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: MpFilter
9/12/2011 8:23:51 AM, error: Service Control Manager [7000] - The Microsoft Antimalware Service service failed to start due to the following error: The system cannot find the file specified.
9/12/2011 8:23:51 AM, error: Service Control Manager [7000] - The Intel® Rapid Storage Technology service failed to start due to the following error: The system cannot find the file specified.
9/12/2011 12:00:24 PM, error: Cdrom [11] - The driver detected a controller error on \Device\CdRom0.
.
==== End Of File ===========================

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-09-16 06:39:38
—————————–
06:39:38.765 OS Version: Windows 5.1.2600 Service Pack 3
06:39:38.765 Number of processors: 4 586 0x2505
06:39:38.765 ComputerName: D7Q3X6N1 UserName: Admin
06:39:39.937 Initialize success
06:40:15.625 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
06:40:15.625 Disk 0 Vendor: Hitachi_ PC3O Size: 305245MB BusType: 3
06:40:15.625 Disk 0 MBR read error 0
06:40:15.625 Disk 0 MBR scan
06:40:15.625 Disk 0 unknown MBR code
06:40:15.640 MBR BIOS signature not found 0
06:40:15.640 Disk 0 scanning sectors +625140400
06:40:15.687 Disk 0 scanning C:\WINDOWS\system32\drivers
06:40:24.828 Service scanning
06:40:25.421 Service TmFilter C:\Program Files\Trend Micro\OfficeScan Client\TmXPFlt.sys **LOCKED** 32
06:40:25.453 Service TmPreFilter C:\Program Files\Trend Micro\OfficeScan Client\TmPreFlt.sys **LOCKED** 32
06:40:25.500 Service VSApiNt C:\Program Files\Trend Micro\OfficeScan Client\VSApiNt.sys **LOCKED** 32
06:40:26.031 Modules scanning
06:40:29.953 Disk 0 trace - called modules:
06:40:29.953 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8914a4d0]<<
06:40:29.953 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8ac29ab8]
06:40:29.953 3 CLASSPNP.SYS[b98e8fd7] -> nt!IofCallDriver -> \Device\00000076[0x8aca49a0]
06:40:29.953 5 ACPI.sys[b977f620] -> nt!IofCallDriver -> [0x8ac1b028]
06:40:29.968 \Driver\iaStor[0x8ac08748] -> IRP_MJ_CREATE -> 0x8914a4d0
06:40:29.968 Scan finished successfully
06:41:00.656 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Admin\Desktop\MBR.dat"
06:41:00.671 The log file has been saved successfully to "C:\Documents and Settings\Admin\Desktop\aswMBR.txt"


Results of screen317's Security Check version 0.99.18
Windows XP Service Pack 3
Internet Explorer 6 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
Trend Micro OfficeScan Client
McAfee Security Scan Plus
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java™ 6 Update 20
Out of date Java installed!
Adobe Flash Player 10.3.183.7
Adobe Reader X (10.1.1)
Mozilla Firefox (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Trend Micro OfficeScan Client pccntmon.exe
Trend Micro OfficeScan Client ntrtscan.exe
Trend Micro OfficeScan Client tmlisten.exe
Trend Micro OfficeScan Client CNTAoSMgr.exe
Trend Micro OfficeScan Client TmProxy.exe
Trend Micro BM TMBMSRV.exe
``````````End of Log````````````


Thank you for this.

OTL logfile created on: 9/17/2011 8:34:11 AM - Run 2
OTL by OldTimer - Version 3.2.28.0 Folder = C:\Documents and Settings\Admin\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 2.18 Gb Available Physical Memory | 75.96% Memory free
4.71 Gb Paging File | 4.08 Gb Available in Paging File | 86.76% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.05 Gb Total Space | 272.66 Gb Free Space | 91.48% Space Free | Partition Type: NTFS

Computer Name: D7Q3X6N1 | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Admin\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
PRC - C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Program Files\IDT\WDM\stacsv.exe (IDT, Inc.)
PRC - C:\WINDOWS\system32\AESTFltr.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Fingerprint Sensor\AtService.exe (AuthenTec, Inc.)
PRC - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.)
PRC - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe (Wave Systems Corp.)
PRC - c:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe (Dell Inc.)
PRC - c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (Dell Inc.)
PRC - c:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe (Dell Inc.)
PRC - C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe (Broadcom Corporation)
PRC - C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.)
PRC - C:\Program Files\Trend Micro\OfficeScan Client\PccNTMon.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\OfficeScan Client\TmListen.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\OfficeScan Client\NTRtScan.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\BM\TMBMSRV.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe (Trend Micro Inc.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\6e563a58e6fc0117070d5b8fd59e4e1b\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d00cc387e462e4c3cdcd112b137cac87\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\7ed09623172a292eaee51e2e3bcaf784\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\10154dcad2d62f226af2fd4211460a4b\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\77df2cd21a5b85a1605b335aa9ad9d44\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e6c79e1d71b0c9000afd7e5e439b5c54\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\Status Lib\1.6.460.18066__f25c74fcad379103\Status Lib.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\StatusInterfaces\1.6.460.18065__4ca2a925deedf37d\StatusInterfaces.dll ()
MOD - C:\WINDOWS\system32\Wavx_ESC_Logging.dll ()
MOD - C:\WINDOWS\system32\btwicons.dll ()
MOD - C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll ()
MOD - C:\WINDOWS\system32\wxvault.dll ()
MOD - C:\WINDOWS\system32\preflib.dll ()
MOD - C:\WINDOWS\system32\bcm1xsup.dll ()
MOD - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\TspPopup_ENU.dll ()


========== Win32 Services (SafeList) ==========

SRV - (MsMpSvc) – File not found
SRV - (IAStorDataMgrSvc) Intel® – File not found
SRV - (McAfee SiteAdvisor Service) – c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (STacSV) – C:\Program Files\IDT\WDM\stacsv.exe (IDT, Inc.)
SRV - (ATService) – C:\Program Files\Fingerprint Sensor\AtService.exe (AuthenTec, Inc.)
SRV - (TdmService) – C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.)
SRV - (SecureStorageService) – C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe (Wave Systems Corp.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (dcpsysmgrsvc) – c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (Dell Inc.)
SRV - (buttonsvc32) – c:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe (Dell Inc.)
SRV - (BrcmMgmtAgent) – C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe (Broadcom Corporation)
SRV - (tmlisten) – C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe (Trend Micro Inc.)
SRV - (ntrtscan) – C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe (Trend Micro Inc.)
SRV - (TmProxy) – C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe (Trend Micro Inc.)
SRV - (TMBMServer) – C:\Program Files\Trend Micro\OfficeScan Client\..\BM\TMBMSRV.exe ()
SRV - (tcsd_win32.exe) – C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe ()


========== Driver Services (SafeList) ==========

DRV - (TmFilter) – C:\Program Files\Trend Micro\OfficeScan Client\TmXpflt.sys (Trend Micro Inc.)
DRV - (TmPreFilter) – C:\Program Files\Trend Micro\OfficeScan Client\TmPreflt.sys (Trend Micro Inc.)
DRV - (VSApiNt) – C:\Program Files\Trend Micro\OfficeScan Client\vsapiNT.sys (Trend Micro Inc.)
DRV - (tmactmon) – C:\WINDOWS\system32\drivers\tmactmon.sys (Trend Micro Inc.)
DRV - (tmevtmgr) – C:\WINDOWS\system32\drivers\tmevtmgr.sys (Trend Micro Inc.)
DRV - (tmcomm) – C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (IDT, Inc.)
DRV - (AESTAud) – C:\WINDOWS\system32\drivers\AESTAud.sys (Andrea Electronics Corporation)
DRV - (risdpcie) – C:\WINDOWS\system32\drivers\risdpe86.sys (REDC)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (BTKRNL) – C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (btaudio) – C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (BTWDNDIS) – C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (BTDriver) – C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)
DRV - (btwmodem) – C:\WINDOWS\system32\drivers\btwmodem.sys (Broadcom Corporation.)
DRV - (Impcd) – C:\WINDOWS\system32\drivers\Impcd.sys (Intel Corporation)
DRV - (BASFND) – C:\Program Files\Broadcom\MgmtAgent\BASFND.sys (Broadcom Corporation)
DRV - (WavxDMgr) – C:\WINDOWS\system32\drivers\WavxDMgr.sys (Wave Systems Corp.)
DRV - (IntcDAud) Intel® – C:\WINDOWS\system32\drivers\IntcDAud.sys (Intel® Corporation)
DRV - (Acceler) – C:\WINDOWS\system32\drivers\Accelern.sys (ST Microelectronics)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (Blfp) – C:\WINDOWS\system32\drivers\baspxp32.sys (Broadcom Corporation)
DRV - (HECI) Intel® – C:\WINDOWS\system32\drivers\HECI.sys (Intel Corporation)
DRV - (tmtdi) – C:\WINDOWS\system32\drivers\tmtdi.sys (Trend Micro Inc.)
DRV - (PBADRV) – C:\WINDOWS\system32\DRIVERS\PBADRV.sys (Dell Inc)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Help_Page = http://support.dell.com/support/index.aspx…;l=en&s=gen
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USREL/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/sphome.aspx
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://g.msn.com/USREL/1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USREL/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com/sphome.aspx
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2011/09/12 14:29:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/07 09:43:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/09/06 07:47:27 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Admin\Application Data\Mozilla\Extensions
[2011/09/06 07:47:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/09/04 22:55:35 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/09/12 14:29:14 | 000,000,000 | —D | M] (McAfee SiteAdvisor) – C:\PROGRAM FILES\MCAFEE\SITEADVISOR
[2009/11/03 18:19:24 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/09/07 09:43:33 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/08/30 15:41:02 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml

Hosts file not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [DellControlPoint] c:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe File not found
O4 - HKLM..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey File not found
O4 - HKLM..\Run: [OfficeScanNT Monitor] C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [USCService] C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation)
O4 - HKLM..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell ControlPoint System Manager.lnk = C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe (Dell Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TdmNotify.lnk = C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe (Wave Systems Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Send to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send To Bluetooth - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} https://officescan.swisher.com:4343/offices…ll/WinNTChk.cab (ObjWinNTCheck Class)
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} https://officescan.swisher.com:4343/offices…stall/setup.cab (OfficeScan Corp Edition Web-Deployment SetupCtrl Class)
O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} https://officescan.swisher.com:4343/offices…root/AtxEnc.cab (Encrypt Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.1.1.5 10.1.1.6
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{07386250-4791-4543-9A76-B8140BB75FF3}: DhcpNameServer = 10.1.1.5 10.1.1.6
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (wvauth) -C:\WINDOWS\System32\wvauth.dll (Wave Systems Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/25 17:29:32 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/09/16 06:37:46 | 000,000,000 | R–D | C] – C:\Documents and Settings\Admin\Start Menu\Programs\Administrative Tools
[2011/09/16 06:35:01 | 001,916,416 | —- | C] (AVAST Software) – C:\Documents and Settings\Admin\Desktop\aswMBR.exe
[2011/09/15 15:42:10 | 000,607,260 | R— | C] (Swearware) – C:\Documents and Settings\Admin\Desktop\dds.scr
[2011/09/15 15:41:17 | 000,581,632 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Admin\Desktop\OTL.exe
[2011/09/15 15:40:53 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Admin\Desktop\HiJackThis.exe
[2011/09/14 12:38:36 | 000,000,000 | —D | C] – C:\WINDOWS\System32\Adobe
[2011/09/14 07:51:45 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/09/12 14:29:06 | 000,000,000 | —D | C] – C:\Program Files\Common Files\McAfee
[2011/09/12 14:28:58 | 000,000,000 | —D | C] – C:\Program Files\McAfee
[2011/09/12 12:38:02 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Application Data\Roxio
[2011/09/09 15:40:59 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Apple Computer
[2011/09/09 15:16:41 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Windows Search
[2011/09/09 15:15:54 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\McAfee
[2011/09/09 15:15:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee Security Scan Plus
[2011/09/09 15:14:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee Security Scan
[2011/09/09 15:14:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2011/09/09 15:14:37 | 000,000,000 | —D | C] – C:\Program Files\McAfee Security Scan
[2011/09/09 06:51:31 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Temp
[2011/09/09 06:51:31 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2011/09/09 06:51:31 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/09/06 08:25:43 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Minit-Charger
[2011/09/06 08:25:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Minit-Charger
[2011/09/06 08:25:40 | 000,000,000 | —D | C] – C:\Program Files\Minit-Charger
[2011/09/06 07:37:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/09/06 07:36:25 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/09/06 07:36:22 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/09/03 06:17:37 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\crypt32.dll
[2011/09/01 07:26:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Application Data\AVG10
[2011/09/01 07:24:34 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/09/01 07:24:34 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\AVG
[2011/09/01 07:23:39 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2011/09/01 06:41:33 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/09/01 06:41:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/08/30 10:31:27 | 000,000,000 | —D | C] – C:\Config.Msi
[2011/08/30 10:31:24 | 000,000,000 | —D | C] – C:\Program Files\Yontoo Layers Runtime
[2011/08/30 10:31:24 | 000,000,000 | —D | C] – C:\Program Files\STMicroelectronics
[2011/08/29 15:06:12 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Intel Corporation
[2011/08/29 15:04:13 | 000,000,000 | —D | C] – C:\Program Files\Intel
[2011/08/29 12:17:39 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/08/29 11:52:36 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2011/08/26 14:57:03 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2011/08/26 14:55:24 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2011/08/26 14:54:48 | 000,000,000 | —D | C] – C:\b8ed71244db11b877a
[2011/08/25 08:07:02 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Sun
[2011/08/25 06:46:37 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/08/24 20:11:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Start Menu\Programs\Google Chrome
[2011/08/24 19:17:21 | 000,000,000 | —D | C] – C:\WINDOWS\ServicePackFiles
[2011/08/24 18:58:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2011/08/24 15:13:54 | 000,954,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40.dll
[2011/08/24 15:13:54 | 000,953,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40u.dll
[2011/08/24 15:13:41 | 000,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comctl32.dll
[2011/08/24 15:13:37 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2011/08/24 15:13:29 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndproxy.sys
[2011/08/24 15:13:05 | 000,139,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpwd.sys
[2011/08/24 15:13:04 | 000,105,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mup.sys
[2011/08/24 14:51:24 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Application Data\Malwarebytes
[2011/08/24 14:51:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/24 14:51:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/08/24 14:51:14 | 000,022,216 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/08/24 14:51:14 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/08/24 14:42:30 | 000,852,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vgx.dll
[2011/08/24 14:42:20 | 000,010,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndistapi.sys
[2011/08/24 14:42:18 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab.exe
[2011/08/23 15:08:27 | 000,000,000 | —D | C] – C:\WINDOWS\System32\PreInstall
[2011/08/23 15:04:39 | 000,000,000 | —D | C] – C:\WINDOWS\System32\SoftwareDistribution
[2011/08/23 15:00:39 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/08/23 14:49:53 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2011/08/23 14:49:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Application Data\A3EAC15C3C5C76B49A332F5DD87897E6
[2011/08/23 14:38:16 | 000,000,000 | —D | C] – C:\WINDOWS\Sun
[2010/09/05 01:38:11 | 000,004,096 | —- | C] ( ) – C:\WINDOWS\System32\IGFXDEVLib.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/17 08:31:39 | 000,000,512 | —- | M] () – C:\Documents and Settings\Admin\Desktop\MBR.dat
[2011/09/17 03:51:51 | 000,016,201 | —- | M] () – C:\WINDOWS\cfgall.ini
[2011/09/17 03:50:47 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/09/17 03:50:23 | 000,000,000 | —- | M] () – C:\Documents and Settings\Admin\Local Settings\Application Data\WavXMapDrive.bat
[2011/09/17 03:50:17 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/09/17 03:50:14 | 3076,427,776 | -HS- | M] () – C:\hiberfil.sys
[2011/09/16 06:35:51 | 000,879,225 | —- | M] () – C:\Documents and Settings\Admin\Desktop\SecurityCheck.exe
[2011/09/16 06:35:08 | 001,916,416 | —- | M] (AVAST Software) – C:\Documents and Settings\Admin\Desktop\aswMBR.exe
[2011/09/16 06:34:09 | 000,607,260 | R— | M] (Swearware) – C:\Documents and Settings\Admin\Desktop\dds.scr
[2011/09/15 17:17:04 | 000,001,809 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/09/15 15:41:17 | 000,581,632 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Admin\Desktop\OTL.exe
[2011/09/15 15:40:53 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Admin\Desktop\HiJackThis.exe
[2011/09/15 10:18:50 | 000,002,497 | —- | M] () – C:\Documents and Settings\Admin\Desktop\Microsoft Office Word 2003.lnk
[2011/09/15 07:40:23 | 000,000,786 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/15 02:48:26 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/09/13 07:19:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/09/12 12:48:37 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/09/09 15:15:45 | 000,001,619 | —- | M] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2011/09/09 15:15:45 | 000,001,611 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/09/09 05:12:13 | 000,599,040 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\crypt32.dll
[2011/09/08 06:40:05 | 000,475,520 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/09/08 06:40:05 | 000,083,118 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/09/06 08:25:54 | 000,000,942 | —- | M] () – C:\Documents and Settings\All Users\Desktop\BICC-Tool 2008.lnk
[2011/09/06 07:47:17 | 000,000,744 | —- | M] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/09/06 07:47:16 | 000,000,726 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/09/06 07:37:42 | 000,001,544 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/08/31 17:00:50 | 000,022,216 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/08/31 10:31:35 | 000,000,376 | —- | M] () – C:\WINDOWS\ODBC.INI
[2011/08/25 08:07:20 | 000,102,400 | —- | M] () – C:\WINDOWS\RegBootClean.exe
[2011/08/24 20:13:09 | 000,002,286 | —- | M] () – C:\Documents and Settings\Admin\Desktop\Google Chrome.lnk
[2011/08/24 20:13:09 | 000,002,264 | —- | M] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/08/24 20:00:47 | 000,266,208 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/08/23 06:27:19 | 000,002,187 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/08/22 10:18:08 | 000,131,137 | —- | M] () – C:\Documents and Settings\Admin\My Documents\arzoo head pic..php
[2011/08/22 10:14:38 | 000,133,923 | —- | M] () – C:\Documents and Settings\Admin\My Documents\zora head pic..php
[2011/08/22 10:12:12 | 000,194,147 | —- | M] () – C:\Documents and Settings\Admin\My Documents\farah.html
[2011/08/22 08:05:22 | 000,000,806 | —- | M] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/08/22 08:05:22 | 000,000,788 | —- | M] () – C:\Documents and Settings\Admin\Desktop\Windows Media Player.lnk
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/16 06:41:00 | 000,000,512 | —- | C] () – C:\Documents and Settings\Admin\Desktop\MBR.dat
[2011/09/16 06:35:51 | 000,879,225 | —- | C] () – C:\Documents and Settings\Admin\Desktop\SecurityCheck.exe
[2011/09/09 15:14:38 | 000,001,619 | —- | C] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2011/09/09 15:14:38 | 000,001,611 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/09/06 08:25:54 | 000,000,942 | —- | C] () – C:\Documents and Settings\All Users\Desktop\BICC-Tool 2008.lnk
[2011/09/06 07:47:16 | 000,000,744 | —- | C] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/09/06 07:47:16 | 000,000,732 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/09/06 07:47:16 | 000,000,726 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/09/06 07:37:42 | 000,001,544 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/08/30 10:32:22 | 3076,427,776 | -HS- | C] () – C:\hiberfil.sys
[2011/08/29 12:17:39 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/08/24 20:20:47 | 000,158,464 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/08/24 20:13:09 | 000,002,286 | —- | C] () – C:\Documents and Settings\Admin\Desktop\Google Chrome.lnk
[2011/08/24 20:13:09 | 000,002,264 | —- | C] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/08/24 14:51:19 | 000,000,786 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/23 14:50:11 | 000,102,400 | —- | C] () – C:\WINDOWS\RegBootClean.exe
[2011/08/22 10:18:08 | 000,131,137 | —- | C] () – C:\Documents and Settings\Admin\My Documents\arzoo head pic..php
[2011/08/22 10:14:38 | 000,133,923 | —- | C] () – C:\Documents and Settings\Admin\My Documents\zora head pic..php
[2011/08/22 10:12:12 | 000,194,147 | —- | C] () – C:\Documents and Settings\Admin\My Documents\farah.html
[2011/08/22 08:05:22 | 000,000,806 | —- | C] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/06/28 10:16:26 | 000,055,304 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/06/16 14:04:17 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2011/06/16 13:42:59 | 000,016,201 | —- | C] () – C:\WINDOWS\cfgall.ini
[2011/06/16 13:36:12 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2011/06/16 13:27:53 | 000,000,000 | —- | C] () – C:\Documents and Settings\Admin\Local Settings\Application Data\WavXMapDrive.bat
[2010/09/05 01:38:16 | 000,077,824 | —- | C] () – C:\WINDOWS\setpwr32.exe
[2010/09/05 01:38:11 | 000,870,560 | —- | C] () – C:\WINDOWS\System32\igkrng575.bin
[2010/09/05 01:38:11 | 000,127,868 | —- | C] () – C:\WINDOWS\System32\igcompkrng575.bin
[2010/09/05 01:38:11 | 000,000,151 | —- | C] () – C:\WINDOWS\System32\GfxUI.exe.config
[2010/09/04 23:11:25 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2010/09/04 22:58:31 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2010/09/04 22:58:30 | 000,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2010/09/04 22:58:30 | 000,025,088 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2010/09/04 22:56:47 | 000,080,368 | —- | C] () – C:\WINDOWS\System32\pbadrvdll.dll
[2010/09/04 22:56:24 | 000,000,206 | —- | C] () – C:\WINDOWS\hbcikrnl.ini
[2010/07/31 07:04:03 | 000,001,156 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2010/03/02 13:46:38 | 000,010,752 | —- | C] () – C:\WINDOWS\System32\Wavx_ESC_Logging.dll
[2010/02/25 22:59:02 | 002,860,384 | —- | C] () – C:\WINDOWS\System32\btwicons.dll
[2010/02/04 12:18:22 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\Internationalization_th.dll
[2010/02/04 12:18:22 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-HK.dll
[2010/02/04 12:18:20 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_sl.dll
[2010/02/04 12:18:18 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_sk.dll
[2010/02/04 12:18:18 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_hr.dll
[2010/02/04 12:18:12 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_ro.dll
[2010/02/04 12:18:12 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_tr.dll
[2010/02/04 12:18:10 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_pt-BR.dll
[2010/02/04 12:18:10 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_hu.dll
[2010/02/04 12:18:08 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_fi.dll
[2010/02/04 12:18:08 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\Internationalization_he.dll
[2010/02/04 12:18:06 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\Internationalization_el.dll
[2010/02/04 12:18:06 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_cs.dll
[2010/02/04 12:18:04 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\Internationalization_ar.dll
[2010/02/04 12:18:04 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-CHT.dll
[2010/02/04 12:18:02 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-CHS.dll
[2010/02/04 12:18:00 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_sv.dll
[2010/02/04 12:18:00 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_ru.dll
[2010/02/04 12:17:58 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_pt.dll
[2010/02/04 12:17:58 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_pl.dll
[2010/02/04 12:17:56 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\Internationalization_nl.dll
[2010/02/04 12:17:56 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_no.dll
[2010/02/04 12:17:54 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\Internationalization_ko.dll
[2010/02/04 12:17:54 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\Internationalization_ja.dll
[2010/02/04 12:17:52 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_it.dll
[2010/02/04 12:17:50 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_fr.dll
[2010/02/04 12:17:50 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_es.dll
[2010/02/04 12:17:48 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_de.dll
[2010/02/04 12:17:46 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_da.dll
[2010/01/19 13:44:30 | 000,249,856 | —- | C] () – C:\WINDOWS\System32\wxvault.dll
[2009/11/06 16:27:22 | 000,839,680 | —- | C] () – C:\WINDOWS\System32\DemoLicense.dll
[2009/08/26 17:25:08 | 000,917,504 | —- | C] () – C:\WINDOWS\System32\lmgr10.dll
[2009/01/20 13:32:04 | 000,024,056 | —- | C] () – C:\WINDOWS\System32\providers.bin
[2008/05/26 22:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 22:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2008/04/25 17:31:41 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2008/04/25 17:27:18 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2008/04/25 17:26:32 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2008/04/25 12:16:24 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2008/04/25 12:16:22 | 000,475,520 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2008/04/25 12:16:22 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2008/04/25 12:16:22 | 000,083,118 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2008/04/25 12:16:22 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2008/04/25 12:16:22 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2008/04/25 12:16:21 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2008/04/25 12:16:20 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2008/04/25 12:16:18 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2008/04/25 12:16:18 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2008/04/25 12:16:13 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2008/04/25 12:16:11 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2008/04/25 05:22:39 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2008/04/25 05:21:52 | 000,266,208 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/03/25 10:46:00 | 000,077,536 | —- | C] () – C:\WINDOWS\System32\xltZlib.dll
[2007/09/27 11:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 11:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 11:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2006/06/30 13:58:44 | 000,176,128 | —- | C] () – C:\WINDOWS\System32\bioapi_mds300.dll
[2006/06/30 13:58:44 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\bioapi100.dll
[2006/04/27 12:43:28 | 000,000,125 | —- | C] () – C:\WINDOWS\System32\EMCUsbUn.ini
[2005/09/02 15:44:04 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\EMCUsbUn.exe
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2001/11/14 13:56:00 | 001,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll

========== LOP Check ==========

[2011/08/24 15:31:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Admin\Application Data\A3EAC15C3C5C76B49A332F5DD87897E6
[2011/09/01 07:26:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Admin\Application Data\AVG10
[2010/09/04 23:11:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Admin\Application Data\Broadcom
[2010/09/04 23:03:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Admin\Application Data\Wave Systems Corp
[2010/09/04 22:55:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Admin\Application Data\Windows Desktop Search
[2011/06/16 13:38:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Admin\Application Data\Windows Search
[2011/09/01 17:19:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/09/01 06:41:33 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/07/14 11:36:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FileCure
[2011/09/01 17:18:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2010/09/04 23:01:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NTRU Cryptosystems
[2011/08/29 13:51:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2010/09/04 23:05:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Uninstall
[2010/09/04 23:02:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Wave Systems Corp
[2011/06/28 09:13:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

========== Purity Check ==========



< End of report >

i did not get an extras this time. I will run it again.

yes it is a work computer, the IT department has no idea how to fix it. My internet line is straight out onto the net without restrictions so i do not have the protection of their server system.

here is the OTC extras you asked for previously and a new Mbam log.

OTL logfile created on: 9/17/2011 5:01:46 PM - Run 3
OTL by OldTimer - Version 3.2.28.0 Folder = C:\Documents and Settings\Admin\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 1.77 Gb Available Physical Memory | 61.89% Memory free
4.71 Gb Paging File | 3.69 Gb Available in Paging File | 78.49% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.05 Gb Total Space | 272.35 Gb Free Space | 91.38% Space Free | Partition Type: NTFS

Computer Name: D7Q3X6N1 | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Admin\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
PRC - C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Program Files\IDT\WDM\stacsv.exe (IDT, Inc.)
PRC - C:\WINDOWS\system32\AESTFltr.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Fingerprint Sensor\AtService.exe (AuthenTec, Inc.)
PRC - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.)
PRC - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe (Wave Systems Corp.)
PRC - c:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe (Dell Inc.)
PRC - c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (Dell Inc.)
PRC - c:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe (Dell Inc.)
PRC - C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe (Broadcom Corporation)
PRC - C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.)
PRC - C:\Program Files\Trend Micro\OfficeScan Client\PccNTMon.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\OfficeScan Client\TmListen.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\OfficeScan Client\NTRtScan.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\BM\TMBMSRV.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe (Trend Micro Inc.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\6e563a58e6fc0117070d5b8fd59e4e1b\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d00cc387e462e4c3cdcd112b137cac87\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\7ed09623172a292eaee51e2e3bcaf784\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\10154dcad2d62f226af2fd4211460a4b\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\77df2cd21a5b85a1605b335aa9ad9d44\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e6c79e1d71b0c9000afd7e5e439b5c54\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\Status Lib\1.6.460.18066__f25c74fcad379103\Status Lib.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\StatusInterfaces\1.6.460.18065__4ca2a925deedf37d\StatusInterfaces.dll ()
MOD - C:\Program Files\Java\jre6\bin\jp2native.dll ()
MOD - C:\WINDOWS\system32\Wavx_ESC_Logging.dll ()
MOD - C:\WINDOWS\system32\btwicons.dll ()
MOD - C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll ()
MOD - C:\WINDOWS\system32\wxvault.dll ()
MOD - C:\WINDOWS\system32\preflib.dll ()
MOD - C:\WINDOWS\system32\bcm1xsup.dll ()
MOD - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\TspPopup_ENU.dll ()


========== Win32 Services (SafeList) ==========

SRV - (MsMpSvc) – File not found
SRV - (IAStorDataMgrSvc) Intel® – File not found
SRV - (McAfee SiteAdvisor Service) – c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (STacSV) – C:\Program Files\IDT\WDM\stacsv.exe (IDT, Inc.)
SRV - (ATService) – C:\Program Files\Fingerprint Sensor\AtService.exe (AuthenTec, Inc.)
SRV - (TdmService) – C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.)
SRV - (SecureStorageService) – C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe (Wave Systems Corp.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (dcpsysmgrsvc) – c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (Dell Inc.)
SRV - (buttonsvc32) – c:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe (Dell Inc.)
SRV - (BrcmMgmtAgent) – C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe (Broadcom Corporation)
SRV - (tmlisten) – C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe (Trend Micro Inc.)
SRV - (ntrtscan) – C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe (Trend Micro Inc.)
SRV - (TmProxy) – C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe (Trend Micro Inc.)
SRV - (TMBMServer) – C:\Program Files\Trend Micro\OfficeScan Client\..\BM\TMBMSRV.exe ()
SRV - (tcsd_win32.exe) – C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe ()


========== Driver Services (SafeList) ==========

DRV - (TmFilter) – C:\Program Files\Trend Micro\OfficeScan Client\TmXpflt.sys (Trend Micro Inc.)
DRV - (TmPreFilter) – C:\Program Files\Trend Micro\OfficeScan Client\TmPreflt.sys (Trend Micro Inc.)
DRV - (VSApiNt) – C:\Program Files\Trend Micro\OfficeScan Client\vsapiNT.sys (Trend Micro Inc.)
DRV - (tmactmon) – C:\WINDOWS\system32\drivers\tmactmon.sys (Trend Micro Inc.)
DRV - (tmevtmgr) – C:\WINDOWS\system32\drivers\tmevtmgr.sys (Trend Micro Inc.)
DRV - (tmcomm) – C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (IDT, Inc.)
DRV - (AESTAud) – C:\WINDOWS\system32\drivers\AESTAud.sys (Andrea Electronics Corporation)
DRV - (risdpcie) – C:\WINDOWS\system32\drivers\risdpe86.sys (REDC)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (BTKRNL) – C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (btaudio) – C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (BTWDNDIS) – C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (BTDriver) – C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)
DRV - (btwmodem) – C:\WINDOWS\system32\drivers\btwmodem.sys (Broadcom Corporation.)
DRV - (Impcd) – C:\WINDOWS\system32\drivers\Impcd.sys (Intel Corporation)
DRV - (BASFND) – C:\Program Files\Broadcom\MgmtAgent\BASFND.sys (Broadcom Corporation)
DRV - (WavxDMgr) – C:\WINDOWS\system32\drivers\WavxDMgr.sys (Wave Systems Corp.)
DRV - (IntcDAud) Intel® – C:\WINDOWS\system32\drivers\IntcDAud.sys (Intel® Corporation)
DRV - (Acceler) – C:\WINDOWS\system32\drivers\Accelern.sys (ST Microelectronics)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (Blfp) – C:\WINDOWS\system32\drivers\baspxp32.sys (Broadcom Corporation)
DRV - (HECI) Intel® – C:\WINDOWS\system32\drivers\HECI.sys (Intel Corporation)
DRV - (tmtdi) – C:\WINDOWS\system32\drivers\tmtdi.sys (Trend Micro Inc.)
DRV - (PBADRV) – C:\WINDOWS\system32\DRIVERS\PBADRV.sys (Dell Inc)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Help_Page = http://support.dell.com/support/index.aspx…;l=en&s=gen
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USREL/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/sphome.aspx
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://g.msn.com/USREL/1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USREL/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com/sphome.aspx
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2011/09/12 14:29:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/07 09:43:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/09/06 07:47:27 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Admin\Application Data\Mozilla\Extensions
[2011/09/06 07:47:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/09/04 22:55:35 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/09/12 14:29:14 | 000,000,000 | —D | M] (McAfee SiteAdvisor) – C:\PROGRAM FILES\MCAFEE\SITEADVISOR
[2009/11/03 18:19:24 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/09/07 09:43:33 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/08/30 15:41:02 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml

Hosts file not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [DellControlPoint] c:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe File not found
O4 - HKLM..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey File not found
O4 - HKLM..\Run: [OfficeScanNT Monitor] C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [USCService] C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation)
O4 - HKLM..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell ControlPoint System Manager.lnk = C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe (Dell Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TdmNotify.lnk = C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe (Wave Systems Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Send to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send To Bluetooth - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} https://officescan.swisher.com:4343/offices…ll/WinNTChk.cab (ObjWinNTCheck Class)
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} https://officescan.swisher.com:4343/offices…stall/setup.cab (OfficeScan Corp Edition Web-Deployment SetupCtrl Class)
O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} https://officescan.swisher.com:4343/offices…root/AtxEnc.cab (Encrypt Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{07386250-4791-4543-9A76-B8140BB75FF3}: DhcpNameServer = 10.1.1.5 10.1.1.6
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A887247F-D04C-4C8B-9CB5-AB1695F771BC}: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (wvauth) -C:\WINDOWS\System32\wvauth.dll (Wave Systems Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/25 17:29:32 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/09/17 15:56:30 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/09/16 06:37:46 | 000,000,000 | R–D | C] – C:\Documents and Settings\Admin\Start Menu\Programs\Administrative Tools
[2011/09/16 06:35:01 | 001,916,416 | —- | C] (AVAST Software) – C:\Documents and Settings\Admin\Desktop\aswMBR.exe
[2011/09/15 15:42:10 | 000,607,260 | R— | C] (Swearware) – C:\Documents and Settings\Admin\Desktop\dds.scr
[2011/09/15 15:41:17 | 000,581,632 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Admin\Desktop\OTL.exe
[2011/09/15 15:40:53 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Admin\Desktop\HiJackThis.exe
[2011/09/14 12:38:36 | 000,000,000 | —D | C] – C:\WINDOWS\System32\Adobe
[2011/09/14 07:51:45 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/09/12 14:29:06 | 000,000,000 | —D | C] – C:\Program Files\Common Files\McAfee
[2011/09/12 14:28:58 | 000,000,000 | —D | C] – C:\Program Files\McAfee
[2011/09/12 12:38:02 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Application Data\Roxio
[2011/09/09 15:40:59 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Apple Computer
[2011/09/09 15:16:41 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Windows Search
[2011/09/09 15:15:54 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\McAfee
[2011/09/09 15:15:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee Security Scan Plus
[2011/09/09 15:14:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee Security Scan
[2011/09/09 15:14:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2011/09/09 15:14:37 | 000,000,000 | —D | C] – C:\Program Files\McAfee Security Scan
[2011/09/09 06:51:31 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Temp
[2011/09/09 06:51:31 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2011/09/09 06:51:31 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/09/06 08:25:43 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Minit-Charger
[2011/09/06 08:25:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Minit-Charger
[2011/09/06 08:25:40 | 000,000,000 | —D | C] – C:\Program Files\Minit-Charger
[2011/09/06 07:37:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/09/06 07:36:25 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/09/06 07:36:22 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/09/03 06:17:37 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\crypt32.dll
[2011/09/01 07:26:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Application Data\AVG10
[2011/09/01 07:24:34 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/09/01 07:24:34 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\AVG
[2011/09/01 07:23:39 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2011/09/01 06:41:33 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/09/01 06:41:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/08/30 10:31:27 | 000,000,000 | —D | C] – C:\Config.Msi
[2011/08/30 10:31:24 | 000,000,000 | —D | C] – C:\Program Files\Yontoo Layers Runtime
[2011/08/30 10:31:24 | 000,000,000 | —D | C] – C:\Program Files\STMicroelectronics
[2011/08/29 15:06:12 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Intel Corporation
[2011/08/29 15:04:13 | 000,000,000 | —D | C] – C:\Program Files\Intel
[2011/08/29 12:17:39 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/08/29 11:52:36 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2011/08/26 14:57:03 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2011/08/26 14:55:24 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2011/08/26 14:54:48 | 000,000,000 | —D | C] – C:\b8ed71244db11b877a
[2011/08/25 08:07:02 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Sun
[2011/08/25 06:46:37 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/08/24 20:11:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Start Menu\Programs\Google Chrome
[2011/08/24 19:17:21 | 000,000,000 | —D | C] – C:\WINDOWS\ServicePackFiles
[2011/08/24 18:58:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2011/08/24 15:13:54 | 000,954,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40.dll
[2011/08/24 15:13:54 | 000,953,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40u.dll
[2011/08/24 15:13:41 | 000,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comctl32.dll
[2011/08/24 15:13:37 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2011/08/24 15:13:29 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndproxy.sys
[2011/08/24 15:13:05 | 000,139,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpwd.sys
[2011/08/24 15:13:04 | 000,105,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mup.sys
[2011/08/24 14:51:24 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Application Data\Malwarebytes
[2011/08/24 14:51:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/24 14:51:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/08/24 14:51:14 | 000,022,216 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/08/24 14:51:14 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/08/24 14:42:30 | 000,852,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vgx.dll
[2011/08/24 14:42:20 | 000,010,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndistapi.sys
[2011/08/24 14:42:18 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab.exe
[2011/08/23 15:08:27 | 000,000,000 | —D | C] – C:\WINDOWS\System32\PreInstall
[2011/08/23 15:04:39 | 000,000,000 | —D | C] – C:\WINDOWS\System32\SoftwareDistribution
[2011/08/23 15:00:39 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/08/23 14:49:53 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2011/08/23 14:49:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Application Data\A3EAC15C3C5C76B49A332F5DD87897E6
[2011/08/23 14:38:16 | 000,000,000 | —D | C] – C:\WINDOWS\Sun
[2010/09/05 01:38:11 | 000,004,096 | —- | C] ( ) – C:\WINDOWS\System32\IGFXDEVLib.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/17 16:50:11 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/09/17 15:56:30 | 000,041,272 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/09/17 15:53:28 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/09/17 15:53:18 | 000,000,000 | —- | M] () – C:\Documents and Settings\Admin\Local Settings\Application Data\WavXMapDrive.bat
[2011/09/17 15:53:01 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/09/17 15:52:59 | 3076,427,776 | -HS- | M] () – C:\hiberfil.sys
[2011/09/17 03:51:51 | 000,016,201 | —- | M] () – C:\WINDOWS\cfgall.ini
[2011/09/16 06:35:51 | 000,879,225 | —- | M] () – C:\Documents and Settings\Admin\Desktop\SecurityCheck.exe
[2011/09/16 06:35:08 | 001,916,416 | —- | M] (AVAST Software) – C:\Documents and Settings\Admin\Desktop\aswMBR.exe
[2011/09/16 06:34:09 | 000,607,260 | R— | M] (Swearware) – C:\Documents and Settings\Admin\Desktop\dds.scr
[2011/09/15 17:17:04 | 000,001,809 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/09/15 15:41:17 | 000,581,632 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Admin\Desktop\OTL.exe
[2011/09/15 15:40:53 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Admin\Desktop\HiJackThis.exe
[2011/09/15 10:18:50 | 000,002,497 | —- | M] () – C:\Documents and Settings\Admin\Desktop\Microsoft Office Word 2003.lnk
[2011/09/15 07:40:23 | 000,000,786 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/13 07:19:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/09/12 12:48:37 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/09/09 15:15:45 | 000,001,619 | —- | M] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2011/09/09 15:15:45 | 000,001,611 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/09/09 05:12:13 | 000,599,040 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\crypt32.dll
[2011/09/08 06:40:05 | 000,475,520 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/09/08 06:40:05 | 000,083,118 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/09/06 08:25:54 | 000,000,942 | —- | M] () – C:\Documents and Settings\All Users\Desktop\BICC-Tool 2008.lnk
[2011/09/06 07:47:17 | 000,000,744 | —- | M] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/09/06 07:47:16 | 000,000,726 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/09/06 07:37:42 | 000,001,544 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/08/31 17:00:50 | 000,022,216 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/08/31 10:31:35 | 000,000,376 | —- | M] () – C:\WINDOWS\ODBC.INI
[2011/08/25 08:07:20 | 000,102,400 | —- | M] () – C:\WINDOWS\RegBootClean.exe
[2011/08/24 20:13:09 | 000,002,286 | —- | M] () – C:\Documents and Settings\Admin\Desktop\Google Chrome.lnk
[2011/08/24 20:13:09 | 000,002,264 | —- | M] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/08/24 20:00:47 | 000,266,208 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/08/23 06:27:19 | 000,002,187 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/08/22 10:18:08 | 000,131,137 | —- | M] () – C:\Documents and Settings\Admin\My Documents\arzoo head pic..php
[2011/08/22 10:14:38 | 000,133,923 | —- | M] () – C:\Documents and Settings\Admin\My Documents\zora head pic..php
[2011/08/22 10:12:12 | 000,194,147 | —- | M] () – C:\Documents and Settings\Admin\My Documents\farah.html
[2011/08/22 08:05:22 | 000,000,806 | —- | M] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/08/22 08:05:22 | 000,000,788 | —- | M] () – C:\Documents and Settings\Admin\Desktop\Windows Media Player.lnk
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/16 06:35:51 | 000,879,225 | —- | C] () – C:\Documents and Settings\Admin\Desktop\SecurityCheck.exe
[2011/09/09 15:14:38 | 000,001,619 | —- | C] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2011/09/09 15:14:38 | 000,001,611 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/09/06 08:25:54 | 000,000,942 | —- | C] () – C:\Documents and Settings\All Users\Desktop\BICC-Tool 2008.lnk
[2011/09/06 07:47:16 | 000,000,744 | —- | C] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/09/06 07:47:16 | 000,000,732 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/09/06 07:47:16 | 000,000,726 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/09/06 07:37:42 | 000,001,544 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/08/30 10:32:22 | 3076,427,776 | -HS- | C] () – C:\hiberfil.sys
[2011/08/29 12:17:39 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/08/24 20:20:47 | 000,158,464 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/08/24 20:13:09 | 000,002,286 | —- | C] () – C:\Documents and Settings\Admin\Desktop\Google Chrome.lnk
[2011/08/24 20:13:09 | 000,002,264 | —- | C] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/08/24 14:51:19 | 000,000,786 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/23 14:50:11 | 000,102,400 | —- | C] () – C:\WINDOWS\RegBootClean.exe
[2011/08/22 10:18:08 | 000,131,137 | —- | C] () – C:\Documents and Settings\Admin\My Documents\arzoo head pic..php
[2011/08/22 10:14:38 | 000,133,923 | —- | C] () – C:\Documents and Settings\Admin\My Documents\zora head pic..php
[2011/08/22 10:12:12 | 000,194,147 | —- | C] () – C:\Documents and Settings\Admin\My Documents\farah.html
[2011/08/22 08:05:22 | 000,000,806 | —- | C] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/06/28 10:16:26 | 000,055,304 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/06/16 14:04:17 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2011/06/16 13:42:59 | 000,016,201 | —- | C] () – C:\WINDOWS\cfgall.ini
[2011/06/16 13:36:12 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2011/06/16 13:27:53 | 000,000,000 | —- | C] () – C:\Documents and Settings\Admin\Local Settings\Application Data\WavXMapDrive.bat
[2010/09/05 01:38:16 | 000,077,824 | —- | C] () – C:\WINDOWS\setpwr32.exe
[2010/09/05 01:38:11 | 000,870,560 | —- | C] () – C:\WINDOWS\System32\igkrng575.bin
[2010/09/05 01:38:11 | 000,127,868 | —- | C] () – C:\WINDOWS\System32\igcompkrng575.bin
[2010/09/05 01:38:11 | 000,000,151 | —- | C] () – C:\WINDOWS\System32\GfxUI.exe.config
[2010/09/04 23:11:25 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2010/09/04 22:58:31 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2010/09/04 22:58:30 | 000,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2010/09/04 22:58:30 | 000,025,088 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2010/09/04 22:56:47 | 000,080,368 | —- | C] () – C:\WINDOWS\System32\pbadrvdll.dll
[2010/09/04 22:56:24 | 000,000,206 | —- | C] () – C:\WINDOWS\hbcikrnl.ini
[2010/07/31 07:04:03 | 000,001,156 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2010/03/02 13:46:38 | 000,010,752 | —- | C] () – C:\WINDOWS\System32\Wavx_ESC_Logging.dll
[2010/02/25 22:59:02 | 002,860,384 | —- | C] () – C:\WINDOWS\System32\btwicons.dll
[2010/02/04 12:18:22 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\Internationalization_th.dll
[2010/02/04 12:18:22 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-HK.dll
[2010/02/04 12:18:20 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_sl.dll
[2010/02/04 12:18:18 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_sk.dll
[2010/02/04 12:18:18 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_hr.dll
[2010/02/04 12:18:12 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_ro.dll
[2010/02/04 12:18:12 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_tr.dll
[2010/02/04 12:18:10 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_pt-BR.dll
[2010/02/04 12:18:10 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_hu.dll
[2010/02/04 12:18:08 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_fi.dll
[2010/02/04 12:18:08 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\Internationalization_he.dll
[2010/02/04 12:18:06 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\Internationalization_el.dll
[2010/02/04 12:18:06 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_cs.dll
[2010/02/04 12:18:04 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\Internationalization_ar.dll
[2010/02/04 12:18:04 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-CHT.dll
[2010/02/04 12:18:02 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-CHS.dll
[2010/02/04 12:18:00 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_sv.dll
[2010/02/04 12:18:00 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_ru.dll
[2010/02/04 12:17:58 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_pt.dll
[2010/02/04 12:17:58 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_pl.dll
[2010/02/04 12:17:56 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\Internationalization_nl.dll
[2010/02/04 12:17:56 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_no.dll
[2010/02/04 12:17:54 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\Internationalization_ko.dll
[2010/02/04 12:17:54 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\Internationalization_ja.dll
[2010/02/04 12:17:52 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_it.dll
[2010/02/04 12:17:50 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_fr.dll
[2010/02/04 12:17:50 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_es.dll
[2010/02/04 12:17:48 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_de.dll
[2010/02/04 12:17:46 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_da.dll
[2010/01/19 13:44:30 | 000,249,856 | —- | C] () – C:\WINDOWS\System32\wxvault.dll
[2009/11/06 16:27:22 | 000,839,680 | —- | C] () – C:\WINDOWS\System32\DemoLicense.dll
[2009/08/26 17:25:08 | 000,917,504 | —- | C] () – C:\WINDOWS\System32\lmgr10.dll
[2009/01/20 13:32:04 | 000,024,056 | —- | C] () – C:\WINDOWS\System32\providers.bin
[2008/05/26 22:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 22:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2008/04/25 17:31:41 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2008/04/25 17:27:18 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2008/04/25 17:26:32 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2008/04/25 12:16:24 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2008/04/25 12:16:22 | 000,475,520 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2008/04/25 12:16:22 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2008/04/25 12:16:22 | 000,083,118 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2008/04/25 12:16:22 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2008/04/25 12:16:22 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2008/04/25 12:16:21 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2008/04/25 12:16:20 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2008/04/25 12:16:18 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2008/04/25 12:16:18 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2008/04/25 12:16:13 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2008/04/25 12:16:11 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2008/04/25 05:22:39 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2008/04/25 05:21:52 | 000,266,208 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/03/25 10:46:00 | 000,077,536 | —- | C] () – C:\WINDOWS\System32\xltZlib.dll
[2007/09/27 11:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 11:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 11:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2006/06/30 13:58:44 | 000,176,128 | —- | C] () – C:\WINDOWS\System32\bioapi_mds300.dll
[2006/06/30 13:58:44 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\bioapi100.dll
[2006/04/27 12:43:28 | 000,000,125 | —- | C] () – C:\WINDOWS\System32\EMCUsbUn.ini
[2005/09/02 15:44:04 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\EMCUsbUn.exe
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2001/11/14 13:56:00 | 001,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll

========== LOP Check ==========

[2011/08/24 15:31:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Admin\Application Data\A3EAC15C3C5C76B49A332F5DD87897E6
[2011/09/01 07:26:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Admin\Application Data\AVG10
[2010/09/04 23:11:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Admin\Application Data\Broadcom
[2010/09/04 23:03:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Admin\Application Data\Wave Systems Corp
[2010/09/04 22:55:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Admin\Application Data\Windows Desktop Search
[2011/06/16 13:38:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Admin\Application Data\Windows Search
[2011/09/01 17:19:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/09/01 06:41:33 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/07/14 11:36:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FileCure
[2011/09/01 17:18:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2010/09/04 23:01:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NTRU Cryptosystems
[2011/08/29 13:51:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2010/09/04 23:05:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Uninstall
[2010/09/04 23:02:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Wave Systems Corp
[2011/06/28 09:13:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

========== Purity Check ==========



< End of report >


Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7721

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

9/17/2011 4:59:40 PM
mbam-log-2011-09-17 (16-59-40).txt

Scan type: Full scan (C:\|)
Objects scanned: 253584
Time elapsed: 1 hour(s), 2 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


keep in mind that even though mbam is picking up nothing there is still an issue. I have been redirected and had the added window come up twice now. When I say added window its like hitting the + on firefox and and opening up a whole new window to use. Except it does it on its own and its always a site trying to see me some junk.

thank you so much for helping me

the previous mbam:

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7685

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

9/12/2011 10:29:21 AM
mbam-log-2011-09-12 (10-29-21).txt

Scan type: Full scan (C:\|)
Objects scanned: 261661
Time elapsed: 59 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


and the extras:

OTL Extras logfile created on: 9/17/2011 5:01:46 PM - Run 3
OTL by OldTimer - Version 3.2.28.0 Folder = C:\Documents and Settings\Admin\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 1.77 Gb Available Physical Memory | 61.89% Memory free
4.71 Gb Paging File | 3.69 Gb Available in Paging File | 78.49% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.05 Gb Total Space | 272.35 Gb Free Space | 91.38% Space Free | Partition Type: NTFS

Computer Name: D7Q3X6N1 | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe shdocvw.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
InternetShortcut [open] – rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management
"80:TCP" = 80:TCP:*:Disabled:Windows Remote Management - Compatibility Mode (HTTP-In)
"39375:TCP" = 39375:TCP:*:Enabled:Trend Micro OfficeScan Listener
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG10\avgmfapx.exe" = C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:AVG Installer


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0003C1E0-E0E7-49BB-A0F6-4AE6D2B09202}" = UPEK TouchChip Fingerprint Reader
"{01C6D0D1-0829-4AB3-955D-59FF12A14931}" = OBD-PC Link
"{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE 10.3
"{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{314E5785-BD81-47FD-9D6B-5C3CD31B351B}" = Dell ControlPoint System Manager
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35748B06-FCFC-4700-8285-DAD41689E4FE}" = Broadcom TPM Driver Installer
"{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor
"{3A6BE9F4-5FC8-44BB-BE7B-32A29607FEF6}" = Preboot Manager
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{560DCF39-61D1-43B0-86DA-5EFF8F7A5144}" = AuthenTec Fingerprint Software
"{5FDA8F6A-E87C-484B-BDE2-12C1BE199149}" = Wave Infrastructure Installer
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{62BFB4C2-8C4E-4D91-BD7D-81C06EAAC3C0}" = Windows Rights Management Client with Service Pack 2
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{69995C7A-062A-4A90-A4DF-8C22895DF522}" = iTunes
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{735619D4-B42A-437A-958C-199BFCAEDB38}" = Safari
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95EF5536-580A-4E57-8EF3-B6ACBFBFAF96}" = O2Micro OZ776 SCR Driver
"{982E1601-0DFC-4FD3-A427-AC6570697858}" = Broadcom NetXtreme-I Netlink Driver and Management Installer
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A9C61491-EF2F-4ED8-8E10-FB33E3C6B55A}" = Dell Control Point
"{ABBA2EA4-740E-4052-902B-9CA70B081E3F}" = Dell Embassy Trust Suite by Wave Systems
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{AD7FC27B-519A-48CB-B996-71A1B367F751}" = Ligos Indeo® Codecs
"{AF7E4468-E364-4991-BC2A-6E8293E1055B}" = BioAPI Framework
"{B0585E15-E03C-4F62-B20E-84639D4A01E5}" = Dell Backup and Recovery Manager
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB93D30B-B395-44BB-A9ED-A0E057F07E53}" = NTRU TCG Software Stack
"{BC52E419-B185-488F-9973-049A88E5DCBE}" = Gemalto
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC47B10A-6F54-433F-8C44-FA4AD607BFD3}" = is CAN Multidriver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D03482C5-9AD8-496D-B388-692AE04C93AF}" = Bonjour
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{DDD6BE8C-9AFA-48F1-A6AE-3BD596E2EB0B}" = Trusted Drive Manager
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"{EC905264-BCFE-423B-9C42-C3A106266790}" = Windows Rights Management Client Backwards Compatibility SP2
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE 10.3
"{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F4487649-7368-4217-AEA3-1E04DB3E2C5C}" = Dell ControlPoint Security Manager
"{F48BE301-EC78-4686-B580-EE4934558798}" = WIDCOMM Bluetooth Software
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FF1DDCF4-3A28-4F7F-96D8-E3F4BD1C1702}" = Dell Security Device Driver Pack
"9512AA21B791B05A54E27065C45BBC417AB282DF" = Windows Driver Package - Dell Inc. PBADRV System (09/11/2009 1.0.1.6)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"D3F88C3864C8C031A7C5D5E63A76571EC1B047DF" = Windows Driver Package - AuthenTec Inc. (ATSwpWDF) Biometric (05/13/2009 8.4.2.0)
"DW WLAN Card Utility" = DW WLAN Card Utility
"ETACC YALE 2.10" = ETACC YALE 2.10
"InstallShield_{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"InstallShield_{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"InstallShield_{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"InstallShield_{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"InstallShield_{95EF5536-580A-4E57-8EF3-B6ACBFBFAF96}" = O2Micro OZ776 SCR Driver
"InstallShield_{CC47B10A-6F54-433F-8C44-FA4AD607BFD3}" = is CAN Multidriver
"InstallShield_{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"InstallShield_{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"InstallShield_{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"Kyocera Product Library" = Kyocera Product Library
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Minit-Tools 2009" = Minit-Charger Software Tools 2008-2009 ([removed])
"Mozilla Firefox 6.0.2 (x86 en-US)" = Mozilla Firefox 6.0.2 (x86 en-US)
"OfficeScanNT" = Trend Micro OfficeScan Client
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WinLiveSuite_Wave3" = Windows Live Essentials
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/31/2011 1:58:06 PM | Computer Name = D7Q3X6N1 | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3921C115C15D0ECA5CCB5BC4F07D21D8050B566A.crt>
with error: The connection with the server was terminated abnormally

Error - 8/31/2011 1:58:06 PM | Computer Name = D7Q3X6N1 | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3921C115C15D0ECA5CCB5BC4F07D21D8050B566A.crt>
with error: This network connection does not exist.

Error - 9/1/2011 7:27:48 AM | Computer Name = D7Q3X6N1 | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module wininet.dll, version 6.0.2900.6126, fault address 0x00003670.

Error - 9/1/2011 8:25:24 AM | Computer Name = D7Q3X6N1 | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 11.0.5604.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 9/12/2011 6:52:23 AM | Computer Name = D7Q3X6N1 | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/25019019CFFBD9991CB76825748D945F30939542.crt>
with error: The connection with the server was terminated abnormally

Error - 9/12/2011 6:52:23 AM | Computer Name = D7Q3X6N1 | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/25019019CFFBD9991CB76825748D945F30939542.crt>
with error: This network connection does not exist.

Error - 9/12/2011 4:12:11 PM | Computer Name = D7Q3X6N1 | Source = Microsoft Office 11 | ID = 2001
Description =

Error - 9/14/2011 10:27:17 PM | Computer Name = D7Q3X6N1 | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3921C115C15D0ECA5CCB5BC4F07D21D8050B566A.crt>
with error: The connection with the server was terminated abnormally

Error - 9/14/2011 10:27:17 PM | Computer Name = D7Q3X6N1 | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3921C115C15D0ECA5CCB5BC4F07D21D8050B566A.crt>
with error: This network connection does not exist.

Error - 9/17/2011 8:33:09 AM | Computer Name = D7Q3X6N1 | Source = Application Hang | ID = 1002
Description = Hanging application OTL.exe, version 3.2.28.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 9/17/2011 3:50:45 AM | Computer Name = D7Q3X6N1 | Source = Service Control Manager | ID = 7000
Description = The Microsoft Antimalware Service service failed to start due to the
following error: %%2

Error - 9/17/2011 3:50:45 AM | Computer Name = D7Q3X6N1 | Source = Service Control Manager | ID = 7000
Description = The Intel® Rapid Storage Technology service failed to start due
to the following error: %%2

Error - 9/17/2011 3:50:45 AM | Computer Name = D7Q3X6N1 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
MpFilter

Error - 9/17/2011 8:27:57 AM | Computer Name = D7Q3X6N1 | Source = Dhcp | ID = 1000
Description = Your computer has lost the lease to its IP address 10.1.6.10 on the
Network
Card with network address F04DA28A8F74.

Error - 9/17/2011 3:53:25 PM | Computer Name = D7Q3X6N1 | Source = Service Control Manager | ID = 7000
Description = The Microsoft Antimalware Service service failed to start due to the
following error: %%2

Error - 9/17/2011 3:53:25 PM | Computer Name = D7Q3X6N1 | Source = Service Control Manager | ID = 7000
Description = The Intel® Rapid Storage Technology service failed to start due
to the following error: %%2

Error - 9/17/2011 3:53:25 PM | Computer Name = D7Q3X6N1 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
MpFilter

Error - 9/17/2011 4:37:31 PM | Computer Name = D7Q3X6N1 | Source = Service Control Manager | ID = 7034
Description = The Windows Audio service terminated unexpectedly. It has done this
1 time(s).

Error - 9/17/2011 4:37:31 PM | Computer Name = D7Q3X6N1 | Source = Service Control Manager | ID = 7031
Description = The Background Intelligent Transfer Service service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in
60000 milliseconds: Restart the service.

Error - 9/17/2011 4:37:47 PM | Computer Name = D7Q3X6N1 | Source = Service Control Manager | ID = 7032
Description = The Service Control Manager tried to take a corrective action (Restart
the service) after the unexpected termination of the Windows Management Instrumentation
service, but this action failed with the following error: %%1056


< End of report >


i really do appreciate your help. for some reason, i had to save these log files on an sd card and post from my home computer.

Hi orpro

for some reason, i had to save these log files on an sd card and post from my home computer.

Please explain the problem: do you mean they wouldn't open in Notepad?

Run TDSSKiller

Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• Press Start Scan
  
  • Only if Malicious objects are found then ensure Cure is selected
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)

======================================================

Download and run ComboFix

Download ComboFix from the following location:

Link

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• See this Link for programs that need to be disabled and instruction on how to disable them.
• Remember to re-enable them when we're done.
• Double click on ComboFix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.
  
  

  [external image: Posted Image]

  
  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
  

  [external image: Posted Image]

  
  Click on Yes, to continue scanning for malware.

Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.

When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt

Please also remember to include the TDSSKiller log

Thanks

Satchfan