Laptop very slow & Searchqu.com/418 forced itself to be default ‘I

My computer is running painfully slow & CPU is running at 100% pretty much all the time. I found the ‘searchqu.com/418’ problem when trying to return my ‘IE new tab page’ to my preferred default setting. I searched it’s name via yahoo & found this help site which informed me I had a malware. I have full AVG + AVGTuneup & have previously done all in it’s optimization processes to try to speed up my laptop. I also trialed full version of Malwarebytes but it hangs.

In preparation to start this new topic I tried to follow your initial instructions to download & run DDS. However the first link didn’t work & link2 said it was a screen saver. So I closed the window & tried OTL instead.

I noted OTL was set to scan new files less than 30days old. Searchqu entered my computer 01Sep2011 making it more than 30days old so it maynot be showing up. The other thing I noted while reading through the Extras.Txt notepad was that the internal clock is set wrong. At the bottom are listed ‘Application Events’ showing the times an event happened. It seems the clock is running about 12hrs slow since it listed an event of the MBam hang as occurring at 10/01/2011 6:44:47pm when it actually happened at 10/02/2011 6:44 am aprox (this morning). If this time clock issue is not related to this current searchqu problem I will start a new topic in the correct category later.

Below are the 2 notepad files produced by OTL after the initial scan:-

Notepad files were too big making this window unstable. I have attached the OTL.Txt - Notepad file because it is 240k.

Below is the Extras.Txt - Notepad file:-

OTL Extras logfile created on: 10/2/2011 11:40:32 AM - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Documents and Settings\Clarissa Townsend\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.03 Gb Available Physical Memory | 51.52% Memory free
4.85 Gb Paging File | 3.99 Gb Available in Paging File | 82.31% Paging File free
Paging file location(s): C:\pagefile.sys 3069 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 84.91 Gb Free Space | 56.97% Space Free | Partition Type: NTFS

Computer Name: YOUR-83675754A1 | User Name: Clarissa Townsend | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management
"80:TCP" = 80:TCP:*:Disabled:Windows Remote Management - Compatibility Mode (HTTP-In)

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger – (Logitech)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Disabled:Logitech Desktop Messenger – (Logitech)
"C:\Program Files\AVG\AVG10\avgmfapx.exe" = C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:AVG Installer – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Seagate\Seagate Dashboard\HipServAgent\HipServAgent.exe" = C:\Program Files\Seagate\Seagate Dashboard\HipServAgent\HipServAgent.exe:*:Enabled:SeagateHipServAgent – (Axentra Corporation)
"C:\Program Files\AVG\AVG10\avgdiagex.exe" = C:\Program Files\AVG\AVG10\avgdiagex.exe:*:Enabled:AVG Diagnostics 2011 – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgnsx.exe" = C:\Program Files\AVG\AVG10\avgnsx.exe:*:Enabled:Online Shield – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgam.exe" = C:\Program Files\AVG\AVG10\avgam.exe:*:Enabled:AVG Alert manager – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgemcx.exe" = C:\Program Files\AVG\AVG10\avgemcx.exe:*:Enabled:Personal E-mail Scanner – (AVG Technologies CZ, s.r.o.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{007F778D-F15C-4EAB-AE92-071D21FAF632}" = Adobe Photoshop Elements 9
"{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0
"{02EED746-8C5A-43C8-BB3D-D29C8B363A4D}" = TOSHIBA Zooming Utility
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5200_series" = Canon MG5200 series MP Drivers
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 3.3
"{1D4EE8FE-F31C-4258-9360-5B8B8309B14B}" = Adobe Premiere Elements 9 Content
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{25080974-6FD5-4230-8C95-E1F8677D0FF6}" = E*TRADE Pro Client
"{25175695-4B20-4298-9F34-C2C57CD277B3}" = Elements STI Installer
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 26
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2A3A4BD6-6CE0-4E2A-80D2-1D0FF6ACBFBA}" = LG United Mobile Driver
"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint
"{2FCE4FC5-6930-40E7-A4F1-F862207424EF}" = InterVideo WinDVD Creator 2
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{37AB0223-AF54-49C5-92AA-BFC9648CD323}" = Adobe Premiere Elements 9 HD Content 3
"{3A57482F-BEBC-47E4-ADA1-6302403C7E50}" = TOSHIBA Accessibility
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C52E7DA-C431-4239-B66B-1BF703D5B194}" = Windows Live Photo Gallery
"{3CBBE028-978B-4876-ABC1-EF9ED6C20C4E}" = Adobe Premiere Elements 9 Content 2
"{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0
"{433EACD8-4747-4A6A-826A-FFA9F39B0D40}" = Elements 9 Organizer
"{43F8F1E5-C740-4293-A309-EA9DD6474DB1}" = MotionDV STUDIO 5.3E LE for DV
"{48CF9A66-5F03-4025-ABD0-B3A3FA095A59}" = TOSHIBA SD Memory Card Format
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{50316C0A-CC2A-460A-9EA5-F486E54AC17D}_is1" = AVG PC Tuneup 2011
"{50D90C59-4F5C-48BC-AFB2-38475412F0CA}" = Adobe Premiere Elements 9 Content 1
"{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"{51F96AEC-D902-4434-A0DC-B9692A21AE7C}" = MobileMe Control Panel
"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"{5BCA8D15-BCB6-421E-9654-238B43456A4F}" = TOSHIBA Controls
"{5D96E2B1-D9AC-46E0-9073-425C5F63E338}" = Touch and Launch
"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes
"{5F9AAF4A-B9B0-489D-AE67-73470A4714FE}" = Adobe Premiere Elements 9 HD Content 1
"{6748E773-5DA0-4D19-8AA5-273B4133A09B}" = SmartSound Quicktracks for Premiere Elements 9.0
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{695B13B2-7919-4EC5-8601-092F0D2DE069}" = AVG 2011
"{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}" = Windows Live Writer
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{727DAFCB-E3AF-46E3-8A38-EB9C3EAA0A88}" = AVG 2011
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7900D3A6-A9E8-4954-ACCB-AB15867978BF}" = TOSHIBA Hotkey Utility
"{7DDC3624-C631-49D1-B281-82EC3A27AA7C}" = Adobe Premiere Elements 9 Content 3
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
"{80977342-27E8-4FF7-8B6A-D8D89461DA7F}" = TouchPad On/Off Utility
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8B12BA86-ADAC-4BA6-B441-FFC591087252}" = TOSHIBA Virtual Sound
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD for TOSHIBA
"{91A10409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office OneNote 2003
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{9A97D672-6C93-4DFA-B527-DE005A761495}" = Video Stream Driver for Panasonic DVC
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB2}" = Paint.NET v3.5.8
"{9D765FA6-F2BC-40AF-8145-50808F9BDF4E}" = DVD-RAM Driver
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A127C3C0-055E-38CF-B38F-1E85F8BBBFFE}" = Adobe Community Help
"{A1BF9950-8CDB-468E-83FA-EACFB00EA7D5}" = Windows Live Sync
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A38D57D1-5F29-4691-B3DD-FE4B3A7B3AFE}" = TOSHIBA Power Saver
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{AC7EE5F1-0DE4-4256-8E43-92B73C8E6019}" = LG Bluetooth Drivers
"{AEB9948B-4FF2-47C9-990E-47014492A0FE}" = MSXML 6.0 Parser
"{AFAC914D-9E83-4A89-8ABE-427521C82CCF}" = Safari
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B609E018-8A33-4BA9-B3D4-C1FD5AECB88C}" = Greeting Card Factory Deluxe 2.0
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3A11907-930D-41AC-A135-CC3B12F92011}" = Seagate Dashboard
"{C43048A9-742C-4DAD-90D2-E3B53C9DB825}" = Logitech QuickCam Software
"{C45F4811-31D5-4786-801D-F79CD06EDD85}" = SD Secure Module
"{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DB0A8A2A-4EA7-4FE3-802E-8A6DEE32696C}_is1" = Orban/Coding Technologies AAC/aacPlus Player Plugin™ 1.0
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{E240C78D-8F35-456A-8876-15FF6901B7E0}" = Adobe Premiere Elements 9 HD Content 2
"{E2AE009D-37E5-4724-A6B8-0ED6A6BA4F68}" = Elements STI Installer
"{EB9955F8-467C-47FC-90F8-12CD5DF684C3}" = Adobe Premiere Elements 9
"{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Photoshop Elements 9" = Adobe Photoshop Elements 9
"Adobe Premiere Elements 9 Content" = Adobe Premiere Elements 9 Content
"Adobe Premiere Elements 9 Content 1" = Adobe Premiere Elements 9 Content 1
"Adobe Premiere Elements 9 Content 2" = Adobe Premiere Elements 9 Content 2
"Adobe Premiere Elements 9 Content 3" = Adobe Premiere Elements 9 Content 3
"Adobe Premiere Elements 9 HD Content 1" = Adobe Premiere Elements 9 HD Content 1
"Adobe Premiere Elements 9 HD Content 2" = Adobe Premiere Elements 9 HD Content 2
"Adobe Premiere Elements 9 HD Content 3" = Adobe Premiere Elements 9 HD Content 3
"am-supercollapse3endless" = Super Collapse! 3 Endless
"Any Video Converter_is1" = Any Video Converter 3.2.7
"AVG" = AVG 2011
"Bejeweled 2" = Bejeweled 2
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"DiskCheckup_is1" = DiskCheckup V3.0
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"EPSON Printer and Utilities" = EPSON Printer Software
"Fn-esse" = TOSHIBA Fn-esse
"Free Desktop Clock_is1" = Free Desktop Clock 2.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{02EED746-8C5A-43C8-BB3D-D29C8B363A4D}" = TOSHIBA Zooming Utility
"InstallShield_{3A57482F-BEBC-47E4-ADA1-6302403C7E50}" = TOSHIBA Accessibility
"InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"InstallShield_{5BCA8D15-BCB6-421E-9654-238B43456A4F}" = TOSHIBA Controls
"InstallShield_{6748E773-5DA0-4D19-8AA5-273B4133A09B}" = SmartSound Quicktracks for Premiere Elements 9.0
"InstallShield_{7900D3A6-A9E8-4954-ACCB-AB15867978BF}" = TOSHIBA Hotkey Utility
"InstallShield_{80977342-27E8-4FF7-8B6A-D8D89461DA7F}" = TouchPad On/Off Utility
"InstallShield_{9A97D672-6C93-4DFA-B527-DE005A761495}" = Video Stream Driver for Panasonic DVC
"InstallShield_{A38D57D1-5F29-4691-B3DD-FE4B3A7B3AFE}" = TOSHIBA Power Saver
"Jigsaw Puzzle Platinum" = Jigsaw Puzzle Platinum
"Logitech Print Service" = Logitech Print Service
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MP Navigator EX 4.0" = Canon MP Navigator EX 4.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Nero PhotoShow Express" = Nero PhotoShow Express
"NeroMultiInstaller!UninstallKey" = Nero Suite
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"PC Diagnostic Tool" = TOSHIBA PC Diagnostic Tool
"Picasa 3" = Picasa 3
"PremElem90" = Adobe Premiere Elements 9
"PuTTY_is1" = PuTTY development snapshot 2010-08-20:r8981
"QcDrv" = Logitech® Camera Driver
"RealArcade 1.2" = RealArcade
"smartmontools" = smartmontools
"SystemRequirementsLab" = System Requirements Lab
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GoToMeeting" = GoToMeeting 4.8.0.723

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9/26/2011 7:02:44 AM | Computer Name = YOUR-83675754A1 | Source = Windows Search Service | ID = 3013
Description = The entry PICTURES\PICASA\SCREEN CAPTURES\FULLSCREEN CAPTURE 9252011 105102 PM.BMP> in the
hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A
device attached to the system is not functioning. (0x8007001f)

Error - 9/26/2011 7:02:44 AM | Computer Name = YOUR-83675754A1 | Source = Windows Search Service | ID = 3013
Description = The entry PICTURES\PICASA\SCREEN CAPTURES\CPU USAGE 4 25SEP2011.JPG> in the hash map cannot
be updated. Context: Application, SystemIndex Catalog Details: A device attached
to the system is not functioning. (0x8007001f)

Error - 9/28/2011 5:37:14 AM | Computer Name = YOUR-83675754A1 | Source = WinMgmt | ID = 27
Description = WinMgmt could not open the repository file. This could be due to
insufficient security access to the "\System32\WBEM\Repository", insufficient
disk space or insufficient memory.

Error - 9/28/2011 5:37:14 AM | Computer Name = YOUR-83675754A1 | Source = SecurityCenter | ID = 1802
Description = The Windows Security Center Service was unable to establish event
queries with WMI to monitor third party AntiVirus and Firewall.

Error - 9/29/2011 7:38:56 PM | Computer Name = YOUR-83675754A1 | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 9/29/2011 7:38:59 PM | Computer Name = YOUR-83675754A1 | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 9/29/2011 7:39:00 PM | Computer Name = YOUR-83675754A1 | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 9/30/2011 4:59:40 AM | Computer Name = YOUR-83675754A1 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 10/1/2011 6:44:47 PM | Computer Name = YOUR-83675754A1 | Source = Application Hang | ID = 1002
Description = Hanging application mbam.exe, version 1.51.0.1118, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 10/1/2011 6:45:24 PM | Computer Name = YOUR-83675754A1 | Source = Application Hang | ID = 1001
Description = Fault bucket -1692901061.

[ System Events ]
Error - 9/25/2011 6:50:00 AM | Computer Name = YOUR-83675754A1 | Source = Service Control Manager | ID = 7022
Description = The Freemake Service service hung on starting.

Error - 9/25/2011 6:50:00 AM | Computer Name = YOUR-83675754A1 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd

Error - 9/25/2011 6:55:34 AM | Computer Name = YOUR-83675754A1 | Source = System Error | ID = 1003
Description = Error code 0000000a, parameter1 00000054, parameter2 00000002, parameter3
00000001, parameter4 804dbc8e.

Error - 9/26/2011 6:54:08 AM | Computer Name = YOUR-83675754A1 | Source = Service Control Manager | ID = 7022
Description = The Freemake Service service hung on starting.

Error - 9/26/2011 6:54:08 AM | Computer Name = YOUR-83675754A1 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd

Error - 9/27/2011 8:12:49 PM | Computer Name = YOUR-83675754A1 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd

Error - 9/28/2011 10:43:47 PM | Computer Name = YOUR-83675754A1 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd

Error - 9/29/2011 1:16:53 AM | Computer Name = YOUR-83675754A1 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd

Error - 9/29/2011 7:35:29 PM | Computer Name = YOUR-83675754A1 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd

Error - 10/1/2011 2:08:49 AM | Computer Name = YOUR-83675754A1 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd


< End of report >

OK scans done & files included. But first a small apology.



I had a ‘little’ unintended help yesterday!

My daughter who usually has no interest in my computer ( & didn’t know I had asked for help on this site) replied to a very overdue email from my security software provider. Previous weekend I emailed their help centre not sure what was wrong with my computer but suspecting a malware. I got no timely reply.

So after 6 days I came here instead & things became much clearer regarding what the problem was.

Well my dear daughter checked my emails for me last night, discovered the reply from security software people, followed their instructions, downloaded HijackThis, did scan, sent notepad file, got immediate reply c/- fix, followed those instructions & was happy she’d done a great job for Mum!

Upon my return home from an arduous night shift, she excitedly informed me she had fixed my computer problem! I can’t scold her because she didn’t know I had changed to this forum for help. She was just trying to help her overworked Mum.

Computer did run just a little faster but I found some remnants of the malware so I am continuing to follow your instructions provided as there is obviously more to remove.

After the OTL scan & reboot I got an AVG message of a severe threat level file name TFSWCTRL.EXE
I have allowed it hoping it is to do with the OTL software since that was still in control of the computer reboot at that point. If it is not related it will need removing too.


I also wanted to ask about another thing I found running in start-up list in task manager. It’s called alg.exe & I read that if it’s in sys32 it’s the real thing but if not it’s a malware. How do I tell the difference? Should I start a new thread about this?


Here are the scan files:-

All processes killed
========== OTL ==========
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\AutorunsDisabled\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{99079a25-328f-4bd4-be04-00955acaa0a7} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{52bb1f1e-a6c7-11e0-8835-00037a2c91e6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52bb1f1e-a6c7-11e0-8835-00037a2c91e6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{52bb1f1e-a6c7-11e0-8835-00037a2c91e6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52bb1f1e-a6c7-11e0-8835-00037a2c91e6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{52bb1f1e-a6c7-11e0-8835-00037a2c91e6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52bb1f1e-a6c7-11e0-8835-00037a2c91e6}\ not found.
File E:\LGAutoRun.exe not found.
C:\Documents and Settings\Clarissa Townsend\Desktop\Removal instructions for Searchqu.com.url moved successfully.
File C:\Documents and Settings\Clarissa Townsend\Desktop\Searchqu.com help .url not found.
C:\Documents and Settings\Clarissa Townsend\Application Data\searchquband folder moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Clarissa Townsend\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Clarissa Townsend\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYFLASH]

User: Administrator

User: All Users

User: Clarissa Townsend
->Flash cache emptied: 2159 bytes

User: Default User
->Flash cache emptied: 56509 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0.00 mb


[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: All Users

User: Clarissa Townsend
->Temp folder emptied: 4441114 bytes
->Temporary Internet Files folder emptied: 269034922 bytes
->Java cache emptied: 113564 bytes
->Apple Safari cache emptied: 11713536 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 51299 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 389541745 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 48161396 bytes
%systemroot%\System32 .tmp files removed: 2952721 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 84281 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 213771777 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34318 bytes
RecycleBin emptied: 473919348 bytes

Total Files Cleaned = 1,348.00 mb


OTL by OldTimer - Version 3.2.29.1 log created on 10042011_111848

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…




aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-10-04 11:51:02
—————————–
11:51:02.140 OS Version: Windows 5.1.2600 Service Pack 3
11:51:02.140 Number of processors: 1 586 0xD08
11:51:02.140 ComputerName: YOUR-83675754A1 UserName:
11:51:06.703 Initialize success
12:04:34.375 AVAST engine defs: 11100301
12:11:32.265 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
12:11:32.265 Disk 0 Vendor: WDC_WD1600BEVE-00UYT0 01.04A01 Size: 152627MB BusType: 3
12:11:32.296 Disk 0 MBR read successfully
12:11:32.296 Disk 0 MBR scan
12:11:32.390 Disk 0 unknown MBR code
12:11:32.406 Disk 0 scanning sectors +312576705
12:11:32.531 Disk 0 scanning C:\WINDOWS\system32\drivers
12:12:23.953 Service scanning
12:12:28.125 Modules scanning
12:12:48.218 Disk 0 trace - called modules:
12:12:48.250 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys
12:12:48.250 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a5b4ab8]
12:12:48.250 3 CLASSPNP.SYS[f7657fd7] -> nt!IofCallDriver -> \Device\00000085[0x8a5fc9e8]
12:12:48.578 5 ACPI.sys[f75ae620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a578940]
12:12:51.468 AVAST engine scan C:\WINDOWS
12:13:09.718 AVAST engine scan C:\WINDOWS\system32
12:21:24.875 AVAST engine scan C:\WINDOWS\system32\drivers
12:22:15.390 AVAST engine scan C:\Documents and Settings\Clarissa Townsend
12:54:36.390 AVAST engine scan C:\Documents and Settings\All Users
13:07:39.875 Scan finished successfully
13:33:37.796 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Clarissa Townsend\Desktop\MBR.dat"
13:33:37.796 The log file has been saved successfully to "C:\Documents and Settings\Clarissa Townsend\Desktop\aswMBR.txt"



MBR.zip is attached

Here is the next file report from ComboFix.

My AVG wouldn’t let itself be properly disabled. It reset itself every 10mins whether I clicked on that or not! I hope that didn’t upset ComboFix.

Since it scanned I am getting this message everytime I click on a web page telling me I am about to view over a secure connection & no-one else can view this or something. It won’t go away!! It’s driving me start raving maaaadddd!!! It won’t allow me to click on “Don’t show this message again”.

I read through the log & it reminded me of all the old Norton stuff still hanging around from 3 generations of versions of Symantec on this computer. Plus a variety of other security softwares I have trialed during the 5.5yrs I’ve had this machine, all needing to be cleaned off even though the proper uninstall was used.


ComboFix 11-10-04.02 - Clarissa Townsend 10/04/2011 21:36:14.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1151 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Internet Security 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\Clarissa Townsend\g2mdlhlpx.exe
c:\documents and settings\Clarissa Townsend\WINDOWS
c:\documents and settings\Default User\WINDOWS
C:\install.exe
c:\program files\avg_ipw_stf_all_90_700a1738.exe
c:\program files\avg_ipw_x86_all_2011_1170a3265.exe
c:\program files\avg_iswt_stf_all_85_323a1500_suncorp.exe
c:\program files\avg_pct_stf_all_2011_23.exe
c:\program files\google\common\google updater\googleupdaterservice.exe
c:\program files\HijackThis1991.exe
c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\bwUnin-7.2.0.137-8876480SL.exe
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\rnaph.dll
c:\windows\system32\system
c:\windows\system32\Thumbs.db
.
.
((((((((((((((((((((((((( Files Created from 2011-09-04 to 2011-10-04 )))))))))))))))))))))))))))))))
.
.
2011-10-04 01:33 . 2011-10-04 01:33 7271 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS
2011-10-04 01:33 . 2011-10-04 01:33 23327 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS
2011-10-04 01:33 . 2011-10-04 01:33 8782 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS
2011-10-04 01:18 . 2011-10-04 01:18 ——– d—–w- C:\_OTL
2011-10-01 00:42 . 2011-10-01 00:42 323624 —-a-w- c:\windows\system32\wiaaut.dll
2011-09-27 03:29 . 2011-09-27 03:29 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG
2011-09-26 17:51 . 2011-09-26 17:51 ——– d—–w- C:\$AVG
2011-09-25 02:39 . 2011-09-25 02:39 ——– d—–w- c:\documents and settings\All Users\Application Data\YouTube Downloader
2011-09-19 01:49 . 2011-09-19 01:49 ——– d—–w- C:\temp
2011-09-19 01:25 . 2011-09-19 01:25 ——– d—–w- c:\program files\SystemRequirementsLab
2011-09-19 01:22 . 2011-09-19 01:22 ——– d—–w- C:\NVIDIA
2011-09-05 17:04 . 2011-09-05 17:04 183696 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-24 09:32 . 2011-05-18 04:40 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-09 09:12 . 2005-05-12 22:54 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-09-04 10:10 . 2011-09-04 10:10 1389280 —-a-w- c:\program files\GameHouse-Installer_am-namcoallstarspacman_gamehouse_.exe
2011-09-01 11:52 . 2011-09-01 11:52 23341560 —-a-w- c:\program files\avc-free.exe
2011-09-01 10:39 . 2011-09-01 10:39 454120 —-a-w- c:\program files\cnet_avc-free_exe.exe
2011-09-01 09:01 . 2011-09-01 09:01 454120 —-a-w- c:\program files\cnet_smconverter_installer_exe.exe
2011-08-25 03:32 . 2011-08-25 03:32 454120 —-a-w- c:\program files\cnet_full_video_converter_free_exe.exe
2011-08-09 05:35 . 2011-08-09 05:35 27627362 —-a-w- c:\program files\full_video_converter_free.exe
2011-08-03 12:20 . 2011-08-03 12:20 1857488 —-a-w- c:\program files\install_easyshare.exe
2011-07-15 13:29 . 2005-05-12 22:55 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2005-05-12 22:55 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-05 12:59 . 2011-07-05 12:59 261208 ——w- c:\program files\LG B2CAppSetup.exe
2011-05-29 01:39 . 2011-05-14 02:41 605223 ——w- c:\program files\YouTubeDownloaderSetup272.exe
2011-04-23 16:59 . 2011-04-23 16:59 406016 —-a-w- c:\program files\movtoavi.exe
2010-12-02 01:02 . 2010-12-02 01:02 24032780 ——w- c:\program files\stihl_bildschirmschoner.exe
2010-11-06 11:26 . 2010-11-06 11:26 4295761 ——w- c:\program files\YouTubeDownloaderSetup262.exe
2010-11-02 12:53 . 2010-11-02 12:53 955272 ——w- c:\program files\SkypeSetup.exe
2010-10-08 23:55 . 2010-10-08 23:55 729464 ——w- c:\program files\autoruns.exe
2010-09-28 12:05 . 2010-09-28 11:31 746016 ——w- c:\program files\diskcheckup.exe
2010-09-28 11:26 . 2010-09-28 11:26 408273 ——w- c:\program files\smartmontools-5.39.1-1.win32-setup.exe
2009-09-02 01:31 . 2009-09-02 01:27 27024112 ——w- c:\program files\PowerPointViewer.exe
2009-07-31 00:58 . 2009-07-31 00:58 3233584 ——w- c:\program files\CNET_TechTracker_1_0_40_Setup.exe
2009-03-23 13:32 . 2009-03-23 13:32 774144 ——w- c:\program files\RngInterstitial.dll
2004-11-11 11:17 . 2009-03-28 00:29 114688 ——w- c:\program files\asf.vcp
2004-11-11 11:14 . 2009-03-28 00:29 86016 ——w- c:\program files\PanaAsfConv.dll
2004-11-05 00:35 . 2009-03-28 00:29 503808 ——w- c:\program files\HSMain.exe
2004-10-29 12:36 . 2009-03-28 00:29 339968 ——w- c:\program files\MediaExporter.exe
2004-10-29 12:05 . 2009-03-28 00:29 106496 ——w- c:\program files\MotionDVSTUDIO.exe
2004-10-29 12:05 . 2009-03-28 00:29 143360 ——w- c:\program files\WaveRecorder.exe
2004-10-29 12:05 . 2009-03-28 00:29 110592 ——w- c:\program files\Title.tcp
2004-10-29 12:05 . 2009-03-28 00:29 274432 ——w- c:\program files\Assistant.exe
2004-10-29 12:05 . 2009-03-28 00:29 114688 ——w- c:\program files\AssistantEngine.dll
2004-10-29 12:05 . 2009-03-28 00:29 86016 ——w- c:\program files\AssistantUICtrl.dll
2004-10-29 12:03 . 2009-03-28 00:29 57344 ——w- c:\program files\BGM.acp
2004-10-29 12:03 . 2009-03-28 00:29 32768 ——w- c:\program files\Hmplayer.exe
2004-10-29 12:02 . 2009-03-28 00:29 49152 ——w- c:\program files\MultiPlayer.dll
2004-10-29 12:02 . 2009-03-28 00:29 32768 ——w- c:\program files\audio.acp
2004-10-29 12:02 . 2009-03-28 00:29 151552 ——w- c:\program files\VDSTool.dll
2004-10-29 12:02 . 2009-03-28 00:32 40960 ——w- c:\program files\UIImageViewer.ocx
2004-10-29 12:02 . 2009-03-28 00:29 73728 ——w- c:\program files\ToolBox.dll
2004-10-29 12:02 . 2009-03-28 00:29 24576 ——w- c:\program files\picture.pcp
2004-10-29 12:02 . 2009-03-28 00:29 65536 ——w- c:\program files\Mpeg2.vcp
2004-10-29 12:02 . 2009-03-28 00:32 61440 ——w- c:\program files\Hmplayer.ocx
2004-10-29 12:02 . 2009-03-28 00:29 155648 ——w- c:\program files\Jpeg.pcp
2004-10-29 12:02 . 2009-03-28 00:29 798720 ——w- c:\program files\HSManager.dll
2004-10-29 12:01 . 2009-03-28 00:32 94208 ——w- c:\program files\DVMultiSrc.ax
2004-10-29 12:00 . 2009-03-28 00:29 28672 ——w- c:\program files\ExportEx.dll
2004-10-29 12:00 . 2009-03-28 00:29 159744 ——w- c:\program files\DVSequence.dll
2004-10-29 12:00 . 2009-03-28 00:29 458752 ——w- c:\program files\HSequence.dll
2004-10-29 12:00 . 2009-03-28 00:29 49152 ——w- c:\program files\innertimeline.dll
2004-10-29 12:00 . 2009-03-28 00:32 81920 ——w- c:\program files\vMix.ax
2004-10-29 12:00 . 2009-03-28 00:32 94208 ——w- c:\program files\vEffect.ax
2004-10-29 12:00 . 2009-03-28 00:29 32768 ——w- c:\program files\ExportFile.dll
2004-10-29 12:00 . 2009-03-28 00:29 32768 ——w- c:\program files\ExportPicture.pep
2004-10-29 11:59 . 2009-03-28 00:29 49152 ——w- c:\program files\ExportMpeg1.hep
2004-10-29 11:59 . 2009-03-28 00:29 57344 ——w- c:\program files\ExportDV.hep
2004-10-29 11:59 . 2009-03-28 00:29 65536 ——w- c:\program files\ExportWMV.hep
2004-10-29 11:59 . 2009-03-28 00:29 32768 ——w- c:\program files\DVHSCtrl.dll
2004-10-29 11:59 . 2009-03-28 00:29 192512 ——w- c:\program files\DVControl2.dll
2004-10-29 11:59 . 2009-03-28 00:29 28672 ——w- c:\program files\DSTools.dll
2004-10-29 11:59 . 2009-03-28 00:29 77824 ——w- c:\program files\DTFileMgr.dll
2004-10-29 11:59 . 2009-03-28 00:29 184320 ——w- c:\program files\HUiCtrl.dll
2004-10-29 11:59 . 2009-03-28 00:29 86016 ——w- c:\program files\CNCGUI.dll
2004-10-29 11:59 . 2009-03-28 00:29 32768 ——w- c:\program files\avi.vcp
2004-10-29 11:59 . 2009-03-28 00:29 36864 ——w- c:\program files\MMManager2.dll
2004-10-29 11:59 . 2009-03-28 00:29 364544 ——w- c:\program files\CmLibs.dll
2004-10-29 11:58 . 2009-03-28 00:29 36864 ——w- c:\program files\ToolBoxData.dll
2004-10-29 11:58 . 2009-03-28 00:29 28672 ——w- c:\program files\AudioControl.dll
2004-10-29 11:57 . 2009-03-28 00:29 151552 ——w- c:\program files\CmGUI.dll
2004-10-26 10:53 . 2009-03-28 00:29 12288 ——w- c:\program files\rcUIImageViewer.dll
2004-10-26 10:53 . 2009-03-28 00:29 114688 ——w- c:\program files\rcWaveRecorder.dll
2004-10-26 10:53 . 2009-03-28 00:29 36864 ——w- c:\program files\rcMotionDVSTUDIO.dll
2004-10-26 10:53 . 2009-03-28 00:29 28672 ——w- c:\program files\rcMultiPlayer.dll
2004-10-26 10:53 . 2009-03-28 00:29 20480 ——w- c:\program files\rcPicture.dll
2004-10-26 10:53 . 2009-03-28 00:29 12288 ——w- c:\program files\rcMpeg2.dll
2004-10-26 10:53 . 2009-03-28 00:29 86016 ——w- c:\program files\rcMediaExporter.dll
2004-10-26 10:53 . 2009-03-28 00:29 20480 ——w- c:\program files\rcMMManager2.dll
2004-10-26 10:53 . 2009-03-28 00:29 12288 ——w- c:\program files\rcJpeg.dll
2004-10-26 10:53 . 2009-03-28 00:29 114688 ——w- c:\program files\rcHsmanager.dll
2004-10-26 10:53 . 2009-03-28 00:29 28672 ——w- c:\program files\rcHmplayer.dll
2004-10-26 10:53 . 2009-03-28 00:29 24576 ——w- c:\program files\rcHSequence.dll
2004-10-26 10:53 . 2009-03-28 00:29 12288 ——w- c:\program files\rcHmplayerocx.dll
2004-10-26 10:53 . 2009-03-28 00:29 114688 ——w- c:\program files\rcHSMain.dll
2004-10-26 10:52 . 2009-03-28 00:29 20480 ——w- c:\program files\rcExportPictureocx.dll
2004-10-26 10:52 . 2009-03-28 00:29 20480 ——w- c:\program files\rcExportMpeg1.dll
2004-10-26 10:52 . 2009-03-28 00:29 20480 ——w- c:\program files\rcExportDV.dll
2004-10-26 10:52 . 2009-03-28 00:29 65536 ——w- c:\program files\rcCmlibs.dll
2004-10-26 10:52 . 2009-03-28 00:29 24576 ——w- c:\program files\rcDVSequence.dll
2004-10-26 10:52 . 2009-03-28 00:29 24576 ——w- c:\program files\rcDTFileMgr.dll
2004-10-26 10:52 . 2009-03-28 00:29 24576 ——w- c:\program files\rcCNCGUI.dll
2004-10-26 10:52 . 2009-03-28 00:29 20480 ——w- c:\program files\rcExportWMV.dll
2004-10-26 10:52 . 2009-03-28 00:29 61440 ——w- c:\program files\rcAssistant.dll
2004-10-26 10:52 . 2009-03-28 00:29 24576 ——w- c:\program files\rcAssistantEngine.dll
2004-10-26 10:52 . 2009-03-28 00:29 20480 ——w- c:\program files\rcAssistantUICtrl.dll
2004-10-26 10:52 . 2009-03-28 00:29 12288 ——w- c:\program files\rcavi.dll
2004-10-26 10:52 . 2009-03-28 00:29 12288 ——w- c:\program files\rcAsf.dll
2004-10-26 10:43 . 2009-03-28 00:29 90112 ——w- c:\program files\DlgRes.dll
2004-10-26 10:22 . 2009-03-28 00:29 1114112 ——w- c:\program files\Title.exe
2004-10-26 10:22 . 2009-03-28 00:29 65536 ——w- c:\program files\ScRender_Ta.dll
2004-10-26 10:22 . 2009-03-28 00:29 61440 ——w- c:\program files\ScRender_Audio.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]
"PhotoShow Deluxe Media Manager"="c:\progra~1\Nero\data\Xtras\mssysmgr.exe" [2005-02-26 212992]
"SkinClock"="c:\program files\Free Desktop Clock\DesktopClock.exe" [2006-10-01 334848]
"CAHeadless"="c:\program files\Adobe\Elements 9 Organizer\CAHeadless\ElementsAutoAnalyzer.exe" [2010-09-29 533952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-23 339968]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-04-14 5562368]
"nwiz"="nwiz.exe" [2005-04-14 1495040]
"CeEKEY"="c:\program files\TOSHIBA\E-KEY\CeEKey.exe" [2005-04-29 675840]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2003-10-30 192512]
"TPNF"="c:\program files\TOSHIBA\TouchPad\TPTray.exe" [2004-11-30 53248]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-01-14 122939]
"TPSMain"="TPSMain.exe" [2004-12-28 270336]
"ZoomingHook"="ZoomingHook.exe" [2004-05-01 24576]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-15 122880]
"TCtryIOHook"="TCtrlIOHook.exe" [2005-04-20 28672]
"TFncKy"="TFncKy.exe" [BU]
"HWSetup"="c:\program files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [2004-12-24 28672]
"TOSHIBA Accessibility"="c:\program files\TOSHIBA\Accessibility\FnKeyHook.exe" [2005-03-08 24576]
"PadTouch"="c:\program files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-09-07 1077301]
"SVPWUTIL"="c:\program files\Toshiba\Windows Utilities\SVPWUTIL.exe" [2005-02-26 65536]
"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2005-04-05 73728]
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-12 88358]
"LtMoh"="c:\\Program Files\\ltmoh\\Ltmoh.exe" [2005-04-12 184320]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-10-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-10-08 217088]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-24 2516296]
"CanonSolutionMenuEx"="c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-04-02 1185112]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2010-03-02 140640]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-28 497648]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-09-09 2338656]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
c:\documents and settings\Clarissa Townsend\Start Menu\Programs\Startup\
Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-4-19 64864]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-3-22 483328]
EPSON Status Monitor 3 Environment Check 2.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2009-5-8 127488]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2005-5-13 155648]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Seagate\\Seagate Dashboard\\HipServAgent\\HipServAgent.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgemcx.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2/22/2011 8:13 AM 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [3/16/2011 4:03 PM 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [1/7/2011 6:41 AM 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [4/5/2011 12:59 AM 297168]
R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [9/30/2010 3:06 AM 169408]
R2 avgfws;AVG Firewall;c:\program files\AVG\AVG10\avgfws.exe [3/9/2011 7:24 PM 2708024]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [8/18/2011 1:33 AM 7390560]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [2/8/2011 5:33 AM 269520]
R2 LGScsiCommandService;LG SCSI command service;c:\windows\system32\LGScsiCommandService.exe [7/5/2011 10:28 PM 47616]
R2 SeagateDashboardService;Seagate Dashboard Service;c:\program files\Seagate\Seagate Dashboard\SeagateDashboardService.exe [6/2/2011 9:06 AM 14088]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [7/12/2010 4:33 AM 30432]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [4/14/2011 9:28 PM 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2/10/2011 7:53 AM 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2/10/2011 7:53 AM 27216]
R3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\drivers\lgbtport.sys [9/29/2009 8:11 AM 12160]
R3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\drivers\lgbtbus.sys [9/29/2009 8:11 AM 10496]
R3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\drivers\lgvmodem.sys [9/29/2009 8:11 AM 12928]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys –> c:\windows\system32\DRIVERS\Lbd.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 gupdate1c9e70374aefaf4;Google Update Service (gupdate1c9e70374aefaf4);c:\program files\Google\Update\GoogleUpdate.exe [6/7/2009 10:03 AM 133104]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [7/12/2010 4:33 AM 30432]
S3 FlashUSB;FlashUSB;c:\windows\system32\drivers\FlashUSB.sys [7/5/2011 11:17 PM 16896]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [6/7/2009 10:03 AM 133104]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys –> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [5/13/2005 8:55 AM 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - ASWMBR
*Deregistered* - aswMBR
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-02 c:\windows\Tasks\AdobeAAMUpdater-1.0-YOUR-83675754A1-Clarissa Townsend.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2010-07-28 15:25]
.
2011-09-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 02:34]
.
2011-10-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-07 00:03]
.
2011-10-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-07 00:03]
.
2011-10-04 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 05:07]
.
.
——- Supplementary Scan ——-
.
uStart Page =
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: E&xport; to Microsoft Excel
Trusted Zone: etrade.com.au
Trusted Zone: etrade.com.au\invest
Trusted Zone: etradeaustralia.com.au
TCP: DhcpNameServer = 192.168.0.1
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.
.
——- File Associations ——-
.
JSEFile=notepad.exe "%1" %*
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-HijackThis - c:\documents and settings\Clarissa Townsend\Desktop\HijackThis.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-04 21:54
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-171498112-2073979050-300961397-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(2008)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2011-10-04 22:02:17
ComboFix-quarantined-files.txt 2011-10-04 12:02
.
Pre-Run: 91,930,451,968 bytes free
Post-Run: 91,606,896,640 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 73D02B6478A1BB059A954985ED427BE9