Brother's computer is acting strange

OTL logfile created on: 10/4/2011 8:45:12 PM - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Documents and Settings\Family\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

479.30 Mb Total Physical Memory | 230.73 Mb Available Physical Memory | 48.14% Memory free
1.10 Gb Paging File | 0.89 Gb Available in Paging File | 81.16% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.30 Gb Total Space | 24.39 Gb Free Space | 65.39% Space Free | Partition Type: NTFS
Drive E: | 3.73 Gb Total Space | 2.90 Gb Free Space | 77.92% Space Free | Partition Type: FAT32

Computer Name: HOOPER-632A2D28 | User Name: Family | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Family\desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe (BillP Studios)
PRC - C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe (TuneUp Software GmbH)
PRC - C:\WINDOWS\system32\savedump.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\BillP Studios\WinPatrol\sqlite3.dll ()
MOD - C:\Program Files\TuneUp Utilities 2008\MSI_D6.bpl ()
MOD - C:\Program Files\TuneUp Utilities 2008\ehs_d6.bpl ()


========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – File not found
SRV - (TuneUp.Defrag) – C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software GmbH)


========== Driver Services (SafeList) ==========

DRV - (NDIS) – C:\WINDOWS\System32\drivers\ndis.sys ()
DRV - (SiSkp) – C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (BANTExt) – C:\WINDOWS\System32\Drivers\BANTExt.sys ()
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (SiSRaid) – C:\WINDOWS\system32\DRIVERS\SiSRaid.sys (Silicon Integrated Systems)
DRV - (SISNIC) – C:\WINDOWS\system32\drivers\sisnic.sys (SiS Corporation)
DRV - (HSFHWBS2) – C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.ca/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "msn.ca"
FF - prefs.js..network.proxy.no_proxies_on: "*.local"


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/08 16:50:04 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/10/01 23:00:42 | 000,000,000 | —D | M]

[2010/02/01 09:13:14 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Family\Application Data\Mozilla\Extensions
[2011/05/31 13:32:56 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\jribkiqj.default\extensions
[2011/05/29 15:53:54 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\jribkiqj.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/05/31 13:32:56 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/09/08 16:50:02 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/05/31 15:29:08 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2004/08/04 09:30:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [SiSPower] C:\WINDOWS\System32\SiSPower.dll (Silicon Integrated Systems Corporation)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKCU..\Run: [TuneUp MemOptimizer] C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe (TuneUp Software GmbH)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_18.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/Facebo…toUploader5.cab (Facebook Photo Uploader 5)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1265168238109 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{16D7496D-4528-4F56-A4B7-C166B890560D}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/05/28 10:48:49 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2011/10/04 20:35:30 | 000,582,656 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Family\Desktop\OTL.exe
[2011/10/04 20:35:21 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Family\Desktop\HiJackThis.exe
[2011/10/02 09:44:08 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Family\Recent
[2011/10/02 00:51:44 | 000,000,000 | R–D | C] – C:\Documents and Settings\Family\Start Menu\Programs\Administrative Tools
[2011/10/02 00:50:40 | 000,607,260 | R— | C] (Swearware) – C:\Documents and Settings\Family\Desktop\dds.scr
[2011/10/01 20:38:05 | 000,000,000 | —D | C] – C:\Program Files\Windows Sidebar
[2011/10/01 20:38:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Norton
[2011/10/01 20:37:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2011/10/01 19:16:30 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2011/10/01 19:12:08 | 000,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2011/10/01 19:12:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Family\Start Menu\Programs\Revo Uninstaller
[2011/10/01 19:11:45 | 002,579,088 | —- | C] (Piriform Ltd) – C:\Documents and Settings\Family\Desktop\ccsetup311_slim.exe
[2011/10/01 19:08:20 | 013,568,992 | —- | C] (Sunbelt Software) – C:\Documents and Settings\Family\Desktop\vipre-en-setup.exe
[2011/09/29 21:21:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/09/29 20:37:07 | 000,022,216 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/09/29 20:37:07 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/09/29 20:36:18 | 009,852,544 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Family\Desktop\mbam-setup-1.51.2.1300.exe
[2011/09/29 16:42:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Family\Application Data\MSNInstaller
[2011/09/20 17:02:57 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/09/13 18:19:51 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/09/08 17:55:12 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/10/04 20:43:32 | 000,000,538 | —- | M] () – C:\WINDOWS\tasks\Automatic maintenance.job
[2011/10/04 20:43:25 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/10/04 20:36:03 | 000,000,258 | —- | M] () – C:\WINDOWS\tasks\Clean System Memory.job
[2011/10/04 20:31:14 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Family\Desktop\HiJackThis.exe
[2011/10/04 20:30:58 | 000,582,656 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Family\Desktop\OTL.exe
[2011/10/03 21:56:39 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/10/02 00:51:25 | 000,000,000 | —- | M] () – C:\Documents and Settings\Family\defogger_reenable
[2011/10/02 00:46:28 | 000,302,592 | —- | M] () – C:\Documents and Settings\Family\Desktop\gmer.exe
[2011/10/02 00:44:22 | 000,607,260 | R— | M] (Swearware) – C:\Documents and Settings\Family\Desktop\dds.scr
[2011/10/02 00:43:42 | 000,050,477 | —- | M] () – C:\Documents and Settings\Family\Desktop\Defogger.exe
[2011/10/01 22:34:13 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2011/10/01 21:46:06 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/10/01 21:03:00 | 000,095,072 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/10/01 19:16:30 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/10/01 19:12:08 | 000,000,917 | —- | M] () – C:\Documents and Settings\Family\Desktop\Revo Uninstaller.lnk
[2011/10/01 18:48:28 | 002,579,088 | —- | M] (Piriform Ltd) – C:\Documents and Settings\Family\Desktop\ccsetup311_slim.exe
[2011/09/29 20:37:14 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/29 16:49:18 | 009,852,544 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Family\Desktop\mbam-setup-1.51.2.1300.exe
[2011/09/26 20:49:39 | 000,510,009 | —- | M] () – C:\Documents and Settings\Family\Desktop\steve cm diploma.JPG
[2011/09/26 20:49:34 | 000,453,993 | —- | M] () – C:\Documents and Settings\Family\Desktop\steve pf diploma.JPG
[2011/09/26 20:49:26 | 000,193,195 | —- | M] () – C:\Documents and Settings\Family\Desktop\steves tickets #2.JPG
[2011/09/26 20:49:17 | 000,460,452 | —- | M] () – C:\Documents and Settings\Family\Desktop\steves tickets #1.JPG
[2011/09/14 21:02:35 | 000,023,586 | —- | M] () – C:\Documents and Settings\Family\Desktop\DSC_3755.jpg
[2011/09/09 06:42:13 | 000,599,040 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\crypt32.dll
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/10/02 00:51:25 | 000,000,000 | —- | C] () – C:\Documents and Settings\Family\defogger_reenable
[2011/10/02 00:50:32 | 000,302,592 | —- | C] () – C:\Documents and Settings\Family\Desktop\gmer.exe
[2011/10/02 00:50:23 | 000,050,477 | —- | C] () – C:\Documents and Settings\Family\Desktop\Defogger.exe
[2011/10/01 21:45:53 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/10/01 21:03:00 | 000,095,072 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/10/01 20:15:25 | 000,238,608 | —- | C] () – C:\Documents and Settings\Family\Desktop\avira_registry_cleaner_en.exe
[2011/10/01 19:16:30 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/10/01 19:12:08 | 000,000,917 | —- | C] () – C:\Documents and Settings\Family\Desktop\Revo Uninstaller.lnk
[2011/09/29 20:37:14 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/26 20:49:39 | 000,510,009 | —- | C] () – C:\Documents and Settings\Family\Desktop\steve cm diploma.JPG
[2011/09/26 20:49:33 | 000,453,993 | —- | C] () – C:\Documents and Settings\Family\Desktop\steve pf diploma.JPG
[2011/09/26 20:49:26 | 000,193,195 | —- | C] () – C:\Documents and Settings\Family\Desktop\steves tickets #2.JPG
[2011/09/26 20:49:15 | 000,460,452 | —- | C] () – C:\Documents and Settings\Family\Desktop\steves tickets #1.JPG
[2011/09/14 21:02:32 | 000,023,586 | —- | C] () – C:\Documents and Settings\Family\Desktop\DSC_3755.jpg
[2010/03/20 22:46:49 | 000,000,023 | -HS- | C] () – C:\WINDOWS\System32\edacded0.dat
[2010/02/01 14:09:04 | 000,003,840 | —- | C] () – C:\WINDOWS\System32\drivers\BANTExt.sys
[2010/02/01 09:13:05 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2008/06/26 19:58:44 | 000,000,221 | —- | C] () – C:\WINDOWS\NCLogConfig.ini
[2008/06/26 18:38:53 | 000,130,958 | —- | C] () – C:\WINDOWS\hpoins12.dat
[2008/06/26 18:38:52 | 000,001,470 | —- | C] () – C:\WINDOWS\hpomdl12.dat
[2008/06/08 18:02:16 | 000,001,755 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2008/05/30 21:36:43 | 000,000,022 | —- | C] () – C:\Documents and Settings\Family\Local Settings\Application Data\kodakpcd.ini
[2008/05/28 11:08:22 | 000,083,517 | R— | C] () – C:\WINDOWS\VGAsetup.ini
[2008/05/28 11:08:22 | 000,035,036 | —- | C] () – C:\WINDOWS\System32\VGAunistlog.ini
[2008/05/28 11:08:19 | 000,049,152 | —- | C] () – C:\WINDOWS\InstFunc.exe
[2008/05/28 11:08:14 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\sis760.bin
[2008/05/28 11:08:13 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\sis741.bin
[2008/05/28 11:08:13 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\sis660.bin
[2008/05/28 11:05:38 | 000,135,168 | R— | C] () – C:\WINDOWS\System32\property.dll
[2008/05/28 10:59:57 | 000,156,672 | R— | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2008/05/28 10:53:04 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2008/05/28 10:45:09 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2008/05/26 22:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 22:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2008/04/28 08:05:48 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2007/09/27 11:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 11:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 11:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2004/08/04 09:30:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/04 09:30:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 09:30:00 | 000,462,498 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 09:30:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 09:30:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 09:30:00 | 000,215,424 | —- | C] () – C:\WINDOWS\System32\drivers\ndis.sys
[2004/08/04 09:30:00 | 000,078,318 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 09:30:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 09:30:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 09:30:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 09:30:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 09:30:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 09:30:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2010/03/21 19:44:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/03/21 08:34:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2008/07/03 22:41:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SugarGames
[2011/09/29 21:34:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/04/01 07:47:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2010/03/21 12:29:19 | 000,000,000 | -HSD | M] – C:\Documents and Settings\All Users\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2011/09/29 22:25:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Akkyu
[2010/02/01 10:19:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\EAST Technologies
[2011/09/03 18:57:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Ebarqu
[2008/06/23 23:41:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\FrostWire
[2010/02/06 16:06:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\GlarySoft
[2011/09/29 22:25:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Icloa
[2010/02/01 10:22:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Image Zone Express
[2011/09/26 20:43:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Irugd
[2011/09/29 22:25:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Izavs
[2010/02/06 16:44:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Jasc
[2008/06/23 10:40:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\LimeWire
[2011/09/26 20:37:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Lyqy
[2011/09/29 21:21:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\MSNInstaller
[2008/06/26 20:05:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Printer Info Cache
[2011/09/03 18:57:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Roliu
[2010/02/01 10:36:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\TuneUp Software
[2011/09/03 18:58:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Urit
[2011/09/29 22:25:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Vofyeq
[2010/02/01 13:27:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Windows Desktop Search
[2010/02/01 13:39:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Windows Search
[2010/02/01 08:38:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\WinPatrol
[2011/09/03 18:57:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Family\Application Data\Yqqau
[2011/10/04 20:43:32 | 000,000,538 | —- | M] () – C:\WINDOWS\Tasks\Automatic maintenance.job
[2011/10/04 20:36:03 | 000,000,258 | —- | M] () – C:\WINDOWS\Tasks\Clean System Memory.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2008/05/28 10:48:49 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2011/10/01 22:34:13 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2008/05/28 10:48:49 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2008/05/28 10:48:49 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/03/21 10:31:12 | 000,039,147 | —- | M] () – C:\logfile
[2008/05/28 10:48:49 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 09:30:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/02/01 01:57:52 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/10/04 20:43:22 | 754,974,720 | -HS- | M] () – C:\pagefile.sys
[1 C:\*.tmp files -> C:\*.tmp -> ]

< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2008/05/28 10:48:06 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/12/29 09:57:18 | 000,273,920 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp4v2.dll
[2008/07/06 08:20:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/04/28 08:01:25 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2008/04/28 08:01:25 | 000,634,880 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2008/04/28 08:01:25 | 000,876,544 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2010/02/01 02:03:52 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2008/05/28 10:57:44 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Family\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2008/05/28 10:57:42 | 000,000,079 | —- | M] () – C:\Documents and Settings\Family\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/09/01 08:24:00 | 000,238,608 | —- | M] () – C:\Documents and Settings\Family\Desktop\avira_registry_cleaner_en.exe
[2011/10/01 18:48:28 | 002,579,088 | —- | M] (Piriform Ltd) – C:\Documents and Settings\Family\Desktop\ccsetup311_slim.exe
[2011/10/02 00:43:42 | 000,050,477 | —- | M] () – C:\Documents and Settings\Family\Desktop\Defogger.exe
[2011/10/02 00:46:28 | 000,302,592 | —- | M] () – C:\Documents and Settings\Family\Desktop\gmer.exe
[2011/10/04 20:31:14 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Family\Desktop\HiJackThis.exe
[2011/09/29 16:49:18 | 009,852,544 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Family\Desktop\mbam-setup-1.51.2.1300.exe
[2011/10/04 20:30:58 | 000,582,656 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Family\Desktop\OTL.exe
[2011/08/31 14:54:32 | 013,568,992 | —- | M] (Sunbelt Software) – C:\Documents and Settings\Family\Desktop\vipre-en-setup.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-10-01 21:08:31

========== Alternate Data Streams ==========

@Alternate Data Stream - 166 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C97C8631
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:07FFC655
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:53:29 PM, on 10/4/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\notepad.exe
C:\Documents and Settings\Family\Desktop\HiJackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-602162358-1214440339-1417001333-1004\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" autostart (User '?')
O4 - HKUS\S-1-5-21-602162358-1214440339-1417001333-1004\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo…toUploader5.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1265168238109
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

–
End of file - 4730 bytes


.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18
Run by [removed] at 21:06:15 on 2011-10-04
.
============== Running Processes ===============
.
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://yahoo.ca/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
uRun: [TuneUp MemOptimizer] "c:\program files\tuneup utilities 2008\MemOptimizer.exe" autostart
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
uPolicies-explorer: NoResolveTrack = 1 (0x1)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1265168238109
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces\{16D7496D-4528-4F56-A4B7-C166B890560D} : DhcpNameServer = [removed] [removed]
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\family\application data\mozilla\firefox\profiles\jribkiqj.default\
FF - prefs.js: browser.startup.homepage - msn.ca
.
—- FIREFOX POLICIES —-
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
.
=============== Created Last 30 ================
.
2011-10-01 23:08:04 ——– d—–w- c:\documents and settings\all users\application data\Norton
2011-10-01 23:07:07 ——– d—–w- c:\documents and settings\all users\application data\NortonInstaller
2011-10-01 21:42:08 ——– d—–w- c:\program files\VS Revo Group
2011-09-29 23:07:07 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-09-29 23:07:07 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-09-29 19:12:45 ——– d—–w- c:\documents and settings\family\application data\MSNInstaller
.
==================== Find3M ====================
.
2011-10-01 21:25:29 90112 —-a-w- c:\windows\DUMP497c.tmp
2011-09-09 09:12:13 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-09-03 21:27:14 215424 —-a-w- c:\windows\system32\drivers\ndis.sys
2011-07-30 18:27:22 90112 —-a-w- c:\windows\DUMP3e41.tmp
2011-07-25 17:25:24 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29:31 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02:00 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
.
============= FINISH: 21:06:30.82 ===============