What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Google redirect crash, virus from itshd.com and testendonline

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I am having several issues since trying to use a movie site called ITSHD.com. I payed by paypal and after not getting the site to work I disputed the charge and noticed I had been getting charged for the service more than once. I had to shut down my paypal and buyer credit. After several attempts to remove the virus, I was unsuccessful due to the virus not allowing the antivirus to complete program. This has caused at first my google to redirect to a 404 error and links began to not work and now in addition I have testendonline popping up with every start up of IE. I am using windows XP.
Post #2
Hi Shelly46013,

To make cleaning this machine easier
  • Please do not uninstall/install any programs unless asked to
    It is more difficult when files/programs are appearing in/disappearing from the logs.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
  • Do not attach any logs/reports, etc.. unless specifically requested to do so.
  • If you have problems with or do not understand the instructions, Please ask before continuing.
  • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

We'll get a better look with this tool.

Download OTL to your desktop.
  • If you are using Firefox, make sure that your download settings are as follows:
    -Tools->Options->Main tab
    -Set to "Always ask me where to Save the files".
  • Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output
  • Check the boxes beside LOP Check and Purity Check.
  • In the window under Custom Scans/Fixes copy and paste the following


    netsvcs
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lîk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %PROGRAMFILES%\Internet Explorer\*.dat
    %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Deskuop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    %USERPROFILE%\..|smtmp;true;true;true /FP
    %temp%\smtmp\*.* /s >
    /md5start
    iexplore.*
    explorer.*
    winlogon.*
    dll
    zx.dll
    hlp.dat
    /md5stop

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.


Next

Download aswMBR.exe to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.

Please post back with
  • both OTL logs
  • aswMBR log
  • MBR.zip (attached)
Post #4
OTL logfile created on: 10/9/2011 12:11:27 p.m.Shelly - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Documents and Settings\S. Michelle Wooten\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

509.98 Mb Total Physical Memory | 86.24 Mb Available Physical Memory | 16.91% Memory free
1.22 Gb Paging File | 0.52 Gb Available in Paging File | 42.99% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.37 Gb Total Space | 41.89 Gb Free Space | 59.52% Space Free | Partition Type: NTFS
Drive E: | 7.46 Gb Total Space | 7.46 Gb Free Space | 100.00% Space Free | Partition Type: FAT32

Computer Name: DGFDV281 | User Name: S. Michelle Wooten | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\844023755:876130765.exe File not found
PRC - C:\Documents and Settings\S. Michelle Wooten\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\JavaQuade\bin\jqs.exe (Oracle)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (AOL LLC)


========== Modules (No Company Name) ==========

MOD - \\?\globalroot\systemroot\system32\mswsock.dll ()
MOD - \\.\globalroot\systemroot\system32\mswsock.dll ()
MOD - C:\WINDOWS\SYSTEM32\LXBRPMON.DLL ()
MOD - C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\LXBMPP5C.DLL ()
MOD - C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\DLBCPP5C.DLL ()


========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – File not found
SRV - (JavaQuickStarterService) – C:\JavaQuade\bin\jqs.exe (Oracle)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)


========== Driver Services (SafeList) ==========

DRV - (NPF) – C:\WINDOWS\SYSTEM32\DRIVERS\npf.sys (CACE Technologies, Inc.)
DRV - (mfehidk) – C:\WINDOWS\SYSTEM32\DRIVERS\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\SYSTEM32\DRIVERS\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\WINDOWS\SYSTEM32\DRIVERS\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\SYSTEM32\DRIVERS\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\WINDOWS\SYSTEM32\DRIVERS\mferkdk.sys (McAfee, Inc.)
DRV - (BVRPMPR5) – C:\WINDOWS\SYSTEM32\DRIVERS\BVRPMPR5.SYS (Avanquest Software)
DRV - (hamachi) – C:\WINDOWS\SYSTEM32\DRIVERS\hamachi.sys (LogMeIn, Inc.)
DRV - (ndsdatamax) – C:\WINDOWS\SYSTEM32\DRIVERS\ndsdatamax.sys (Thesycon GmbH, Germany)
DRV - (MCSTRM) – C:\WINDOWS\System32\drivers\mcstrm.sys (RealNetworks, Inc.)
DRV - (senfilt) – C:\WINDOWS\SYSTEM32\DRIVERS\senfilt.sys (Creative Technology Ltd.)
DRV - (IntelC53) – C:\WINDOWS\SYSTEM32\DRIVERS\IntelC53.sys (Intel Corporation)
DRV - (IntelC52) – C:\WINDOWS\SYSTEM32\DRIVERS\IntelC52.sys (Intel Corporation)
DRV - (IntelC51) – C:\WINDOWS\SYSTEM32\DRIVERS\IntelC51.sys (Intel Corporation)
DRV - (mohfilt) – C:\WINDOWS\SYSTEM32\DRIVERS\mohfilt.sys (Intel Corporation)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\SYSTEM32\DRIVERS\wanatw4.sys (America Online, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\JavaQuade\bin\new_plugin\npjp2.dll (Oracle)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2105: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2163: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1212: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\[removed]/YahooActiveXPluginBridge;version=1.0.0.1: C:\PROGRA~1\Yahoo!\Common\npyaxmpb.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[removed]: C:\JavaQuade\lib\deploy\jqs\ff [2010/07/12 21:26:15 | 000,000,000 | —D | M]

[2010/03/02 01:39:48 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\S. Michelle Wooten\Application Data\Mozilla\Extensions
[2010/03/28 12:56:18 | 000,002,035 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\fcmdSrchFxt.xml

O1 HOSTS File: ([2011/07/08 03:53:22 | 000,000,919 | RH– | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
O1 - Hosts: 67.205.118.179 www.google.com
O1 - Hosts: 67.205.118.180 search.yahoo.com
O1 - Hosts: 67.205.118.180 www.bing.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\JavaQuade\bin\jp2ssv.dll (Oracle)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\JavaQuade\lib\deploy\jqs\ie\jqs_plugin.dll (Oracle)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - SITEguard - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {724D43A0-0D85-11D4-9908-00400523E39A} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\RunServices: [AolAcsDaemon1] C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (AOL LLC)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\S. Michelle Wooten\Start Menu\Programs\IMVU\Run IMVU.lnk File not found
O9 - Extra Button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - Reg Error: Value error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase6770.cab (Windows Live Safety Center Base Module)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} http://hoylegames.sierra.com/cab/WONWebLauncherControl.cab (Reg Error: Key error.)
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-29-0.cab (EPUImageControl Class)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{59F47CA7-EDF1-42D3-85DB-1C98CD60EF41}: DhcpNameServer = 10.0.0.1
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\SYSTEM32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 14:04:08 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{47433822-3d4f-11dd-87a8-00038a000015}\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: ('autocheck autochk *')
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\SYSTEM32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\TSSOFT32.ACM (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\IR32_32.DLL ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\IR32_32.DLL ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.MJPG - jl_mjpg2.drv File not found
Drivers32: vidc.XVID - xvidvfw.dll File not found
Drivers32: wave - C:\WINDOWS\System32\SERWVDRV.DLL (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/10/09 11:59:47 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\S. Michelle Wooten\Desktop\HiJackThis.exe
[2011/10/09 11:41:01 | 000,582,656 | —- | C] (OldTimer Tools) – C:\Documents and Settings\S. Michelle Wooten\Desktop\OTL.exe
[2011/10/09 11:30:43 | 003,900,592 | —- | C] (AVG Technologies) – C:\Documents and Settings\S. Michelle Wooten\Desktop\avg_isct_stb_all_2012_1831_ppc2.exe
[2011/10/09 00:41:12 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/10/09 00:41:12 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/10/08 18:37:32 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2011/10/07 19:38:42 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Real
[2011/10/05 19:59:47 | 000,000,000 | —D | C] – C:\Documents and Settings\S. Michelle Wooten\Local Settings\Application Data\NPE
[2011/10/05 19:25:33 | 000,000,000 | —D | C] – C:\Documents and Settings\S. Michelle Wooten\Application Data\Tific
[2011/10/05 17:20:29 | 000,106,928 | —- | C] (GEAR Software Inc.) – C:\WINDOWS\System32\GEARAspi.dll
[2011/10/04 19:27:41 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2011/10/04 19:27:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2011/10/04 19:23:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\White Sky, Inc
[2011/10/04 15:08:49 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/10/04 14:52:25 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/10/04 14:46:06 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/09/24 23:34:41 | 000,398,760 | R— | C] (Coupons, Inc.) – C:\WINDOWS\System32\cpnprt2.cid
[2011/09/24 23:30:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Coupons
[2011/09/24 23:30:53 | 000,000,000 | —D | C] – C:\Program Files\Coupons
[2011/09/20 01:10:32 | 000,000,000 | —D | C] – C:\Documents and Settings\S. Michelle Wooten\Application Data\MSNInstaller
[2011/09/18 21:59:11 | 000,000,000 | —D | C] – C:\Documents and Settings\S. Michelle Wooten\Application Data\Registry Mechanic
[2011/09/18 21:49:44 | 000,000,000 | —D | C] – C:\Program Files\Registry Mechanic
[2011/09/10 19:48:56 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hidserv.dll
[2011/09/10 19:48:51 | 000,012,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mouhid.sys
[2011/09/10 19:48:43 | 000,014,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhid.sys
[4 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[3 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/10/09 12:17:09 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/10/09 12:06:01 | 000,625,664 | —- | M] () – C:\Documents and Settings\S. Michelle Wooten\Desktop\dds.scr
[2011/10/09 11:59:49 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\S. Michelle Wooten\Desktop\HiJackThis.exe
[2011/10/09 11:41:01 | 000,582,656 | —- | M] (OldTimer Tools) – C:\Documents and Settings\S. Michelle Wooten\Desktop\OTL.exe
[2011/10/09 11:30:48 | 003,900,592 | —- | M] (AVG Technologies) – C:\Documents and Settings\S. Michelle Wooten\Desktop\avg_isct_stb_all_2012_1831_ppc2.exe
[2011/10/09 10:48:31 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2011/10/09 10:48:13 | 000,000,000 | —- | M] () – C:\WINDOWS\844023755
[2011/10/09 10:48:10 | 000,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT
[2011/10/09 10:47:58 | 534,827,008 | -HS- | M] () – C:\hiberfil.sys
[2011/10/08 19:48:23 | 000,000,448 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{2F3DC7DD-193F-4D48-9CDC-F88BD8D875AE}.job
[2011/10/07 19:54:59 | 000,000,221 | -HS- | M] () – C:\BOOT.INI
[2011/10/07 19:00:04 | 000,000,280 | —- | M] () – C:\WINDOWS\tasks\RMSchedule.job
[2011/10/07 13:03:58 | 000,047,872 | —- | M] () – C:\Documents and Settings\S. Michelle Wooten\Application Data\wklnhst.dat
[2011/10/06 21:05:25 | 000,019,968 | —- | M] () – C:\Documents and Settings\S. Michelle Wooten\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/10/06 17:29:02 | 000,000,256 | —- | M] () – C:\Documents and Settings\S. Michelle Wooten\pool.bin
[2011/10/06 02:41:37 | 000,000,825 | —- | M] () – C:\Documents and Settings\S. Michelle Wooten\Desktop\Norton Installation Files.lnk
[2011/10/05 21:06:13 | 000,000,815 | —- | M] () – C:\Documents and Settings\S. Michelle Wooten\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/10/05 21:02:11 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2011/10/05 20:00:52 | 002,562,040 | —- | M] () – C:\Documents and Settings\S. Michelle Wooten\Desktop\NPE.exe
[2011/10/05 18:56:11 | 000,001,940 | —- | M] () – C:\Documents and Settings\S. Michelle Wooten\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/10/04 13:15:39 | 000,003,564 | —- | M] () – C:\Documents and Settings\S. Michelle Wooten\Desktop\on nancy's wall 10 02 11.rtf
[2011/10/01 07:17:10 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/09/26 11:37:30 | 000,000,444 | —- | M] () – C:\WINDOWS\lexstat.ini
[2011/09/25 23:00:07 | 000,442,846 | —- | M] () – C:\WINDOWS\System32\PERFH009.DAT
[2011/09/25 23:00:07 | 000,072,112 | —- | M] () – C:\WINDOWS\System32\PERFC009.DAT
[2011/09/24 23:34:44 | 000,398,760 | R— | M] (Coupons, Inc.) – C:\WINDOWS\System32\cpnprt2.cid
[2011/09/18 22:26:36 | 008,024,064 | —- | M] () – C:\Documents and Settings\S. Michelle Wooten\s-1-5-21-150711622-62787169-932184494-1006.rrr
[2011/09/18 22:16:34 | 000,000,763 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Lexmark 4200 Series All-In-One Center.lnk
[2011/09/15 01:21:50 | 000,348,992 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/09/15 00:03:21 | 000,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/09/10 15:51:39 | 002,359,350 | —- | M] () – C:\Documents and Settings\S. Michelle Wooten\Desktop\untitled.bmp
[2011/09/09 16:59:22 | 000,006,881 | —- | M] () – C:\Documents and Settings\S. Michelle Wooten\Desktop\Dear paypal roughdraft.rtf
[4 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[3 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========
Post #5
========== Files Created - No Company Name ==========

[2011/10/09 12:05:59 | 000,625,664 | —- | C] () – C:\Documents and Settings\S. Michelle Wooten\Desktop\dds.scr
[2011/10/06 01:44:32 | 534,827,008 | -HS- | C] () – C:\hiberfil.sys
[2011/10/05 20:00:46 | 002,562,040 | —- | C] () – C:\Documents and Settings\S. Michelle Wooten\Desktop\NPE.exe
[2011/10/05 18:56:10 | 000,001,940 | —- | C] () – C:\Documents and Settings\S. Michelle Wooten\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/10/05 18:50:14 | 000,001,940 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/10/04 13:40:23 | 000,000,000 | —- | C] () – C:\WINDOWS\844023755
[2011/10/04 13:15:38 | 000,003,564 | —- | C] () – C:\Documents and Settings\S. Michelle Wooten\Desktop\on nancy's wall 10 02 11.rtf
[2011/09/18 22:26:31 | 008,024,064 | —- | C] () – C:\Documents and Settings\S. Michelle Wooten\s-1-5-21-150711622-62787169-932184494-1006.rrr
[2011/09/18 22:16:34 | 000,000,763 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Lexmark 4200 Series All-In-One Center.lnk
[2011/09/18 21:51:04 | 000,000,280 | —- | C] () – C:\WINDOWS\tasks\RMSchedule.job
[2011/09/10 15:51:35 | 002,359,350 | —- | C] () – C:\Documents and Settings\S. Michelle Wooten\Desktop\untitled.bmp
[2011/09/09 16:59:22 | 000,006,881 | —- | C] () – C:\Documents and Settings\S. Michelle Wooten\Desktop\Dear paypal roughdraft.rtf
[2011/07/09 14:35:43 | 000,009,048 | -HS- | C] () – C:\Documents and Settings\S. Michelle Wooten\Local Settings\Application Data\6vd0omv8k4prg7181tovcmo3736b
[2011/07/09 14:35:43 | 000,009,048 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\6vd0omv8k4prg7181tovcmo3736b
[2011/07/09 14:35:40 | 000,006,310 | —- | C] () – C:\Documents and Settings\S. Michelle Wooten\Application Data\F3E2.B34
[2010/07/01 00:38:33 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\dlbcvs.dll
[2010/07/01 00:38:29 | 000,000,373 | —- | C] () – C:\WINDOWS\System32\dlbccoin.ini
[2010/04/08 20:07:32 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/10/20 14:19:30 | 000,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2009/02/22 00:40:53 | 000,047,104 | —- | C] () – C:\WINDOWS\System32\Wh2Robo.dll
[2008/12/04 11:43:15 | 000,091,520 | —- | C] () – C:\WINDOWS\System32\WebIQEngineSetup.exe
[2008/08/23 16:49:37 | 000,000,256 | —- | C] () – C:\WINDOWS\System32\pool.bin
[2008/08/23 16:04:42 | 000,000,664 | —- | C] () – C:\Documents and Settings\S. Michelle Wooten\Local Settings\Application Data\FASTWiz.html
[2008/03/21 00:48:17 | 000,004,096 | —- | C] () – C:\WINDOWS\d3dx.dat
[2007/12/15 20:55:25 | 000,000,000 | —- | C] () – C:\WINDOWS\vpc32.INI
[2006/06/27 22:28:52 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2006/06/27 22:28:46 | 000,000,597 | —- | C] () – C:\WINDOWS\videomvp.ini
[2006/06/27 22:28:07 | 000,000,021 | —- | C] () – C:\WINDOWS\CS_SETUP.ini
[2006/05/22 21:11:13 | 000,000,026 | —- | C] () – C:\WINDOWS\UP9ASP.INI
[2006/05/22 21:09:29 | 000,000,075 | —- | C] () – C:\WINDOWS\upst.ini
[2006/05/22 21:09:29 | 000,000,030 | —- | C] () – C:\WINDOWS\atid.ini
[2006/05/07 20:02:33 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\LXBRPMON.DLL
[2006/05/07 20:02:33 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\LXBRPMUI.DLL
[2006/05/07 19:52:07 | 000,000,444 | —- | C] () – C:\WINDOWS\lexstat.ini
[2006/04/24 00:45:04 | 000,000,715 | —- | C] () – C:\WINDOWS\aolback.exe.lnk
[2006/04/24 00:31:27 | 000,000,012 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/04/22 19:26:04 | 000,047,872 | —- | C] () – C:\Documents and Settings\S. Michelle Wooten\Application Data\wklnhst.dat
[2006/04/18 14:07:01 | 000,001,082 | —- | C] () – C:\WINDOWS\checkip.dat
[2006/03/21 17:15:25 | 000,000,037 | —- | C] () – C:\WINDOWS\ipixActivex.ini
[2005/12/13 07:43:35 | 000,000,000 | —- | C] () – C:\WINDOWS\slingo.INI
[2005/10/03 17:33:57 | 000,000,141 | -HS- | C] () – C:\WINDOWS\WSYS049.SYS
[2005/08/19 22:47:05 | 000,000,141 | —- | C] () – C:\Documents and Settings\S. Michelle Wooten\Local Settings\Application Data\fusioncache.dat
[2005/08/12 10:27:36 | 000,019,968 | —- | C] () – C:\Documents and Settings\S. Michelle Wooten\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/08/10 09:58:50 | 000,000,861 | —- | C] () – C:\WINDOWS\dellstat.ini
[2005/08/05 11:19:29 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/08/05 11:08:58 | 000,000,868 | —- | C] () – C:\WINDOWS\WININIT.INI
[2005/08/05 11:05:37 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2005/08/05 11:03:45 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/08/05 10:48:54 | 000,002,048 | –S- | C] () – C:\WINDOWS\BOOTSTAT.DAT
[2005/08/05 10:48:10 | 000,442,846 | —- | C] () – C:\WINDOWS\System32\PERFH009.DAT
[2005/08/05 10:48:10 | 000,072,112 | —- | C] () – C:\WINDOWS\System32\PERFC009.DAT
[2005/08/05 10:25:38 | 000,000,370 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/06/22 14:37:46 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/02/23 15:05:34 | 000,049,152 | —- | C] () – C:\WINDOWS\SETPWRCG.EXE
[2004/08/10 14:13:12 | 000,000,780 | —- | C] () – C:\WINDOWS\ORUN32.INI
[2004/08/10 14:08:08 | 000,348,992 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 14:03:52 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/10 14:02:16 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 11:08:26 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\OEMBIOS.BIN
[2004/08/10 11:08:26 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\OEMBIOS.DAT
[2004/08/04 06:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\MLANG.DAT
[2004/08/04 06:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\PERFI009.DAT
[2004/08/04 06:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\DSSEC.DAT
[2004/08/04 06:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\MIB.BIN
[2004/08/04 06:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\PERFD009.DAT
[2004/08/04 06:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\SECUPD.DAT
[2004/08/04 06:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 06:00:00 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\FXSPERF.INI
[2004/08/04 06:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\NOISE.DAT
[2004/01/13 19:15:18 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\LXBMIH.EXE
[2004/01/13 19:06:46 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\LXBMLCNP.DLL
[2003/06/13 07:53:38 | 000,000,187 | —- | C] () – C:\WINDOWS\System32\lxbmcoin.ini
[2002/11/13 11:40:22 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxbmvs.dll
[2001/01/19 11:50:20 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\INSTMON.EXE
[1980/01/01 01:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\e100bmsg.dll

========== LOP Check ==========

[2011/10/06 01:01:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2011/08/13 22:24:50 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2008/03/21 00:48:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EA
[2008/05/31 20:38:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ludia
[2011/08/13 22:24:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2007/08/10 22:39:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NannyMania
[2009/10/20 09:03:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RoboForm
[2009/02/09 03:21:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SITEguard
[2009/02/09 12:42:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2011/09/23 19:07:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2007/01/13 02:30:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/10/04 19:23:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\White Sky, Inc
[2010/09/03 12:25:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/12/06 14:31:37 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\4200Series
[2007/01/19 04:49:28 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\acccore
[2010/02/09 05:17:46 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\Amazon
[2008/09/26 07:08:22 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/07/26 14:35:16 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\com.zoosk.Desktop.096E6A67431258A508A2446A847B240591D2C99B.1
[2007/04/05 20:39:10 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\DriveCleaner Free
[2007/08/16 18:00:03 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\EA
[2011/08/19 12:21:28 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\ElevatedDiagnostics
[2011/08/10 14:01:27 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\Elluminate
[2010/09/23 04:08:02 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\facemoods.com
[2009/11/08 14:42:31 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\GetRightToGo
[2007/06/25 20:53:05 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\IMVU
[2006/03/03 00:05:59 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\Leadertech
[2011/08/13 21:45:54 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\licenses
[2008/05/31 20:38:39 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\Ludia
[2009/07/31 18:27:19 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\mjusbsp
[2009/01/04 21:33:05 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\Morpheus Software
[2011/09/20 01:10:32 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\MSNInstaller
[2011/08/13 21:48:51 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\PCMM2009
[2011/08/13 21:45:44 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\PCMM2011
[2008/12/04 22:51:55 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\Pogo Games
[2011/09/18 21:59:11 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\Registry Mechanic
[2008/08/23 16:49:35 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\Research In Motion
[2011/10/05 19:25:33 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\Tific
[2007/01/13 02:30:01 | 000,000,000 | —D | M] – C:\Documents and Settings\S. Michelle Wooten\Application Data\Viewpoint
[2011/10/07 19:00:04 | 000,000,280 | —- | M] () – C:\WINDOWS\Tasks\RMSchedule.job
[2011/10/08 19:48:23 | 000,000,448 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{2F3DC7DD-193F-4D48-9CDC-F88BD8D875AE}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/01/14 10:59:25 | 000,036,179 | —- | M] () – C:\1f17005688a8ec924f26549f341880af.gif
[2009/01/14 10:46:30 | 000,081,499 | —- | M] () – C:\53c7426a50fc366e3865563d6fb9e326.jpg
[2009/01/14 10:58:40 | 000,023,598 | —- | M] () – C:\6e6795c1cc63abcf12eb13bd8e0cde54.png
[2009/01/14 10:49:32 | 000,007,712 | —- | M] () – C:\937227b884c70c47cfd09de0a12b6526.jpg
[2005/12/06 10:04:41 | 000,010,920 | —- | M] () – C:\aolconnfix.exe
[2005/12/06 10:04:41 | 000,001,039 | —- | M] () – C:\aolconnfix.txt
[2004/08/10 14:04:08 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2011/10/07 19:54:59 | 000,000,221 | -HS- | M] () – C:\BOOT.INI
[2006/07/01 13:23:13 | 000,179,320 | —- | M] () – C:\ClearLog.txt
[2004/08/10 14:04:08 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/07/29 13:09:50 | 000,479,674 | —- | M] () – C:\debugfile.txt
[2005/08/05 10:32:48 | 000,005,063 | RH– | M] () – C:\DELL.SDR
[2010/04/21 08:29:34 | 000,000,202 | —- | M] () – C:\dlbt.log
[2008/02/26 00:05:40 | 000,004,182 | —- | M] () – C:\DTLog.txt
[2007/08/26 21:55:47 | 000,000,061 | —- | M] () – C:\DVDPATH.TXT
[2006/07/01 13:41:21 | 000,000,392 | —- | M] () – C:\EasyShareInstall.log
[2009/01/13 23:50:09 | 000,007,284 | —- | M] () – C:\f12c5aa641cb79424b1597018b988540.jpg
[2011/10/09 10:47:58 | 534,827,008 | -HS- | M] () – C:\hiberfil.sys
[2004/08/10 14:14:36 | 000,004,128 | —- | M] () – C:\INFCACHE.1
[2004/08/10 14:04:08 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2004/08/10 14:04:08 | 000,000,000 | -H– | M] () – C:\MSDOS.SYS
[2009/08/05 10:45:50 | 000,001,100 | —- | M] () – C:\net_save.dna
[2004/08/04 06:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/03/09 08:24:17 | 000,250,048 | RHS- | M] () – C:\NTLDR
[2011/10/09 10:47:51 | 805,306,368 | -HS- | M] () – C:\pagefile.sys
[2005/09/29 22:50:02 | 000,000,000 | —- | M] () – C:\palsound.txt
[2006/01/05 21:29:46 | 000,001,520 | —- | M] () – C:\Poppit.Bmp
[2005/08/05 11:07:05 | 000,000,087 | —- | M] () – C:\SystemInfo.ini
[2009/01/14 10:48:50 | 000,001,911 | —- | M] () – C:\thm_trustingmen_thumb.jpg
[2011/04/25 17:43:59 | 000,053,721 | —- | M] () – C:\VETlog.dmp
[2011/04/25 17:43:59 | 004,084,185 | —- | M] () – C:\VETlog.txt
[2006/07/30 01:23:49 | 000,000,002 | —- | M] () – C:\wizard.txt
[2007/06/29 14:25:21 | 000,007,306 | —- | M] () – C:\YServer.txt
Post #6
@Alternate Data Stream - 99 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:27EEEB5C @Alternate Data Stream - 784 bytes -> C:\WINDOWS\844023755:876130765.exe @Alternate Data Stream - 76 bytes -> C:\Documents and Settings\S. Michelle Wooten\My Documents\IMG00019.jpg:Roxio EMC Stream @Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9B7E8561 @Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A73EAFFB @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C5A35877 @Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:13D82150 @Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4EFDF5FB @Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 @Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B85C37B @Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5EC637CB < End of report >
Post #7
EXTRAS.TXT


OTL Extras logfile created on: 10/9/2011 12:11:27 p.m.Shelly - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Documents and Settings\S. Michelle Wooten\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

509.98 Mb Total Physical Memory | 86.24 Mb Available Physical Memory | 16.91% Memory free
1.22 Gb Paging File | 0.52 Gb Available in Paging File | 42.99% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.37 Gb Total Space | 41.89 Gb Free Space | 59.52% Space Free | Partition Type: NTFS
Drive E: | 7.46 Gb Total Space | 7.46 Gb Free Space | 100.00% Space Free | Partition Type: FAT32

Computer Name: DGFDV281 | User Name: S. Michelle Wooten | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"2107:TCP" = 2107:TCP:*:Enabled:Akamai NetSession Interface
"5000:UDP" = 5000:UDP:*:Enabled:Akamai NetSession Interface

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL
"C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe:*:Enabled:AOL – (AOL LLC)
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL – (AOL LLC)
"C:\Program Files\America Online 9.0a\waol.exe" = C:\Program Files\America Online 9.0a\waol.exe:*:Enabled:America Online 9.0a
"C:\Program Files\AOL 9.0\waol.exe" = C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0
"C:\Program Files\AOL 9.1\waol.exe" = C:\Program Files\AOL 9.1\waol.exe:*:Enabled:AOL 9.1 – (AOL, LLC.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Yahoo!\Messenger\YPager.exe" = C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger
"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL
"C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe:*:Enabled:AOL – (AOL LLC)
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL – (AOL LLC)
"C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe" = C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe:*:Enabled:AOL TopSpeed – (AOL LLC)
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (AOL LLC)
"C:\Program Files\Common Files\AOL\1166619106\ee\aolsoftware.exe" = C:\Program Files\Common Files\AOL\1166619106\ee\aolsoftware.exe:*:Enabled:AOL Services
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"C:\Program Files\Common Files\AOL\System Information\sinf.exe" = C:\Program Files\Common Files\AOL\System Information\sinf.exe:*:Enabled:AOL System Information – (AOL LLC)
"C:\Program Files\Common Files\AOL\1192804660\ee\aolsoftware.exe" = C:\Program Files\Common Files\AOL\1192804660\ee\aolsoftware.exe:*:Enabled:AOL Shared Components – (AOL LLC)
"C:\Program Files\AOL 9.0\waol.exe" = C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0
"C:\Program Files\Roxio\Media Manager 9\MediaManager9.exe" = C:\Program Files\Roxio\Media Manager 9\MediaManager9.exe:*:Enabled:MediaManager9 Module – (Sonic Solutions)
"C:\Program Files\MySpace\IM\MySpaceIM.exe" = C:\Program Files\MySpace\IM\MySpaceIM.exe:*:Enabled:MySpace Instant Messenger
"C:\Program Files\AOL 9.1\waol.exe" = C:\Program Files\AOL 9.1\waol.exe:*:Enabled:AOL 9.1 – (AOL, LLC.)
"C:\WINDOWS\SYSTEM32\usmt\migwiz.exe" = C:\WINDOWS\SYSTEM32\USMT\MIGWIZ.EXE:*:Enabled:Files and Settings Transfer Wizard – (Microsoft Corporation)
"C:\Documents and Settings\S. Michelle Wooten\Application Data\mjusbsp\magicJack.exe" = C:\Documents and Settings\S. Michelle Wooten\Application Data\mjusbsp\magicJack.exe:*:Disabled:magicJack – (magicJack L.P.)
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java™ Platform SE binary
"C:\WINDOWS\SYSTEM32\java.exe" = C:\WINDOWS\SYSTEM32\java.exe:*:Enabled:Java™ Platform SE binary – (Oracle)
"C:\Program Files\America Online 9.0a\waol.exe" = C:\Program Files\America Online 9.0a\waol.exe:*:Enabled:America Online 9.0a
"C:\Program Files\Common Files\AOL\1166619106\ee\AOLOpenRide.exe" = C:\Program Files\Common Files\AOL\1166619106\ee\AOLOpenRide.exe:*:Disabled:AOL OpenRide
"F:\N8\NeverBit.exe" = F:\N8\NeverBit.exe:*:Enabled:Neverdaunt:8Bit
"C:\Documents and Settings\S. Michelle Wooten\Local Settings\Temporary Internet Files\Content.IE5\97TFJ71N\AudioConverterSetup[1].exe" = C:\Documents and Settings\S. Michelle Wooten\Local Settings\Temporary Internet Files\Content.IE5\97TFJ71N\AudioConverterSetup[1].exe:*:Enabled:Audio Converter
"C:\Documents and Settings\S. Michelle Wooten\Local Settings\Temp\is799009782\AInstaller.exe" = C:\Documents and Settings\S. Michelle Wooten\Local Settings\Temp\is799009782\AInstaller.exe:*:Enabled:AD Installer


========== HKEY_LOCAL_MACHINE Uninstall List ==========
Post #8
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{0456ebd7-5f67-4ab6-852e-63781e3f389c}" = Macromedia Flash Player "{05410044-64A6-4248-A026-9745C1E9E159}" = Microsoft Encarta Encyclopedia Standard 2005 "{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data "{0D048BE8-AE02-4CB5-A428-616B9848E4A7}" = BlackBerry Desktop Software 4.3 "{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0 "{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE "{17334AAF-C9E7-483B-9F45-E3FCAF07FFA7}" = Intel® PROSet for Wired Connections "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 21 "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager "{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10 "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{350FB27C-CF62-4EF3-AF9D-70FF313FE221}" = iTunes "{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page "{3F262ADC-5AD2-48E5-A586-44315E04A9E2}" = Microsoft Picture It! Library 10 "{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = Modem On Hold "{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works "{4192EAC0-6B36-4723-B216-D0E86E7757AC}" = Jasc Paint Shop Photo Album 5 "{42756145-9997-4D28-809B-8756BFD00106}" = Microsoft Picture It! Premium 10 "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF}" = Banctec Service Agreement "{548EEA8E-8299-497F-8057-811D2D7097DC}" = Dell Support 3.1 "{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool "{5EED93A8-33AD-46A7-A6AC-4DEAFBEFEEE1}" = Roxio Media Manager "{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon "{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0 "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.5 "{69A83D99-D41B-4396-BCC4-3DCB77DFFED0}" = WebIQ Technology Engine "{6E179C77-7335-458D-9537-4F4EAC0181ED}" = Photo Click "{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK "{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore "{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762 "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com "{78C496B9-5A6B-4692-8C2E-AFFFC34E4961}" = Jasc Paint Shop Pro Studio, Dell Editon "{78D944D7-A97B-4004-AB0A-B5AD06839940}" = My Way Search Assistant "{797EE0CA-8165-405C-B5CE-F11EC20F1BB0}" = Microsoft VC9 runtime libraries "{7A0EFAFB-AC4B-4B88-8C6B-6731BE88DB68}" = Modem Event Monitor "{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper "{81A34902-9D0B-4920-A25C-4CDC5D14B328}" = Jasc Paint Shop Pro 8 Dell Edition "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver "{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12 "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007 "{90120000-0015-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007 "{90120000-0016-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007 "{90120000-0018-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007 "{90120000-0019-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007 "{90120000-001A-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007 "{90120000-001B-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_PROR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_PROR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}_PROR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007 "{90120000-0115-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007 "{90120000-0117-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007 "{91120000-0014-0000-0000-0000000FF1CE}_PROR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{91120000-0014-0000-0000-0000000FF1CE}_PROR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{911B0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002 "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB2}" = Paint.NET v3.5.8 "{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures "{AC0EE5B0-A8FB-4D0A-AF03-2EDC518F841B}" = Dell Media Experience "{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.6 "{AF06CAE4-C134-44B1-B699-14FBDB63BD37}" = Dell Picture Studio v3.0 "{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy "{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR "{BE8913B7-B2C4-48BE-8A26-84390FF4F231}" = DMX Update "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CB54ABA8-D67F-47AD-A76C-2631BADA9FE5}" = Microsoft Works Suite Add-in for Microsoft Word "{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0}" = Jasc Paint Shop Photo Album "{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support "{DE1AF137-C455-494A-A817-EFE44BCCFDEE}" = Works Upgrade "{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime "{F57D8342-E2E4-46F4-915A-F50817CBCB45}" = ArcSoft Software Suite "{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
Post #9
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AOL Uninstaller" = AOL Uninstaller (Choose which Products to Remove)
"BlackBerry_{0D048BE8-AE02-4CB5-A428-616B9848E4A7}" = BlackBerry Desktop Software 4.3
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Coupon Printer for Windows5.0.0.1" = Coupon Printer for Windows
"Dell Photo Printer 720" = Dell Photo Printer 720
"Dell Photo Printer 720 Logger" = Dell Photo Printer 720 Logger
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Intel® 537EP V9x DF PCI Modem" = Intel® 537EP V9x DF PCI Modem
"Jasc Paint Shop Pro Studio.01 , Dell Edition 1.0.1.1 Patch" = Jasc Paint Shop Pro Studio.01 , Dell Edition 1.0.1.1 Patch
"Lexmark 4200 Series" = Lexmark 4200 Series
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Money2005b" = Microsoft Money 2005
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MyMouse_is1" = MyMouse 4.3
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Paint Shop Pro 6.0" = Paint Shop Pro 6.0 (ESD)
"PictureItPrem_v10" = Microsoft Picture It! Premium 10
"PROR" = Microsoft Office Professional 2007 Trial
"PROSet" = Intel® PRO Network Adapters and Drivers
"RealPlayer 6.0" = RealPlayer
"Shockwave" = Shockwave
"ViewpointMediaPlayer" = Viewpoint Media Player
"WebCyberCoach_wtrb" = WebCyberCoach 3.2 Dell
"WIC" = Windows Imaging Component
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinPcapInst" = WinPcap 4.1.1
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Works2005Setup" = Microsoft Works 2005 Setup Launcher
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"309a46b1dc89b774" = Dell Driver Download Manager
"blinkx beat" = blinkx beat
"f031ef6ac137efc5" = Dell Driver Download Manager - 1
Post #13
Hi Shelly46013,

Can you zip the aswMBR log and attach it?

There will be a file on your desktop named aswMBR.txt. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.

Do the same with MBR.txt

Thanks
Post #14
Thanks for working with me :) Here's the results of trying to run and save the aswMBR.exe : at the end of the scan it did not allow me to save the log as it just disappeared and left an icon aswMBR.exe. I tried to compress the file to attatch it and got this error message: compressed (zipped) Folders Error file not found or no read permission Then it shows at the top another window that says compressing… but it's not finishing even as the window shows a file moving papers to the other file and the blue is already at the end as if it were finished. I clicked ok and it disappeared! the file aswMBR.exe is still on my desktop but disabled.
Post #15
Hi

Can you open the OTL.txt and look for a section named Custom scans. This section is missing from the OTL.txt you posted. Please try to post the Custom scan part. It may contain some information we need.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI