Spyware / Malware / Virus Removal

Ping.exe / NetBT.sys Infection

18 min read

Looking for the outcome? Ask AI

NoodleTech

Post #16November 23, 2011, 5:08 PM UTC last edited November 23, 2011, 5:12 PM UTC

Hi ent,

Your computer appears to be clean!

Now let's clean up the tools we used and send you on your way.

Please delete aswMBR, GMER, and DDS from your desktop.

===================================================

Follow these steps to uninstall Combofix

Click START then RUN
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

===================================================

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

===================================================

Here are some tips to reduce the potential for spyware infection in the future:

Updates

It is very important that you keep your Operating System, anti-virus software and applications up to date so that you will be less susceptible to malware.
It's a good idea to have Windows Update automatically download and install updates as they become available.
FileHippo Update Checker is a great tool that will tell you which of your third party applications need to be updated.

Run Anti-Virus Software

For an excellent list of free anti virus software, free online virus scanners, free spyware detection/removal and free firewalls, click here.
IMPORTANT! Please make sure you only have ONE firewall and ONE real-time antivirus installed on your system.
When using "on demand" scanners, first update the detection signature files, then disconnect from the internet and disable your resident security program before running the scan.
Once complete, remember to re-engage your resident security before going online.

Passwords

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection.
Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

How to Prevent Malware by miekiemoes
PC Safety and Security–What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop

WOT has an add-on available for both Firefox and IE.

SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here

MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
- Download Host.zip and Save it to your Desktop.
- Right-click hosts.zip and select 'Extract all files' or 'Extract files…'.
- Follow the prompts and click 'Finish'.
- This will open the newly created hosts folder on your Desktop.
- Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
- Once updated you should see another prompt that the task was completed.
Firefox is a great alternative to Internet Explorer.
No-Script provides additional security for Mozilla Firefox users by preventing malicious scripts from being executed on your system.

Follow this list and keep your antivirus program and antispyware programs updated and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically.

Hopefully this should take care of your problems! Good luck.

Do you have any further questions?

**Please respond one more time to confirm your problem is resolved so I can close this thread.

ent

Post #17November 23, 2011, 9:46 PM UTC

I have to tell you that I really, really appreciate your dedication to this task! You stuck with me all day and into the wee hours, and we got it cleaned up in record time. I use my computer for doing real work, so being unable to use it for an extended period of time is extremely frustrating. I will definitely look into most of the recommendations in your last posting. I have one general question, if you have the time… What part do System Restore and backups play in the disinfection process? For example, if I had a recent full system backup, would doing a full restore have fixed the rootkit problem? I don't recall seeing much discussion of this option in malware forums. Or if I had been able to do a System Restore, should it have been the first thing to try? In this case I couldn't because the infection disabled it, but it makes me wonder what the very first step should be if I think I'm infected. Again, I really appreciate your help. I will be sending in a donation. Thanks!

NoodleTech

Post #18November 24, 2011, 4:21 AM UTC last edited November 24, 2011, 4:21 AM UTC

Hi ent, Thank for your kind words and donation! It is my pleasure and I am glad that I was able to get you back up and running! Unfortunately a full system restore would not fix your malware problems and I would not recommend it as a preliminary step. More often than not, your restore points would contain malware so doing a system restore would actually restore your computer to a previous state that contains infected files. You should NOT however delete all your system restore points because sometimes mistakes are made in the malware cleaning process that can seriously cripple your system. You would want to have these system restore points in place so that the system could be restored to a working state even if that state contains malware. The best practice is to leave system restore enabled and system restore points in place until the computer is stable and clean, then delete all the old infected restore points. When we remove ComboFix using the uninstall switch, it actually purges old system restore points and sets a fresh new one. Do you have any more questions?

ent

Post #19November 24, 2011, 5:27 AM UTC

Here and attached are the DDS scan results that you requested… ———- . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.1.0 Run by [removed] at 23:20:51 on 2011-11-23 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.219 [GMT -6:00] . AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ============== Running Processes =============== . C:\WINDOWS\system32\svchost.exe -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\Program Files\AVG\AVG2012\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\stsystra.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Program Files\AVG\AVG2012\avgtray.exe C:\Program Files\Dell Support\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe C:\Program Files\CapsUnlock\CapsUnlock.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Program Files\Logitech\SetPointP\SetPoint.exe C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Program Files\AVG\AVG2012\avgui.exe C:\WINDOWS\system32\wscntfy.exe . ============== Pseudo HJT Report =============== . uStart Page = about:blank uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = ;*.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll uRun: [DellSupport] "c:\program files\dell support\DSAgnt.exe" /startup uRun: [MusicManager] "c:\documents and settings\bill entwistle\local settings\application data\programs\google\musicmanager\MusicManager.exe" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [FileHippo.com] "c:\program files\filehippo.com\UpdateChecker.exe" /background mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [SigmatelSysTrayApp] stsystra.exe mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\Iaanotif.exe mRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe" mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming StartupFolder: c:\docume~1\billen~1\startm~1\programs\startup\capsun~1.lnk - c:\program files\capsunlock\CapsUnlock.exe StartupFolder: c:\docume~1\billen~1\startm~1\programs\startup\flasht~1.lnk - c:\program files\flashtray pro\FlashTray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\microt~1.lnk - c:\program files\microtek\scanwizard 5\ScannerFinder.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe Trusted Zone: internet Trusted Zone: netflix.com\www Trusted Zone: pandora.com DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1307775913765 DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177138576847 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1177467272937 DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} TCP: DhcpNameServer = 192.168.1.254 TCP: Interfaces\{579E98ED-CD52-4E61-B524-E6FBBB03B165} : DhcpNameServer = 192.168.1.254 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll Notify: igfxcui - igfxdev.dll Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Eudora's Shell Extension: {edb0e980-90bd-11d4-8599-0008c7d3b6f8} - c:\program files\eudora\EuShlExt.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll mASetup: {621FCD24-4498-4324-A81E-07D331376EDF} - c:\program files\pixiepack codec pack\InstallerHelper.exe . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\bill entwistle\application data\mozilla\firefox\profiles\6xnqpoll.default\ FF - prefs.js: browser.startup.homepage - about:blank FF - plugin: c:\documents and settings\bill entwistle\application data\facebook\npfbplugin_1_0_1.dll FF - plugin: c:\documents and settings\bill entwistle\application data\facebook\npfbplugin_1_0_3.dll FF - plugin: c:\documents and settings\bill entwistle\local settings\application data\google\update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll FF - plugin: c:\program files\java\jre7\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\java\jre7\bin\new_plugin\npjp2.dll FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll . ============= SERVICES / DRIVERS =============== . R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 32592] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-10-7 230608] R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 295248] R1 mfehidk;mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-1-16 213640] R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776] R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-9-25 189736] R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2011-5-16 12184] R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-7-11 134608] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-7-11 24272] R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-10-4 16720] S2 0258161238559076mcinstcleanup;0258161238559076mcinstcleanup; [x] S2 0327391238561196mcinstcleanup;0327391238561196mcinstcleanup; [x] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-10-12 4433248] S2 winmgmt32;Windows Management Instrumentation ;c:\windows\system32\msacm32.exe –> c:\windows\system32\msacm32.exe [?] S3 LW;LW;c:\docume~1\billen~1\locals~1\temp\lw.exe –> c:\docume~1\billen~1\locals~1\temp\LW.exe [?] S3 mferkdk;mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-3-30 34216] S3 notecable;NoteCable Driver (WDM);c:\windows\system32\drivers\notcable.sys –> c:\windows\system32\drivers\notcable.sys [?] S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520] . =============== File Associations =============== . .txt=TextPad.txt . =============== Created Last 30 ================ . 2011-11-24 00:59:17 53248 —-a-r- c:\documents and settings\bill entwistle\application data\microsoft\installer\{3ee9bcae-e9a9-45e5-9b1c-83a4d357e05c}\ARPPRODUCTICON.exe 2011-11-24 00:58:58 ——– d—–w- c:\documents and settings\bill entwistle\local settings\application data\Logishrd 2011-11-23 23:42:05 ——– d—–w- c:\documents and settings\all users\application data\{429CAD59-35B1-4DBC-BB6D-1DB246563521} 2011-11-23 23:22:58 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll 2011-11-23 23:22:58 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll 2011-11-23 23:22:58 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll 2011-11-23 23:22:58 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll 2011-11-23 23:22:58 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll 2011-11-23 23:22:58 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll 2011-11-23 23:22:58 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin.dll 2011-11-23 18:19:51 56200 —-a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{d7598baa-21b9-447d-8437-1655871cb5d5}\offreg.dll 2011-11-23 18:18:17 ——– d—–w- c:\program files\FileHippo.com 2011-11-23 17:57:33 ——– d-s—w- C:\ComboFix 2011-11-23 08:19:20 ——– d—–w- c:\program files\ESET 2011-11-23 08:01:31 ——– d—–w- c:\documents and settings\bill entwistle\local settings\application data\Sun 2011-11-23 07:58:45 128000 —-a-w- c:\windows\system32\javacpl.cpl 2011-11-23 07:49:01 ——– d-sh–w- c:\documents and settings\bill entwistle\PrivacIE 2011-11-23 07:42:40 ——– d—–w- c:\windows\ie8updates 2011-11-23 07:40:33 ——– dc-h–w- c:\windows\ie8 2011-11-23 07:35:06 6144 ——w- c:\windows\system32\dllcache\iecompat.dll 2011-11-23 07:34:03 12800 ——w- c:\windows\system32\dllcache\xpshims.dll 2011-11-23 07:33:50 743424 ——w- c:\windows\system32\dllcache\iedvtool.dll 2011-11-23 07:33:43 247808 ——w- c:\windows\system32\dllcache\ieproxy.dll 2011-11-22 19:48:51 6668624 —-a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{d7598baa-21b9-447d-8437-1655871cb5d5}\mpengine.dll 2011-11-22 19:06:36 ——– d—–w- C:\ad50495e293c0ecf77207ce935a5 2011-11-21 08:21:27 6668624 —-a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\backup\mpengine.dll 2011-11-20 21:22:56 ——– d—–w- C:\$AVG 2011-11-20 20:59:11 ——– d—–w- c:\documents and settings\bill entwistle\application data\AVG2012 2011-11-20 20:57:56 ——– d–h–w- c:\documents and settings\all users\application data\Common Files 2011-11-20 20:56:18 ——– d—–w- c:\windows\system32\drivers\AVG 2011-11-20 20:56:18 ——– d—–w- c:\documents and settings\all users\application data\AVG2012 2011-11-20 20:55:04 ——– d—–w- c:\program files\AVG 2011-11-20 20:50:28 ——– d—–w- c:\documents and settings\all users\application data\MFAData 2011-11-20 20:39:55 ——– d—–w- c:\program files\Bonjour 2011-11-20 19:05:40 ——– d—–w- c:\program files\6A1DD 2011-11-20 18:45:24 ——– d—–w- c:\program files\CyberFOX Software . ==================== Find3M ==================== . 2011-11-24 00:58:38 16400 —-a-w- c:\windows\system32\drivers\LNonPnP.sys 2011-11-23 07:58:16 544656 —-a-w- c:\windows\system32\deployJava1.dll 2011-11-20 23:37:02 162816 —-a-w- c:\windows\system32\drivers\netbt.sys 2011-11-20 19:23:14 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-10-24 20:29:02 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx 2011-10-24 20:29:02 69632 —-a-w- c:\windows\system32\QuickTime.qts 2011-10-10 14:22:41 692736 —-a-w- c:\windows\system32\inetcomm.dll 2011-10-07 12:23:48 230608 —-a-w- c:\windows\system32\drivers\avgldx86.sys 2011-10-04 12:21:42 16720 —-a-w- c:\windows\system32\drivers\AVGIDSShim.sys 2011-09-28 07:06:50 599040 —-a-w- c:\windows\system32\crypt32.dll 2011-09-26 16:41:20 611328 ——w- c:\windows\system32\uiautomationcore.dll 2011-09-26 16:41:20 220160 —-a-w- c:\windows\system32\oleacc.dll 2011-09-26 16:41:14 20480 —-a-w- c:\windows\system32\oleaccrc.dll 2011-09-13 12:30:10 32592 —-a-w- c:\windows\system32\drivers\avgrkx86.sys 2011-09-06 13:20:51 1858944 —-a-w- c:\windows\system32\win32k.sys 2011-09-02 06:31:28 55064 —-a-w- c:\windows\system32\SET163.tmp 2011-09-02 06:31:28 39192 —-a-w- c:\windows\system32\drivers\LMouFilt.Sys 2011-09-02 06:31:28 30360 —-a-w- c:\windows\system32\drivers\LUsbFilt.sys 2011-09-02 06:31:20 41240 —-a-w- c:\windows\system32\drivers\LHidFilt.Sys 2011-09-02 06:31:20 1583896 —-a-w- c:\windows\system32\LkmdfCoInst.dll 2011-09-02 06:30:58 12184 —-a-w- c:\windows\system32\drivers\LBeepKE.sys 2011-08-31 22:00:50 22216 ——w- c:\windows\system32\drivers\mbam.sys 2011-08-31 05:05:04 83816 —-a-w- c:\windows\system32\dns-sd.exe 2011-08-31 05:05:04 73064 —-a-w- c:\windows\system32\dnssd.dll 2011-08-31 05:05:04 178536 —-a-w- c:\windows\system32\dnssdX.dll . ============= FINISH: 23:21:42.73 ===============

Attachments:

📎Attach.txt.txt

NoodleTech

Post #20November 24, 2011, 5:46 AM UTC

Hi ent,

Thanks for the log. That service is still there so we need to remove it.

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Select All Users
Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
consrv.dll
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
CREATERESTOREPOINT
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Post both logs

ent

Post #21November 24, 2011, 6:04 AM UTC

Here you go…

———-

OTL logfile created on: 11/23/2011 11:52:34 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Bill Entwistle\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1013.84 Mb Total Physical Memory | 552.68 Mb Available Physical Memory | 54.51% Memory free
2.38 Gb Paging File | 1.89 Gb Available in Paging File | 79.22% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 68.36 Gb Total Space | 25.61 Gb Free Space | 37.47% Space Free | Partition Type: NTFS
Drive F: | 68.36 Gb Total Space | 16.86 Gb Free Space | 24.67% Space Free | Partition Type: NTFS
Drive G: | 2.93 Gb Total Space | 1.18 Gb Free Space | 40.09% Space Free | Partition Type: NTFS
Drive H: | 6.31 Gb Total Space | 5.16 Gb Free Space | 81.81% Space Free | Partition Type: NTFS

Computer Name: TUCKER | User Name: Bill Entwistle | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/11/23 23:51:07 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Bill Entwistle\Desktop\OTL.exe
PRC - [2011/11/23 01:58:16 | 000,161,664 | —- | M] (Oracle Corporation) – C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2011/10/24 20:29:16 | 002,415,456 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2011/10/18 06:14:54 | 001,229,152 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2011/10/12 06:25:22 | 004,433,248 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011/10/07 03:40:42 | 001,387,288 | —- | M] (Logitech, Inc.) – C:\Program Files\Logitech\SetPointP\SetPoint.exe
PRC - [2011/09/27 13:05:24 | 000,149,784 | —- | M] (Logitech, Inc.) – C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
PRC - [2011/09/08 20:53:26 | 000,743,264 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2011/08/15 06:21:40 | 000,337,760 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2011/08/02 06:09:08 | 000,192,776 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2010/10/27 19:17:52 | 000,207,424 | —- | M] (ArcSoft Inc.) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010/03/18 10:19:26 | 000,113,152 | —- | M] (ArcSoft Inc.) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2009/09/25 23:32:18 | 000,189,736 | —- | M] (Seagate Technology LLC) – C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
PRC - [2009/09/25 23:31:32 | 000,185,640 | —- | M] (Seagate LLC) – C:\Program Files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe
PRC - [2008/04/13 18:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/11/08 09:20:22 | 000,344,064 | —- | M] () – C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
PRC - [2007/04/24 23:12:13 | 000,013,312 | —- | M] (BrainSystems) – C:\Program Files\CapsUnlock\CapsUnlock.exe
PRC - [2006/11/10 09:12:30 | 000,099,936 | —- | M] () – C:\Program Files\Canon\IJPLM\ijplmsvc.exe
PRC - [2006/11/03 19:20:12 | 000,866,584 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2006/11/03 19:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2006/08/28 19:57:12 | 000,395,776 | —- | M] (Gteko Ltd.) – C:\Program Files\Dell Support\DSAgnt.exe
PRC - [2006/07/24 08:20:00 | 000,282,624 | —- | M] (SigmaTel, Inc.) – C:\WINDOWS\stsystra.exe
PRC - [2006/07/06 05:15:00 | 000,151,552 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2006/07/06 05:14:30 | 000,090,112 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2005/10/05 01:12:00 | 000,094,208 | —- | M] () – C:\Program Files\Dell\Media Experience\DMXLauncher.exe
PRC - [2005/09/08 03:20:00 | 000,122,940 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\DLA\DLACTRLW.EXE

========== Modules (No Company Name) ==========

MOD - [2011/10/07 03:41:16 | 000,879,896 | —- | M] () – C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll
MOD - [2011/09/27 07:23:00 | 000,087,912 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/09/27 07:22:40 | 001,242,472 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009/08/16 16:06:02 | 000,141,312 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll
MOD - [2007/11/08 09:20:22 | 000,344,064 | —- | M] () – C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
MOD - [2007/04/24 23:12:13 | 000,003,072 | —- | M] () – C:\Program Files\CapsUnlock\CapsUnlock.dll
MOD - [2006/11/10 09:12:30 | 000,099,936 | —- | M] () – C:\Program Files\Canon\IJPLM\ijplmsvc.exe
MOD - [2005/10/05 01:12:00 | 000,094,208 | —- | M] () – C:\Program Files\Dell\Media Experience\DMXLauncher.exe

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] – – (winmgmt32)
SRV - File not found [Auto | Stopped] – – (McNASvc)
SRV - File not found [Auto | Stopped] – – (mcmscsvc)
SRV - File not found [On_Demand | Stopped] – – (LW)
SRV - File not found [Auto | Stopped] – – (KodakCCS)
SRV - File not found [Disabled | Stopped] – – (HidServ)
SRV - File not found [Auto | Stopped] – – (0327391238561196mcinstcleanup)
SRV - File not found [Auto | Stopped] – – (0258161238559076mcinstcleanup)
SRV - [2011/11/23 01:58:16 | 000,161,664 | —- | M] (Oracle Corporation) [Auto | Running] – C:\Program Files\Java\jre7\bin\jqs.exe – (JavaQuickStarterService)
SRV - [2011/10/12 06:25:22 | 004,433,248 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe – (AVGIDSAgent)
SRV - [2011/09/27 13:03:28 | 000,295,192 | —- | M] (Logitech, Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe – (LBTServ)
SRV - [2011/08/02 06:09:08 | 000,192,776 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgwdsvc.exe – (avgwd)
SRV - [2010/03/18 10:19:26 | 000,113,152 | —- | M] (ArcSoft Inc.) [Auto | Running] – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe – (ACDaemon)
SRV - [2009/09/25 23:32:18 | 000,189,736 | —- | M] (Seagate Technology LLC) [Auto | Running] – C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe – (FreeAgentGoNext Service)
SRV - [2006/11/10 09:12:30 | 000,099,936 | —- | M] () [Auto | Running] – C:\Program Files\Canon\IJPLM\ijplmsvc.exe – (IJPLMSVC)
SRV - [2006/11/03 19:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MsMpEng.exe – (WinDefend)
SRV - [2006/07/06 05:14:30 | 000,090,112 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe – (IAANTMON) Intel®

========== Driver Services (SafeList) ==========

DRV - [2011/10/07 06:23:48 | 000,230,608 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2011/10/04 06:21:42 | 000,016,720 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSShim.sys – (AVGIDSShim)
DRV - [2011/09/13 06:30:10 | 000,032,592 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys – (Avgrkx86)
DRV - [2011/09/02 00:31:28 | 000,039,192 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LMouFilt.Sys – (LMouFilt)
DRV - [2011/09/02 00:31:28 | 000,030,360 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LUsbFilt.sys – (LUsbFilt)
DRV - [2011/09/02 00:31:20 | 000,041,240 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LHidFilt.Sys – (LHidFilt)
DRV - [2011/09/02 00:30:58 | 000,012,184 | —- | M] (Logitech, Inc.) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\LBeepKE.sys – (LBeepKE)
DRV - [2011/08/08 06:08:58 | 000,040,016 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\WINDOWS\system32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2011/07/11 01:14:38 | 000,295,248 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2011/07/11 01:14:28 | 000,024,272 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys – (AVGIDSFilter)
DRV - [2011/07/11 01:14:28 | 000,023,120 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys – (AVGIDSEH)
DRV - [2011/07/11 01:14:26 | 000,134,608 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys – (AVGIDSDriver)
DRV - [2009/02/13 11:02:52 | 000,011,520 | —- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wdcsam.sys – (WDC_SAM)
DRV - [2009/01/16 19:04:28 | 000,213,640 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\mfehidk.sys – (mfehidk)
DRV - [2009/01/16 19:03:56 | 000,034,216 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\mferkdk.sys – (mferkdk)
DRV - [2007/12/11 09:52:12 | 000,026,784 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\tbhsd.sys – (tbhsd)
DRV - [2006/07/24 08:20:00 | 001,156,648 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\sthda.sys – (STHDA)
DRV - [2006/01/10 09:07:58 | 000,004,864 | —- | M] (GTek Technologies Ltd.) [Kernel | On_Demand | Running] – C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys – (DSproct)
DRV - [2005/09/08 03:20:00 | 000,094,332 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS – (DLAUDFAM)
DRV - [2005/09/08 03:20:00 | 000,087,036 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS – (DLAUDF_M)
DRV - [2005/09/08 03:20:00 | 000,086,524 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS – (DLAIFS_M)
DRV - [2005/09/08 03:20:00 | 000,025,628 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLABOIOM.SYS – (DLABOIOM)
DRV - [2005/09/08 03:20:00 | 000,014,684 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS – (DLAOPIOM)
DRV - [2005/09/08 03:20:00 | 000,006,364 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAPoolM.SYS – (DLAPoolM)
DRV - [2005/09/08 03:20:00 | 000,002,496 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLADResN.SYS – (DLADResN)
DRV - [2005/08/25 10:16:52 | 000,005,628 | —- | M] (Sonic Solutions) [File_System | System | Running] – C:\WINDOWS\system32\drivers\DLACDBHM.SYS – (DLACDBHM)
DRV - [2005/08/25 10:16:16 | 000,022,684 | —- | M] (Sonic Solutions) [File_System | System | Running] – C:\WINDOWS\system32\drivers\DLARTL_N.SYS – (DLARTL_N)
DRV - [2004/08/03 21:31:20 | 000,036,224 | —- | M] (ADMtek Incorporated.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\an983.sys – (AN983)
DRV - [2004/08/03 21:29:28 | 000,327,040 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtaa.sys – (ati2mtaa)
DRV - [2003/03/14 12:18:30 | 000,004,228 | —- | M] (PowerQuest Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\PQNTDRV.sys – (PQNTDrv)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5070418
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5070418

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5070418
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 85 BC 9E 11 05 E6 28 4F BF 91 5E D8 44 36 C2 C0 [binary data]
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5070418
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 85 BC 9E 11 05 E6 28 4F BF 91 5E D8 44 36 C2 C0 [binary data]
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 85 BC 9E 11 05 E6 28 4F BF 91 5E D8 44 36 C2 C0 [binary data]

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 85 BC 9E 11 05 E6 28 4F BF 91 5E D8 44 36 C2 C0 [binary data]

IE - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 85 BC 9E 11 05 E6 28 4F BF 91 5E D8 44 36 C2 C0 [binary data]
IE - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;*.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\[removed]/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll File not found
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.1: C:\Documents and Settings\Bill Entwistle\Application Data\Facebook\npfbplugin_1_0_1.dll ( )
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\Bill Entwistle\Application Data\Facebook\npfbplugin_1_0_3.dll ( )
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Bill Entwistle\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Bill Entwistle\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2011/11/21 13:41:19 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/11/23 17:22:58 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files\Thunderbird\components [2011/11/23 17:22:58 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: C:\Program Files\Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\AVG\AVG2012\Thunderbird\ [2011/11/20 14:56:45 | 000,000,000 | —D | M]

[2011/04/22 07:49:14 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Bill Entwistle\Application Data\Mozilla\Extensions
[2011/04/22 07:49:14 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Bill Entwistle\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/11/23 01:59:09 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/11/23 01:58:48 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}
[2011/11/21 13:41:19 | 000,000,000 | —D | M] (AVG Safe Search) – C:\PROGRAM FILES\AVG\AVG2012\FIREFOX4
[2011/11/09 10:02:17 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/10/02 23:52:57 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/09 10:02:18 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2011/11/23 01:05:44 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll File not found
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [MaxMenuMgr] C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe (Seagate LLC)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005..\Run: [DellSupport] C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
O4 - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005..\Run: [MusicManager] C:\Documents and Settings\Bill Entwistle\Local Settings\Application Data\Programs\Google\MusicManager\MusicManager.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Uninstall LastPass RunOnce.lnk = C:\Documents and Settings\Administrator\Application Data\lpuninstall.exe (LastPass)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe ()
O4 - Startup: C:\Documents and Settings\Bill Entwistle\Start Menu\Programs\Startup\CapsUnlock.lnk = C:\Program Files\CapsUnlock\CapsUnlock.exe (BrainSystems)
O4 - Startup: C:\Documents and Settings\Bill Entwistle\Start Menu\Programs\Startup\FlashTray.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\..Trusted Domains: netflix.com ([www] http in Trusted sites)
O15 - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\..Trusted Domains: netflix.com ([www] https in Trusted sites)
O15 - HKU\S-1-5-21-3238264531-3539326320-3744746308-1005\..Trusted Domains: pandora.com ([]* in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} http://catalog.update.microsoft.com/v7/sit…b?1307775913765 (MUCatalogWebControl Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1177138576847 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1177467272937 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} Reg Error: Value error. (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} Reg Error: Value error. (McFreeScan Class)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{579E98ED-CD52-4E61-B524-E6FBBB03B165}: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Cat in basket.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Cat in basket.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\Program Files\Eudora\EuShlExt.dll (Qualcomm Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/11 15:15:00 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2004/02/25 23:03:54 | 000,000,194 | —- | M] () - G:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/11/23 23:51:20 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Bill Entwistle\Desktop\OTL.exe
[2011/11/23 23:19:53 | 000,607,260 | R— | C] (Swearware) – C:\Documents and Settings\Bill Entwistle\Desktop\dds.scr
[2011/11/23 18:58:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill Entwistle\Local Settings\Application Data\Logishrd
[2011/11/23 18:57:55 | 000,000,000 | —D | C] – C:\Program Files\Logitech
[2011/11/23 17:42:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/11/23 17:38:26 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Apple Computer
[2011/11/23 17:25:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2011/11/23 17:22:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\QuickTime
[2011/11/23 12:18:17 | 000,000,000 | —D | C] – C:\Program Files\FileHippo.com
[2011/11/23 11:57:33 | 000,000,000 | –SD | C] – C:\ComboFix
[2011/11/23 02:01:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill Entwistle\Local Settings\Application Data\Sun
[2011/11/23 01:59:18 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2011/11/23 01:49:01 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Bill Entwistle\PrivacIE
[2011/11/23 01:47:54 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/11/23 01:42:40 | 000,000,000 | —D | C] – C:\WINDOWS\ie8updates
[2011/11/23 01:40:33 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2011/11/22 13:06:36 | 000,000,000 | —D | C] – C:\ad50495e293c0ecf77207ce935a5
[2011/11/21 02:20:05 | 000,000,000 | —D | C] – C:\Program Files\Windows Defender
[2011/11/20 16:32:17 | 000,000,000 | —D | C] – C:\Program Files\Safari
[2011/11/20 15:22:56 | 000,000,000 | —D | C] – C:\$AVG
[2011/11/20 14:59:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill Entwistle\Application Data\AVG2012
[2011/11/20 14:57:56 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/11/20 14:57:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\AVG 2012
[2011/11/20 14:56:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG2012
[2011/11/20 14:56:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\AVG
[2011/11/20 14:55:04 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2011/11/20 14:50:28 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/11/20 14:39:55 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/11/20 14:34:40 | 000,000,000 | —D | C] – C:\Program Files\Apple Software Update
[2011/11/20 13:31:59 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/11/20 13:31:58 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/11/20 13:05:40 | 000,000,000 | —D | C] – C:\Program Files\6A1DD
[2011/11/20 13:04:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill Entwistle\Start Menu\Programs\AV Protection 2011
[2011/11/20 12:45:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill Entwistle\Start Menu\Programs\JBidwatcher
[2011/11/20 12:45:24 | 000,000,000 | —D | C] – C:\Program Files\CyberFOX Software
[2011/11/12 00:59:04 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Bill Entwistle\Recent

========== Files - Modified Within 30 Days ==========

[2011/11/23 23:51:07 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Bill Entwistle\Desktop\OTL.exe
[2011/11/23 23:49:16 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/11/23 23:34:20 | 000,002,148 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/11/23 23:34:16 | 000,000,260 | —- | M] () – C:\WINDOWS\tasks\WGASetup.job
[2011/11/23 23:34:07 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/11/23 23:34:05 | 1063,165,952 | -HS- | M] () – C:\hiberfil.sys
[2011/11/23 23:19:44 | 000,607,260 | R— | M] (Swearware) – C:\Documents and Settings\Bill Entwistle\Desktop\dds.scr
[2011/11/23 22:56:00 | 000,000,962 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3238264531-3539326320-3744746308-1005Core1cc945bae023cbe.job
[2011/11/23 19:12:16 | 000,000,600 | —- | M] () – C:\Documents and Settings\Bill Entwistle\PUTTY.RND
[2011/11/23 19:08:31 | 000,000,600 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Application Data\winscp.rnd
[2011/11/23 19:08:18 | 000,001,512 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\WinSCP.lnk
[2011/11/23 19:05:53 | 000,001,784 | —- | M] () – C:\Documents and Settings\Bill Entwistle\My Documents\Default.rdp
[2011/11/23 17:48:12 | 000,027,333 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/11/23 17:25:05 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/11/23 12:18:17 | 000,001,632 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\Update Checker.lnk
[2011/11/23 12:16:48 | 000,000,088 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\Infection Posting.URL
[2011/11/23 08:06:45 | 110,567,732 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/11/23 04:19:08 | 000,000,246 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\Security Center.lnk
[2011/11/23 01:46:33 | 000,000,815 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/11/23 01:44:02 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/11/23 01:05:44 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/11/23 00:26:01 | 000,002,187 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/11/23 00:04:54 | 000,000,168 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\#134 November 23, 2011 at 1204 am.URL
[2011/11/21 23:29:12 | 000,000,182 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\#37 November 21, 2011 at 1128 pm.URL
[2011/11/21 13:41:19 | 000,000,702 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2012.lnk
[2011/11/21 02:42:25 | 000,008,500 | —- | M] () – C:\WINDOWS\lviewpro.ini
[2011/11/21 02:42:21 | 000,096,627 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\cat.jpg
[2011/11/20 16:32:25 | 000,001,854 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/11/20 16:28:15 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/11/20 14:34:43 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/11/20 12:45:25 | 000,001,843 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\JBidwatcher 2.1.lnk
[2011/11/19 18:04:03 | 000,003,782 | —- | M] () – C:\WINDOWS\SDTAR861.BMP
[2011/11/19 18:04:03 | 000,003,782 | —- | M] () – C:\WINDOWS\SDTAR860.BMP
[2011/11/19 18:04:03 | 000,002,678 | —- | M] () – C:\WINDOWS\SDTAR863.BMP
[2011/11/19 18:04:03 | 000,001,334 | —- | M] () – C:\WINDOWS\SDTAR862.BMP
[2011/11/16 22:41:45 | 000,000,094 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\Course Accessible Web Forms.URL
[2011/11/14 01:21:45 | 000,000,105 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\USA.gov.URL
[2011/11/14 00:28:47 | 000,000,090 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\Subscribe Newsletters.URL
[2011/11/14 00:25:54 | 000,000,091 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\MLive.com's Newsletters.URL
[2011/11/14 00:24:33 | 000,000,059 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\Subscribe to Newsletters ClickZ.URL
[2011/11/14 00:22:37 | 000,000,059 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\iVillage - Newsletter Subscribe.URL
[2011/11/14 00:14:46 | 000,000,061 | —- | M] () – C:\Documents and Settings\Bill Entwistle\Desktop\Subscription Manager for OASIS Public Mailing Lists.URL
[2011/11/12 00:46:17 | 000,442,894 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/11/12 00:46:17 | 000,072,160 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/11/10 22:09:52 | 000,000,996 | —- | M] () – C:\WINDOWS\ULEAD32.INI
[2011/11/05 01:32:40 | 000,001,334 | —- | M] () – C:\WINDOWS\SDTAU8G0.BMP

========== Files Created - No Company Name ==========

[2011/11/23 17:48:12 | 000,027,333 | —- | C] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/11/23 12:22:54 | 000,000,330 | -H– | C] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/11/23 12:18:17 | 000,001,632 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Desktop\Update Checker.lnk
[2011/11/23 08:06:45 | 110,567,732 | —- | C] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/11/23 04:19:08 | 000,000,246 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Desktop\Security Center.lnk
[2011/11/23 00:04:54 | 000,000,168 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Desktop\#134 November 23, 2011 at 1204 am.URL
[2011/11/21 23:29:12 | 000,000,182 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Desktop\#37 November 21, 2011 at 1128 pm.URL
[2011/11/21 15:48:41 | 000,000,088 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Desktop\Infection Posting.URL
[2011/11/21 02:42:21 | 000,096,627 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Desktop\cat.jpg
[2011/11/21 02:20:08 | 000,000,955 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Defender.lnk
[2011/11/20 19:03:27 | 000,001,393 | —- | C] () – C:\WINDOWS\imsins.BAK
[2011/11/20 16:32:25 | 000,002,187 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/11/20 16:32:25 | 000,001,854 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Safari.lnk
[2011/11/20 16:32:25 | 000,001,854 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/11/20 14:57:39 | 000,000,702 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AVG 2012.lnk
[2011/11/20 12:45:25 | 000,001,843 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Desktop\JBidwatcher 2.1.lnk
[2011/11/16 22:41:45 | 000,000,094 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Desktop\Course Accessible Web Forms.URL
[2011/11/14 01:21:45 | 000,000,105 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Desktop\USA.gov.URL
[2011/11/14 00:28:47 | 000,000,090 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Desktop\Subscribe Newsletters.URL
[2011/11/14 00:25:54 | 000,000,091 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Desktop\MLive.com's Newsletters.URL
[2011/11/14 00:24:33 | 000,000,059 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Desktop\Subscribe to Newsletters ClickZ.URL
[2011/11/14 00:22:37 | 000,000,059 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Desktop\iVillage - Newsletter Subscribe.URL
[2011/11/14 00:14:46 | 000,000,061 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Desktop\Subscription Manager for OASIS Public Mailing Lists.URL
[2011/10/26 21:51:16 | 000,000,962 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3238264531-3539326320-3744746308-1005Core1cc945bae023cbe.job
[2011/10/04 22:05:19 | 000,000,057 | —- | C] () – C:\WINDOWS\TaxACT11.ini
[2011/02/27 19:39:18 | 000,000,600 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Application Data\winscp.rnd
[2010/11/12 22:39:12 | 000,000,075 | —- | C] () – C:\WINDOWS\TaxACT10.ini
[2010/10/31 00:21:50 | 000,000,088 | RHS- | C] () – C:\WINDOWS\System32\95F0FF3853.sys
[2010/02/09 20:19:01 | 000,027,920 | —- | C] () – C:\WINDOWS\System32\mlfcache.dat
[2010/01/01 21:35:34 | 000,000,022 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Local Settings\Application Data\kodakpcd.ini
[2009/12/28 01:18:01 | 000,000,088 | RHS- | C] () – C:\WINDOWS\System32\D8C9CF0C39.sys
[2009/10/01 15:35:58 | 000,000,075 | —- | C] () – C:\WINDOWS\TaxACT09.ini
[2009/08/08 00:52:03 | 000,005,632 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/05/12 08:19:31 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2008/12/04 22:12:20 | 000,000,075 | —- | C] () – C:\WINDOWS\TaxACT08.ini
[2008/11/25 20:01:34 | 000,000,000 | —- | C] () – C:\WINDOWS\VPC32.INI
[2008/01/14 01:02:51 | 000,044,491 | —- | C] () – C:\WINDOWS\System32\MiiIniFile13.ini
[2008/01/14 01:02:48 | 000,285,216 | —- | C] () – C:\WINDOWS\System32\drivers\Onsio.sys
[2008/01/14 01:02:48 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\drivers\Onsreged.sys
[2008/01/08 13:17:50 | 000,001,183 | —- | C] () – C:\WINDOWS\mozver.dat
[2007/10/18 21:56:34 | 000,001,377 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/10/03 21:43:36 | 000,000,088 | —- | C] () – C:\WINDOWS\TaxACT07.ini
[2007/08/23 19:30:00 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2007/08/02 01:00:03 | 000,093,696 | —- | C] () – C:\WINDOWS\System32\hpgt42.dll
[2007/05/16 00:02:15 | 000,000,225 | —- | C] () – C:\WINDOWS\acdsee.ini
[2007/05/15 23:48:11 | 000,000,141 | —- | C] () – C:\WINDOWS\TaxACT06.ini
[2007/05/15 23:45:43 | 000,000,128 | —- | C] () – C:\WINDOWS\TaxACT05.ini
[2007/05/15 23:35:57 | 000,000,128 | —- | C] () – C:\WINDOWS\TaxACT04.ini
[2007/05/15 22:44:02 | 000,000,128 | —- | C] () – C:\WINDOWS\TaxACT03.ini
[2007/05/15 22:39:23 | 000,000,103 | —- | C] () – C:\WINDOWS\TaxACT02.ini
[2007/05/15 22:25:12 | 000,000,090 | —- | C] () – C:\WINDOWS\TAXACT01.INI
[2007/05/15 22:17:50 | 000,000,091 | —- | C] () – C:\WINDOWS\TaxAct00.ini
[2007/05/15 22:13:34 | 000,000,078 | —- | C] () – C:\WINDOWS\TaxAct99.ini
[2007/05/10 21:21:40 | 000,006,550 | —- | C] () – C:\WINDOWS\jautoexp.dat
[2007/05/09 00:33:39 | 000,000,087 | —- | C] () – C:\WINDOWS\OPHCW.INI
[2007/05/07 00:28:48 | 000,000,088 | RHS- | C] () – C:\WINDOWS\System32\3EEC6A8C6D.sys
[2007/04/28 20:26:12 | 000,000,042 | —- | C] () – C:\WINDOWS\entpack.ini
[2007/04/27 00:02:06 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2007/04/26 23:52:58 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/04/26 19:40:28 | 000,000,996 | —- | C] () – C:\WINDOWS\ULEAD32.INI
[2007/04/26 19:18:20 | 000,008,500 | —- | C] () – C:\WINDOWS\lviewpro.ini
[2007/04/23 22:52:15 | 000,005,330 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2007/04/23 22:52:15 | 000,000,088 | RHS- | C] () – C:\WINDOWS\System32\736179D2E2.sys
[2007/04/21 11:45:43 | 000,005,120 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Application Data\dvd.bmk
[2007/04/21 11:39:12 | 000,000,137 | —- | C] () – C:\Documents and Settings\Bill Entwistle\Local Settings\Application Data\fusioncache.dat
[2007/04/17 23:10:53 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2007/04/17 23:06:50 | 000,000,259 | —- | C] () – C:\WINDOWS\wininit.ini
[2007/04/17 22:41:38 | 000,049,152 | —- | C] () – C:\WINDOWS\setpwrcg.exe
[2007/04/17 22:41:31 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4642.dll
[2007/04/17 22:40:06 | 000,000,392 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2007/03/14 19:29:32 | 003,107,788 | —- | C] () – C:\WINDOWS\System32\ativvaxx.dat
[2007/03/06 16:04:53 | 000,143,676 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2005/11/09 23:56:34 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/11 15:24:19 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/11 15:19:30 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/08/11 15:12:14 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/11 15:07:24 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/11 15:06:43 | 000,158,752 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/11 15:00:30 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/11 15:00:29 | 001,287,168 | —- | C] () – C:\WINDOWS\System32\quartz(2).dll
[2004/08/11 15:00:28 | 000,442,894 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/11 15:00:28 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/11 15:00:28 | 000,072,160 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/11 15:00:28 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/11 15:00:27 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/11 15:00:26 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/11 15:00:24 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/11 15:00:19 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/11 15:00:19 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/11 15:00:12 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/11 15:00:04 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2001/09/11 15:06:50 | 000,001,787 | —- | C] () – C:\WINDOWS\SDDM.INI
[1999/01/22 12:46:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/03/09 23:00:00 | 000,042,496 | —- | C] () – C:\WINDOWS\ttuninst.exe
[1996/07/30 23:00:00 | 000,041,472 | —- | C] () – C:\WINDOWS\System32\WOSAXRT.DLL
[1996/07/30 23:00:00 | 000,006,656 | —- | C] () – C:\WINDOWS\System32\MSNWEBQT.DLL

========== LOP Check ==========

[2008/11/25 21:32:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Admin\Application Data\Leadertech
[2011/11/20 15:12:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG2012
[2010/06/29 00:01:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2010/07/11 21:00:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CanonIJPLM
[2009/03/29 15:27:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Citrix
[2011/11/20 14:57:56 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/11/23 17:49:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2008/01/18 21:49:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RapidSolution
[2011/04/03 18:35:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RoboForm
[2008/12/03 20:00:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Seagate
[2011/11/23 17:42:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/02/08 22:39:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2008/03/15 17:02:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill Entwistle\Application Data\Amazon
[2011/11/20 14:59:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill Entwistle\Application Data\AVG2012
[2009/12/02 01:33:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill Entwistle\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/05/06 02:18:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill Entwistle\Application Data\Facebook
[2011/04/03 20:52:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill Entwistle\Application Data\KeePass
[2007/08/26 22:04:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill Entwistle\Application Data\lalacollection
[2007/08/25 20:40:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill Entwistle\Application Data\lalaplayer
[2007/04/24 23:23:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill Entwistle\Application Data\Leadertech
[2008/01/18 20:59:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill Entwistle\Application Data\NoteCable
[2008/01/18 21:53:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill Entwistle\Application Data\RTPlayer
[2010/01/01 20:22:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill Entwistle\Application Data\Skinux
[2011/11/12 01:22:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill Entwistle\Application Data\Spotify
[2011/04/22 07:49:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill Entwistle\Application Data\Thunderbird
[2008/01/18 22:23:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill Entwistle\Application Data\Tunebite
[2009/03/08 10:59:56 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\SACore
[2011/11/23 23:49:16 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2011/11/23 23:34:16 | 000,000,260 | —- | M] () – C:\WINDOWS\Tasks\WGASetup.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2008/04/13 18:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/13 18:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/13 18:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007/06/13 05:26:03 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 – C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 04:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/04/13 18:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ERDNT\cache\svchost.exe
[2008/04/13 18:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 18:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\svchost.exe
[2004/08/04 03:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 – C:\i386\svchost.exe
[2004/08/04 03:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 – C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: USERINIT.EXE >
[2004/08/04 03:00:00 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF – C:\i386\userinit.exe
[2004/08/04 03:00:00 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF – C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 18:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/13 18:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 18:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004/08/04 03:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\i386\winlogon.exe
[2004/08/04 03:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/13 18:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/13 18:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 18:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

< End of report >

———-

OTL Extras logfile created on: 11/23/2011 11:52:34 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Bill Entwistle\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1013.84 Mb Total Physical Memory | 552.68 Mb Available Physical Memory | 54.51% Memory free
2.38 Gb Paging File | 1.89 Gb Available in Paging File | 79.22% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 68.36 Gb Total Space | 25.61 Gb Free Space | 37.47% Space Free | Partition Type: NTFS
Drive F: | 68.36 Gb Total Space | 16.86 Gb Free Space | 24.67% Space Free | Partition Type: NTFS
Drive G: | 2.93 Gb Total Space | 1.18 Gb Free Space | 40.09% Space Free | Partition Type: NTFS
Drive H: | 6.31 Gb Total Space | 5.16 Gb Free Space | 81.81% Space Free | Partition Type: NTFS

Computer Name: TUCKER | User Name: Bill Entwistle | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_USERS\S-1-5-21-3238264531-3539326320-3744746308-1005\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\msacm32.exe" = C:\WINDOWS\system32\msacm32.exe:*:Enabled:Windows Update Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"G:\WS FTP\WS_FTP95.exe" = G:\WS FTP\WS_FTP95.exe:*:Enabled:WS_FTP 95 – (Ipswitch, Inc. 81 Hartwell Ave. Lexington, MA 02173)
"C:\Program Files\TeraTerm\ttermpro.exe" = C:\Program Files\TeraTerm\ttermpro.exe:*:Enabled:Tera Term – (TeraTerm Project T. Teranishi)
"C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe" = C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe:*:Enabled:AppleMobileDeviceService
"C:\Program Files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe" = C:\Program Files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe:*:Enabled:StxMenuMgr – (Seagate LLC)
"C:\Program Files\Dell Support\DSAgnt.exe" = C:\Program Files\Dell Support\DSAgnt.exe:*:Enabled:DSAgnt – (Gteko Ltd.)
"C:\Program Files\Spotify\spotify.exe" = C:\Program Files\Spotify\spotify.exe:*:Enabled:Spotify – (Spotify Ltd)
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit – (Apple Inc.)
"C:\Program Files\AVG\AVG2012\avgmfapx.exe" = C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:AVG Installer – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2012\avgnsx.exe" = C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Online Shield – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2012\avgdiagex.exe" = C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostics 2012 – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2012\avgemcx.exe" = C:\Program Files\AVG\AVG2012\avgemcx.exe:*:Enabled:Personal E-mail Scanner – (AVG Technologies CZ, s.r.o.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00010409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Professional
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{007B37D9-0C45-4202-834B-DD5FAAE99D63}" = ArcSoft Print Creations - Slimline Card
"{0673654C-5296-453B-9798-B61CD7E03FEB}" = SES Driver
"{075473F5-846A-448B-BCB3-104AA1760205}" = Roxio RecordNow Data
"{0A0873E1-D9BA-4994-B85D-A0A331EF1F0C}" = Intel® PRO Network Connections
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP1800_series" = Canon iP1800 series
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Roxio DLA
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Roxio MyDVD LE
"{238B8820-011B-11D6-9C28-0080C85A0C2D}" = Microtek LightLid 35 Calibrator
"{26A24AE4-039D-4CA4-87B4-2F83217001FF}" = Java™ 7 Update 1
"{2A30052B-831C-41D3-8044-3C0388066350}" = Seagate Manager Installer
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{41F4B3D2-3CC8-41B5-99B8-3A9C1BCDEA0A}" = AVG 2012
"{43CAC9A1-1993-4F65-9096-7C9AFC2BBF54}" = Dell CinePlayer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56589DFE-0C29-4DFE-8E42-887B771ECD23}" = ArcSoft Print Creations - Photo Book
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5B6BE547-21E2-49CA-B2E2-6A5F470593B1}" = Sonic Activation Module
"{5E453519-60F6-4A4D-A0BF-16663F9B3536}" = Safari
"{621FCD24-4498-4324-A81E-07D331376EDF}" = PixiePack Codec Pack
"{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PartitionMagic
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{80F28669-97B7-4CC9-B256-1F1BCFB7FDCF}" = AVG 2012
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{902C002A-60F8-45BD-9EFF-4DE38C99C51B}" = Eudora
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{9591C049-5CAE-4E89-A8D9-191F1899628B}" = ArcSoft Print Creations - Funhouse
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Roxio RecordNow Audio
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{B08D262E-D902-11D5-9C28-0080C85A0C2D}" = ScanWizard 5
"{B0D83FCD-9D42-43ED-8315-250326AADA02}" = ArcSoft Print Creations - Scrapbook
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Roxio RecordNow Copy
"{B702CCCE-3176-4DBF-B932-D1B8F402F330}" = Digital Content Portal
"{BCE72AED-3332-4863-9567-C5DCB9052CA2}" = Netflix Movie Viewer
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CA9ED5E4-1548-485B-A293-417840060158}" = ArcSoft Print Creations - Photo Calendar
"{CAE8A0F1-B498-4C23-95FA-55047E730C8F}" = ArcSoft Print Creations
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEE2252C-4035-4B27-8EC6-0B085DD3A413}" = Dell Support 3.2.1
"{E6B4117F-AC59-4B13-9274-EB136E8897EE}" = ArcSoft Print Creations - Album Page
"{F04F9557-81A9-4293-BC49-2C216FA325A7}" = ArcSoft Print Creations - Greeting Card
"{F51251E6-FF62-48D0-9F87-149F48CDE46C}" = OKI C5100 Digitally Signed Driver
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AVG" = AVG 2012
"CANONIJPLM100" = PIXMA Extended Survey Program
"CanonMyPrinter" = Canon My Printer
"CCleaner" = CCleaner
"ColorMania_is1" = ColorMania 2.4
"DVD Identifier_is1" = DVD Identifier
"Easy-LayoutPrint" = Canon Utilities Easy-LayoutPrint
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"FileHippo.com" = FileHippo.com Update Checker
"HDMI" = Intel® Graphics Media Accelerator Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{2A30052B-831C-41D3-8044-3C0388066350}" = Seagate Manager Installer
"InstallShield_{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PowerQuest PartitionMagic 8.0
"JBidwatcher_0" = JBidwatcher 2.1.6
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 8.0 (x86 en-US)" = Mozilla Firefox 8.0 (x86 en-US)
"Mozilla Thunderbird (8.0)" = Mozilla Thunderbird (8.0)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSMONEYV50" = Microsoft Money 5.0
"Multimedia Xplorer 2" = Multimedia Xplorer 2
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"SBC.MCCInstall" = SBC Self Support Tool
"SearchAssist" = SearchAssist
"sp6" = Logitech SetPoint 6.32
"Spotify" = Spotify
"TaxACT 2000" = TaxACT 2000
"TaxACT 2001" = TaxACT 2001
"TaxACT 2002" = TaxACT 2002
"TaxACT 2003" = TaxACT 2003
"TaxACT 2004" = TaxACT 2004
"TaxACT 2005" = TaxACT 2005
"TaxACT 2006" = TaxACT 2006
"TaxACT 2007" = TaxACT 2007
"TaxACT 2008" = TaxACT 2008
"TaxACT 2008 Illinois" = TaxACT 2008 Illinois
"TaxACT 2009 Illinois" = TaxACT 2009 Illinois
"TaxACT 2010 Illinois" = TaxACT 2010 Illinois
"TaxACT 2011 - 1040 Edition" = TaxACT 2011 - 1040 Edition
"TaxACT Illinois 2003" = TaxACT Illinois 2003
"TaxACT Illinois 2004" = TaxACT Illinois 2004
"TaxACT Illinois 2005" = TaxACT Illinois 2005
"TaxACT Illinois 2006" = TaxACT Illinois 2006
"TaxACT Illinois 2007" = TaxACT Illinois 2007
"Tera Term Pro" = Tera Term Pro
"Tera Term_is1" = Tera Term 4.62
"TextPad 4" = TextPad 4
"Ulead iPhoto Express 1.1" = Ulead iPhoto Express 1.1
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"winscp3_is1" = WinSCP 4.3.5
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3238264531-3539326320-3744746308-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
"GoToMeeting" = GoToMeeting 5.0.0.799
"MusicManager" = Music Manager

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/22/2011 2:50:16 PM | Computer Name = TUCKER | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 36830407

Error - 11/22/2011 2:50:16 PM | Computer Name = TUCKER | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 36830407

Error - 11/22/2011 2:50:18 PM | Computer Name = TUCKER | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/22/2011 2:50:18 PM | Computer Name = TUCKER | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 36833125

Error - 11/22/2011 2:50:18 PM | Computer Name = TUCKER | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 36833125

Error - 11/22/2011 2:50:21 PM | Computer Name = TUCKER | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/22/2011 2:50:21 PM | Computer Name = TUCKER | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 36835172

Error - 11/22/2011 2:50:21 PM | Computer Name = TUCKER | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 36835172

Error - 11/22/2011 2:57:05 PM | Computer Name = TUCKER | Source = Application Hang | ID = 1002
Description = Hanging application mbam.exe, version 1.51.0.1118, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 11/23/2011 8:59:39 PM | Computer Name = TUCKER | Source = Automatic LiveUpdate Scheduler | ID = 101
Description =

[ System Events ]
Error - 11/23/2011 6:16:18 AM | Computer Name = TUCKER | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 11/23/2011 1:53:01 PM | Computer Name = TUCKER | Source = Service Control Manager | ID = 7000
Description = The Kodak Camera Connection Software service failed to start due to
the following error: %%2

Error - 11/23/2011 1:53:01 PM | Computer Name = TUCKER | Source = Service Control Manager | ID = 7000
Description = The mcmscsvc service failed to start due to the following error: %%3

Error - 11/23/2011 1:53:01 PM | Computer Name = TUCKER | Source = Service Control Manager | ID = 7000
Description = The McNASvc service failed to start due to the following error: %%3

Error - 11/23/2011 1:53:35 PM | Computer Name = TUCKER | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 11/23/2011 1:53:47 PM | Computer Name = TUCKER | Source = Service Control Manager | ID = 7034
Description = The iPod Service service terminated unexpectedly. It has done this
1 time(s).

Error - 11/24/2011 1:34:17 AM | Computer Name = TUCKER | Source = Service Control Manager | ID = 7000
Description = The Kodak Camera Connection Software service failed to start due to
the following error: %%2

Error - 11/24/2011 1:34:17 AM | Computer Name = TUCKER | Source = Service Control Manager | ID = 7000
Description = The mcmscsvc service failed to start due to the following error: %%3

Error - 11/24/2011 1:34:17 AM | Computer Name = TUCKER | Source = Service Control Manager | ID = 7000
Description = The McNASvc service failed to start due to the following error: %%3

Error - 11/24/2011 1:34:24 AM | Computer Name = TUCKER | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Cdrom Imapi redbook

< End of report >

NoodleTech

Post #22November 24, 2011, 6:17 AM UTC

Hi ent,

Sorry for the hassle. This should take care of it.

Run OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL

:Reg

:Services
LW

:Files
c:\docume~1\billen~1\locals~1\temp\LW.exe
C:\WINDOWS\System32\95F0FF3853.sys

:Commands
[createrestorepoint]
[purity]
[emptytemp]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

ent

Post #23November 24, 2011, 6:33 AM UTC

No problem. Here are the results. Should I be concerned about the Paypal password that I entered possibly being trapped when I sent the donation? ———- All processes killed ========== OTL ========== ========== REGISTRY ========== ========== SERVICES/DRIVERS ========== Service LW stopped successfully! Service LW deleted successfully! ========== FILES ========== File\Folder c:\docume~1\billen~1\locals~1\temp\LW.exe not found. C:\WINDOWS\System32\95F0FF3853.sys moved successfully. ========== COMMANDS ========== Restore point Set: OTL Restore Point (0) [EMPTYTEMP] User: Admin ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Bill Entwistle ->Temp folder emptied: 23240998 bytes ->Temporary Internet Files folder emptied: 3904043 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 61618152 bytes ->Apple Safari cache emptied: 0 bytes ->Flash cache emptied: 1694 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 1792 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 2223 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 169271103 bytes Total Files Cleaned = 246.00 mb OTL by OldTimer - Version 3.2.31.0 log created on 11242011_002349 Files\Folders moved on Reboot… Registry entries deleted on Reboot…

NoodleTech

Post #24November 24, 2011, 6:36 AM UTC last edited November 24, 2011, 6:38 AM UTC

Hi ent,

No you shouldn't be worried. ComboFix took care of the main infection. I removed a service that was no longer in use and was missing its corresponding file anyway.

Please delete DDS from the desktop and follow these steps to remove OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

Remember to reenable AVG Antivirus.

Do you have any other questions?

ent

Post #25November 24, 2011, 6:55 AM UTC

Well, I've been wondering for a long time why I can't get Windows Defender to start automatically on boot (XP) – might it be because AVG shuts it down? If I start it manually and close it, it stays resident and doesn't seem to interfere with AVG. If you happen to know the answer, that's great. But otherwise, please don't waste any time on it. I can probably figure it out myself. Thanks for your help. I hope you have a pleasant Thanksgiving!

NoodleTech

Post #26November 24, 2011, 6:58 AM UTC

Hi Ent,

Windows Defender is obsolete and has been replaced by Microsoft Security Essentials. MSE is a great antivirus/antispyware software that is free and doesn't take up much resources. I would consider removing Windows Defender and AVG and replacing them both with just MSE. You can download MSE here.

I hope you have a great Thanksgiving as well!

NoodleTech

Post #27November 24, 2011, 6:40 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Ping.exe / NetBT.sys Infection

✨ Ask AI

Ask AI