Hi there!
You are awesome!
Ok, I did as you said, and the logfiles are posted below:
OTL Notepad first:
OTL logfile created on: 12/10/2011 10:05:53 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.49 Gb Total Physical Memory | 2.63 Gb Available Physical Memory | 75.23% Memory free
4.82 Gb Paging File | 4.29 Gb Available in Paging File | 89.05% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 372.61 Gb Total Space | 333.59 Gb Free Space | 89.53% Space Free | Partition Type: NTFS
Computer Name: OWNER-84FDF6F64 | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - File not found
PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\2X\Client\TUXCredProv.exe (2X Software Ltd.)
PRC - C:\Program Files\2X\Client\APPServerClient.exe (2X Software Ltd.)
PRC - C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
PRC - C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)
PRC - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
PRC - C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe ()
PRC - C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\ATT-SST\McciTrayApp.exe (Motive Communications, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\AT&T\Internet Security Wizard\ISW.exe (AT&T)
PRC - C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe (Lexmark International, Inc.)
PRC - C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe (Lexmark International, Inc.)
========== Modules (No Company Name) ==========
MOD - C:\Program Files\PC Tools\PC Tools Security\BDT\BSPatch.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe ()
MOD - C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe ()
MOD - C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll ()
MOD - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll ()
MOD - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
MOD - C:\Program Files\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\AmvTransform.dll ()
MOD - C:\WINDOWS\system32\spool\prtprocs\w32x86\LXBKPP5C.DLL ()
MOD - C:\Program Files\Lexmark X1100 Series\ConvDIB.dll ()
========== Win32 Services (SafeList) ==========
SRV - (mfevtp) – File not found
SRV - (mfefire) – File not found
SRV - (McShield) – File not found
SRV - (2X SSO Service) – C:\Program Files\2X\Client\\TUXCredProv.exe ()
SRV - (sdCoreService) – C:\Program Files\PC Tools\PC Tools Security\pctsSvc.exe (PC Tools)
SRV - (sdAuxService) – C:\Program Files\PC Tools\PC Tools Security\pctsAuxs.exe (PC Tools)
SRV - (ThreatFire) – C:\Program Files\PC Tools\PC Tools Security\TFEngine\TFService.exe (PC Tools)
SRV - (Browser Defender Update Service) – C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SRV - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SRV - (MotoHelper) – C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe ()
SRV - (UMVPFSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (0050001323483531mcinstcleanup) McAfee Application Installer Cleanup (0050001323483531) – C:\Documents and Settings\Owner\Local Settings\temp\0050001323483531mcinst.exe (McAfee, Inc.)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (NMSAccess) – C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
========== Driver Services (SafeList) ==========
DRV - (mfetdi2k) – File not found
DRV - (mfehidk) – File not found
DRV - (mfeavfk) – File not found
DRV - (pctplsg) – C:\WINDOWS\system32\drivers\pctplsg.sys (PC Tools)
DRV - (PCTSD) – C:\WINDOWS\system32\drivers\PCTSD.sys (PC Tools)
DRV - (pctBTFix) – C:\WINDOWS\System32\Drivers\pctBTFix.sys (PC Tools)
DRV - (pctgntdi) – C:\WINDOWS\system32\drivers\pctgntdi.sys (PC Tools)
DRV - (TFSysMon) – C:\WINDOWS\system32\drivers\TfSysMon.sys (PC Tools)
DRV - (TfNetMon) – C:\WINDOWS\system32\drivers\TfNetMon.sys (PC Tools)
DRV - (TfFsMon) – C:\WINDOWS\system32\drivers\TfFsMon.sys (PC Tools)
DRV - (PCTCore) – C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (Lavasoft Kernexplorer) – C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys ()
DRV - (pctEFA) – C:\WINDOWS\system32\drivers\pctEFA.sys (PC Tools)
DRV - (pctDS) – C:\WINDOWS\system32\drivers\pctDS.sys (PC Tools)
DRV - (PCTBD) – C:\WINDOWS\system32\drivers\PCTBD.sys (PC Tools)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (LVUVC) Logitech HD Webcam C270(UVC) – C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (LVPr2Mon) – C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()
DRV - (StarOpen) – C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (MREMP50) – C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) – C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (sfvfs02) StarForce Protection VFS Driver (version 2.x) – C:\WINDOWS\System32\drivers\sfvfs02.sys (Protection Technology)
DRV - (sfsync02) StarForce Protection Synchronization Driver (version 2.x) – C:\WINDOWS\System32\drivers\sfsync02.sys (Protection Technology)
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) – C:\WINDOWS\System32\drivers\sfdrv01.sys (Protection Technology)
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) – C:\WINDOWS\System32\drivers\sfhlp02.sys (Protection Technology)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (senfilt) – C:\WINDOWS\system32\drivers\senfilt.sys (Creative Technology Ltd.)
DRV - (ATMhelpr) – C:\WINDOWS\System32\drivers\ATMHELPR.SYS (Adobe Systems Incorporated)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages =
http://news.yahoo.com/ [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL =
http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;192.168.*.*
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\Owner\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\Owner\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Documents and Settings\All Users\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2011/03/17 01:00:06 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\ [2011/12/03 03:05:21 | 000,000,000 | —D | M]
[2011/02/15 20:12:56 | 000,002,047 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
O1 HOSTS File: ([2011/12/08 23:29:16 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (PC Tools Browser Defender BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (Ad-Aware Security Toolbar) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files\adawaretb\adawareDx.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (PC Tools Browser Defender) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - No CLSID value found.
O3 - HKLM\..\Toolbar: (SoyDominicano.NET Toolbar) - {5bdea838-df85-40de-85c0-af50e1024f0d} - C:\Program Files\SoyDominicano.NET\prxtbSoy0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ad-Aware Security Toolbar) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files\adawaretb\adawareDx.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (SoyDominicano.NET Toolbar) - {5BDEA838-DF85-40DE-85C0-AF50E1024F0D} - C:\Program Files\SoyDominicano.NET\prxtbSoy0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Ad-Aware Browsing Protection] C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [ATT-SST_McciTrayApp] C:\Program Files\ATT-SST\McciTrayApp.exe (Motive Communications, Inc.)
O4 - HKLM..\Run: [ISW.exe] C:\Program Files\AT&T\Internet Security Wizard\ISW.exe (AT&T)
O4 - HKLM..\Run: [Lexmark X1100 Series] C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [Nikon Message Center 2] C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation)
O4 - HKCU..\Run: [Facebook Update] C:\Documents and Settings\Owner\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKLM..\RunOnce: [AvgUninstallURL] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\2X Client.lnk = C:\Program Files\2X\Client\APPServerClient.exe (2X Software Ltd.)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Save video on Savevid.com - C:\Program Files\Savevid\redirect.htm ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: 0.0.0.0 ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: motive.com ([patttbc.att] https in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
http://update.microsoft.com/windowsupdate/…b?1236398655031 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
http://update.microsoft.com/microsoftupdat…b?1237315749827 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5}
http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD}
http://www.superadblocker.com/activex/sabspx.cab (SABScanProcesses Class)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0B48736E-D654-47FB-8CBE-239F7B7E764E}: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (C:\Program Files\2X\Client\\TUXCredProv.dll) -C:\Program Files\2X\Client\\TUXCredProv.dll ()
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/01/23 12:00:22 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – Reg Error: Key error. File not found
NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2011/12/10 10:04:23 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/12/09 21:34:32 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/12/09 21:19:43 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2011/12/09 15:40:45 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Owner\Recent
[2011/12/09 15:40:38 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/12/08 23:28:10 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/12/08 22:52:29 | 004,331,207 | R— | C] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/12/08 22:27:08 | 001,577,776 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\tdsskiller.exe
[2011/12/08 00:24:58 | 004,331,784 | R— | C] (Swearware) – C:\ComboFix.exe
[2011/12/05 02:36:12 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HiJackThis.exe
[2011/12/04 20:16:38 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\GooredFix Backups
[2011/12/04 20:16:16 | 000,071,398 | —- | C] (jpshortstuff) – C:\Documents and Settings\Owner\Desktop\GooredFix.exe
[2011/12/04 20:14:41 | 000,050,688 | —- | C] (Atribune.org) – C:\Documents and Settings\Owner\Desktop\ATF_Cleaner.exe
[2011/12/04 19:57:12 | 000,204,496 | —- | C] (Malwarebytes) – C:\Documents and Settings\Owner\Desktop\StartUpLite.exe
[2011/12/04 19:39:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\2X
[2011/12/04 14:49:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\PCTools
[2011/12/04 08:13:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\My Extracted Files
[2011/12/04 08:06:36 | 000,000,000 | —D | C] – C:\Program Files\File Type Assistant
[2011/12/04 08:06:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\BitZipper
[2011/12/04 08:06:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\BitZipper
[2011/12/04 08:06:12 | 000,000,000 | —D | C] – C:\Program Files\BitZipper
[2011/12/04 00:18:05 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/12/03 17:03:51 | 000,574,424 | –S- | C] (PC Tools) – C:\WINDOWS\System32\drivers\TfSysMon.sys
[2011/12/03 17:03:51 | 000,054,328 | –S- | C] (PC Tools) – C:\WINDOWS\System32\drivers\TfFsMon.sys
[2011/12/03 17:03:51 | 000,035,264 | –S- | C] (PC Tools) – C:\WINDOWS\System32\drivers\TfNetMon.sys
[2011/12/03 16:57:03 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/12/03 16:57:01 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/12/03 16:48:57 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\adawaretb
[2011/12/03 03:05:16 | 000,056,840 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTBD.sys
[2011/12/03 03:05:14 | 002,246,608 | —- | C] (Threat Expert Ltd.) – C:\WINDOWS\PCTBDCore.dll
[2011/12/03 03:05:14 | 001,681,360 | —- | C] (Threat Expert Ltd.) – C:\WINDOWS\PCTBDRes.dll
[2011/12/03 03:05:14 | 000,149,456 | —- | C] (PC Tools) – C:\WINDOWS\SGDetectionTool.dll
[2011/12/03 03:02:12 | 000,253,096 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctgntdi.sys
[2011/12/03 03:01:48 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\PC Tools Security
[2011/12/03 03:01:47 | 000,017,848 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctBTFix.sys
[2011/12/03 03:01:16 | 000,070,536 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctplsg.sys
[2011/12/03 03:00:30 | 000,000,000 | —D | C] – C:\Program Files\PC Tools
[2011/12/03 01:30:18 | 000,660,992 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctEFA.sys
[2011/12/03 01:30:18 | 000,341,656 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctDS.sys
[2011/12/03 01:30:06 | 000,331,880 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTCore.sys
[2011/12/03 01:30:05 | 000,162,584 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTAppEvent.sys
[2011/12/03 01:29:58 | 000,185,560 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTSD.sys
[2011/12/03 01:29:58 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PC Tools
[2011/12/03 01:27:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PC Tools
[2011/12/03 01:27:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\TestApp
[2011/12/03 01:16:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip
[2011/12/03 01:16:47 | 000,000,000 | —D | C] – C:\Program Files\7-Zip
[2011/12/02 22:43:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/12/01 23:34:41 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\adaware
[2011/12/01 23:34:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection
[2011/12/01 23:34:27 | 000,000,000 | —D | C] – C:\Program Files\Toolbar Cleaner
[2011/12/01 23:33:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\adawaretb
[2011/12/01 23:33:31 | 000,000,000 | —D | C] – C:\Program Files\adawaretb
[2011/12/01 23:33:20 | 000,064,512 | —- | C] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2011/12/01 23:32:46 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2011/12/01 17:53:50 | 000,000,000 | —D | C] – C:\sh4ldr
[2011/12/01 17:53:50 | 000,000,000 | —D | C] – C:\Program Files\Enigma Software Group
[2011/12/01 17:53:10 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2011/11/24 22:53:26 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Motorola Shared
[2011/11/24 22:53:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Motorola
[2011/11/24 22:53:23 | 000,000,000 | —D | C] – C:\Program Files\Motorola
[2011/11/20 19:18:08 | 029,918,440 | —- | C] (IObit ) – C:\Documents and Settings\Owner\Desktop\asc-setup.exe
[2011/11/20 03:38:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Earth
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/12/10 10:04:32 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/12/10 10:02:01 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2011/12/10 10:01:34 | 000,002,515 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Word.lnk
[2011/12/10 09:32:01 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/10 09:05:03 | 000,000,998 | —- | M] () – C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1085031214-1682526488-1606980848-1003UA.job
[2011/12/10 05:02:13 | 000,000,422 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{2C5D2369-05C8-4720-B088-78D1B8DB9F44}.job
[2011/12/09 23:04:08 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/12/09 22:53:05 | 000,000,354 | —- | M] () – C:\WINDOWS\tasks\MotoHelper Routing.job
[2011/12/09 21:32:01 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/09 21:25:10 | 000,000,802 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/12/09 21:25:10 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/12/09 20:55:52 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/12/09 14:51:17 | 000,000,436 | -H– | M] () – C:\WINDOWS\tasks\Norton Security Scan for Owner.job
[2011/12/09 12:05:01 | 000,000,976 | —- | M] () – C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1085031214-1682526488-1606980848-1003Core.job
[2011/12/09 01:46:18 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/12/09 01:45:44 | 000,001,664 | —- | M] () – C:\Documents and Settings\Owner\Start Menu\Programs\Startup\2X Client.lnk
[2011/12/09 01:45:20 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/12/08 23:34:45 | 000,000,486 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/12/08 23:29:16 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/12/08 22:52:29 | 004,331,207 | R— | M] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/12/08 22:27:08 | 001,577,776 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\tdsskiller.exe
[2011/12/08 00:24:58 | 004,331,784 | R— | M] (Swearware) – C:\ComboFix.exe
[2011/12/06 02:04:59 | 000,657,086 | —- | M] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/12/05 02:36:14 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HiJackThis.exe
[2011/12/04 23:55:49 | 000,000,064 | —- | M] () – C:\WINDOWS\System32\rp_stats.dat
[2011/12/04 23:55:49 | 000,000,044 | —- | M] () – C:\WINDOWS\System32\rp_rules.dat
[2011/12/04 20:16:16 | 000,071,398 | —- | M] (jpshortstuff) – C:\Documents and Settings\Owner\Desktop\GooredFix.exe
[2011/12/04 20:14:41 | 000,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\Owner\Desktop\ATF_Cleaner.exe
[2011/12/04 19:57:14 | 000,204,496 | —- | M] (Malwarebytes) – C:\Documents and Settings\Owner\Desktop\StartUpLite.exe
[2011/12/04 19:39:43 | 000,000,764 | —- | M] () – C:\Documents and Settings\All Users\Desktop\2X Client.lnk
[2011/12/04 08:08:41 | 000,000,000 | —- | M] () – C:\Documents and Settings\Owner\Desktop\settings.dat
[2011/12/04 08:08:16 | 000,000,696 | —- | M] () – C:\Documents and Settings\Owner\Desktop\BitZipper.lnk
[2011/12/04 08:06:17 | 000,000,712 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\BitZipper.lnk
[2011/12/03 16:27:16 | 000,013,374 | -HS- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\iecmrf5r3icp7iqw6puv2e758t1u
[2011/12/03 16:27:16 | 000,013,374 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\iecmrf5r3icp7iqw6puv2e758t1u
[2011/12/03 03:01:51 | 000,001,809 | —- | M] () – C:\Documents and Settings\All Users\Desktop\PC Tools Spyware Doctor.lnk
[2011/12/01 23:56:54 | 000,016,432 | —- | M] () – C:\WINDOWS\System32\lsdelete.exe
[2011/12/01 17:59:23 | 000,001,490 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Spider Solitaire.lnk
[2011/11/28 20:02:56 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/11/24 22:53:58 | 000,000,370 | —- | M] () – C:\WINDOWS\tasks\MotoHelper Update.job
[2011/11/24 22:53:57 | 000,000,358 | —- | M] () – C:\WINDOWS\tasks\MotoHelper MUM.job
[2011/11/22 19:43:02 | 000,070,536 | —- | M] (PC Tools) – C:\WINDOWS\System32\drivers\pctplsg.sys
[2011/11/22 19:42:40 | 000,185,560 | —- | M] (PC Tools) – C:\WINDOWS\System32\drivers\PCTSD.sys
[2011/11/22 19:41:28 | 000,017,848 | —- | M] (PC Tools) – C:\WINDOWS\System32\drivers\pctBTFix.sys
[2011/11/22 19:38:04 | 000,253,096 | —- | M] (PC Tools) – C:\WINDOWS\System32\drivers\pctgntdi.sys
[2011/11/22 18:20:06 | 000,574,424 | –S- | M] (PC Tools) – C:\WINDOWS\System32\drivers\TfSysMon.sys
[2011/11/22 18:20:06 | 000,035,264 | –S- | M] (PC Tools) – C:\WINDOWS\System32\drivers\TfNetMon.sys
[2011/11/22 18:20:04 | 000,054,328 | –S- | M] (PC Tools) – C:\WINDOWS\System32\drivers\TfFsMon.sys
[2011/11/20 19:18:10 | 029,918,440 | —- | M] (IObit ) – C:\Documents and Settings\Owner\Desktop\asc-setup.exe
[2011/11/20 03:38:58 | 000,001,915 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2011/11/14 16:07:06 | 000,149,456 | —- | M] (PC Tools) – C:\WINDOWS\SGDetectionTool.dll
[2011/11/14 16:07:04 | 002,246,608 | —- | M] (Threat Expert Ltd.) – C:\WINDOWS\PCTBDCore.dll
[2011/11/14 16:07:04 | 001,681,360 | —- | M] (Threat Expert Ltd.) – C:\WINDOWS\PCTBDRes.dll
[2011/11/14 16:06:54 | 000,767,952 | —- | M] () – C:\WINDOWS\BDTSupport.dll
[2011/11/14 15:12:26 | 000,331,880 | —- | M] (PC Tools) – C:\WINDOWS\System32\drivers\PCTCore.sys
[2011/11/14 15:12:24 | 000,162,584 | —- | M] (PC Tools) – C:\WINDOWS\System32\drivers\PCTAppEvent.sys
[2011/11/12 19:06:29 | 000,040,448 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/11/11 03:19:55 | 000,444,016 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/11/11 03:19:55 | 000,072,274 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/12/09 21:25:10 | 000,000,802 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/12/04 19:53:52 | 000,001,664 | —- | C] () – C:\Documents and Settings\Owner\Start Menu\Programs\Startup\2X Client.lnk
[2011/12/04 19:39:43 | 000,000,764 | —- | C] () – C:\Documents and Settings\All Users\Desktop\2X Client.lnk
[2011/12/04 08:08:41 | 000,000,000 | —- | C] () – C:\Documents and Settings\Owner\Desktop\settings.dat
[2011/12/04 08:06:17 | 000,000,712 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\BitZipper.lnk
[2011/12/04 08:06:17 | 000,000,696 | —- | C] () – C:\Documents and Settings\Owner\Desktop\BitZipper.lnk
[2011/12/03 03:57:11 | 000,013,374 | -HS- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\iecmrf5r3icp7iqw6puv2e758t1u
[2011/12/03 03:57:11 | 000,013,374 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\iecmrf5r3icp7iqw6puv2e758t1u
[2011/12/03 03:05:15 | 000,767,952 | —- | C] () – C:\WINDOWS\BDTSupport.dll
[2011/12/03 03:05:14 | 000,003,488 | —- | C] () – C:\WINDOWS\UDB.zip
[2011/12/03 03:05:14 | 000,000,882 | —- | C] () – C:\WINDOWS\RegSDImport.xml
[2011/12/03 03:05:14 | 000,000,879 | —- | C] () – C:\WINDOWS\RegISSImport.xml
[2011/12/03 03:05:14 | 000,000,131 | —- | C] () – C:\WINDOWS\IDB.zip
[2011/12/03 03:01:51 | 000,001,809 | —- | C] () – C:\Documents and Settings\All Users\Desktop\PC Tools Spyware Doctor.lnk
[2011/12/02 22:43:51 | 000,002,265 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2011/12/02 22:43:51 | 000,001,915 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2011/12/02 22:43:51 | 000,001,734 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/12/02 22:43:51 | 000,001,703 | —- | C] () – C:\Documents and Settings\All Users\Desktop\ViewNX 2.lnk
[2011/12/02 22:43:51 | 000,001,695 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Panorama Maker 5.lnk
[2011/12/02 22:43:51 | 000,001,678 | —- | C] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/12/02 22:43:51 | 000,001,604 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2011/12/02 22:43:51 | 000,001,604 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CDBurnerXP.lnk
[2011/12/02 22:43:51 | 000,001,542 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/12/02 22:43:51 | 000,001,261 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Logitech Webcam Software .lnk
[2011/12/02 22:43:51 | 000,000,970 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Norton Security Scan.lnk
[2011/12/02 22:43:51 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/12/02 22:43:51 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/12/02 22:43:47 | 000,002,045 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Dave Ramsey's Financial Peace Financial Software.lnk
[2011/12/02 22:43:47 | 000,000,815 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/12/02 22:43:47 | 000,000,800 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/12/02 22:43:47 | 000,000,792 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk
[2011/12/02 22:43:47 | 000,000,533 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\FrostWire.lnk
[2011/12/02 22:43:47 | 000,000,079 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/12/02 22:43:36 | 000,002,347 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/12/02 22:43:36 | 000,002,265 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Apple Software Update.lnk
[2011/12/02 22:43:36 | 000,002,071 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Dave Ramsey's Personal Finance Software 5.4.lnk
[2011/12/02 22:43:36 | 000,001,986 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\MSN.lnk
[2011/12/02 22:43:36 | 000,001,556 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\CDBurnerXP.lnk
[2011/12/02 22:43:36 | 000,001,077 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Live ID.lnk
[2011/12/02 22:43:36 | 000,000,955 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Defender.lnk
[2011/12/02 22:43:36 | 000,000,786 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Movie Maker.lnk
[2011/12/02 22:43:35 | 000,001,681 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\ABBYY FineReader 5.0 Sprint.lnk
[2011/12/02 22:43:35 | 000,000,738 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Acrobat_com.lnk
[2011/12/02 00:18:21 | 000,016,432 | —- | C] () – C:\WINDOWS\System32\lsdelete.exe
[2011/12/01 23:33:24 | 000,000,797 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2011/11/24 22:53:58 | 000,000,370 | —- | C] () – C:\WINDOWS\tasks\MotoHelper Update.job
[2011/11/24 22:53:57 | 000,000,358 | —- | C] () – C:\WINDOWS\tasks\MotoHelper MUM.job
[2011/11/24 22:53:56 | 000,000,354 | —- | C] () – C:\WINDOWS\tasks\MotoHelper Routing.job
[2011/07/13 20:45:51 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/07/13 20:45:51 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/07/13 20:45:51 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/07/13 20:45:51 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/07/13 20:45:51 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/07/07 15:48:46 | 000,059,560 | —- | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/05/22 22:54:03 | 000,000,000 | —- | C] () – C:\WINDOWS\ViewNX2.INI
[2011/05/22 22:41:42 | 000,000,268 | R— | C] () – C:\Documents and Settings\All Users\Application Data\Booms
[2011/05/22 22:41:42 | 000,000,268 | R— | C] () – C:\Documents and Settings\Owner\Application Data\Bass
[2011/05/22 22:41:41 | 000,000,268 | R— | C] () – C:\Documents and Settings\All Users\Application Data\BookService
[2011/05/22 22:41:41 | 000,000,268 | R— | C] () – C:\Documents and Settings\Owner\Application Data\Basics
[2011/05/22 22:41:41 | 000,000,020 | —- | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLev.DAT
[2011/05/22 22:41:40 | 000,000,268 | R— | C] () – C:\Documents and Settings\All Users\Application Data\Bass Reduction
[2011/05/22 22:41:40 | 000,000,268 | R— | C] () – C:\Documents and Settings\Owner\Application Data\Basic Track
[2011/05/22 22:41:40 | 000,000,020 | —- | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLes.DAT
[2011/05/22 22:41:39 | 000,000,020 | —- | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLet.DAT
[2011/05/19 22:21:49 | 000,000,056 | —- | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2011/04/26 16:40:44 | 000,000,064 | —- | C] () – C:\WINDOWS\System32\rp_stats.dat
[2011/04/26 16:40:44 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\rp_rules.dat
[2011/03/22 22:58:22 | 000,014,168 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2011/02/06 03:10:42 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2010/11/09 21:45:32 | 000,102,744 | —- | C] () – C:\WINDOWS\System32\LogiDPPApp.exe
[2010/11/09 21:45:30 | 010,877,272 | —- | C] () – C:\WINDOWS\System32\LogiDPP.dll
[2010/11/09 21:45:20 | 000,331,608 | —- | C] () – C:\WINDOWS\System32\DevManagerCore.dll
[2010/11/09 21:31:42 | 000,027,872 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2010/10/26 23:29:09 | 000,004,212 | —- | C] () – C:\WINDOWS\System32\zllictbl.dat
[2010/10/26 16:02:50 | 000,000,014 | —- | C] () – C:\WINDOWS\popcinfo.dat
[2010/10/26 15:49:21 | 000,000,018 | —- | C] () – C:\WINDOWS\popcinfot.dat
[2010/10/26 15:49:21 | 000,000,000 | —- | C] () – C:\WINDOWS\popcreg.dat
[2010/09/10 20:28:04 | 000,000,584 | —- | C] () – C:\WINDOWS\wininit.ini
[2010/06/11 19:18:47 | 000,000,153 | —- | C] () – C:\WINDOWS\ACROREAD.INI
[2010/06/11 19:15:41 | 000,210,944 | —- | C] () – C:\WINDOWS\System32\MSVCRT10.DLL
[2010/06/11 19:15:41 | 000,000,177 | —- | C] () – C:\WINDOWS\kpcms.ini
[2010/06/11 19:15:39 | 000,006,144 | —- | C] () – C:\WINDOWS\System32\ImgLibLead.dll
[2010/06/11 19:15:38 | 000,100,864 | —- | C] () – C:\WINDOWS\System32\Dc50ip32.dll
[2010/05/07 17:43:30 | 000,025,824 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2009/11/04 04:48:53 | 000,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2009/10/13 14:48:47 | 000,000,023 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2009/10/05 17:55:12 | 000,001,100 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2009/09/04 20:25:39 | 000,004,096 | —- | C] () – C:\WINDOWS\d3dx.dat
[2009/08/03 14:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | —- | C] () – C:\WINDOWS\System32\OGAEXEC.exe
[2009/07/01 20:07:16 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/03/20 10:59:49 | 000,040,448 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/03/07 06:43:27 | 000,000,072 | —- | C] () – C:\WINDOWS\MediaManager.INI
[2009/03/06 22:25:33 | 000,000,462 | —- | C] () – C:\WINDOWS\lexstat.ini
[2009/01/23 12:02:47 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/01/23 11:57:14 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/01/23 06:47:41 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2009/01/23 06:46:20 | 000,405,408 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/04/14 04:55:28 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2006/12/31 06:57:08 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2006/03/06 10:41:02 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\AMV_DecDLL.dll
[2004/09/16 13:26:40 | 000,012,634 | —- | C] () – C:\WINDOWS\System32\drivers\ADFUUD.SYS
[2004/09/16 13:26:40 | 000,012,634 | —- | C] () – C:\WINDOWS\ADFUUD.SYS
[2004/08/12 07:36:06 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/12 07:36:06 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/12 07:26:08 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/12 07:26:07 | 000,444,016 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/12 07:26:06 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/12 07:26:05 | 000,072,274 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/12 07:24:57 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/12 07:22:08 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/12 07:22:01 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/12 07:18:55 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2003/03/28 09:26:24 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\LXBKIH.EXE
[2003/03/28 09:17:32 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\LXBKLCNP.DLL
[2002/11/13 11:40:22 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxbkvs.dll
[2002/09/13 07:40:06 | 000,000,266 | —- | C] () – C:\WINDOWS\System32\lxbkcoin.ini
[2001/01/19 11:50:20 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\INSTMON.EXE
========== LOP Check ==========
[2011/01/21 05:06:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\183E
[2010/12/03 20:14:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\2A131
[2011/09/15 20:24:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\373D8
[2011/12/09 01:47:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection
[2011/03/20 00:32:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2009/03/06 20:50:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AT&T
[2009/07/17 16:41:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ATTToolbar
[2011/04/16 12:14:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2009/03/06 22:26:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2011/02/06 03:10:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2011/01/17 21:33:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Chat Republic Games
[2011/03/15 07:48:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/10/15 09:35:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Easybits GO
[2011/05/22 22:41:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2011/10/06 19:07:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Fighters
[2011/04/26 18:32:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GameHouse
[2010/11/28 10:14:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/05/22 22:41:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nature
[2011/05/24 05:59:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nikon
[2011/05/22 22:41:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PDEs
[2011/05/22 22:41:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Perl
[2010/10/26 15:49:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap Games
[2011/06/08 19:03:02 | 000,000,000 | -HSD | M] – C:\Documents and Settings\All Users\Application Data\SSGGUS
[2011/12/09 01:45:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/05/22 22:41:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2011/10/15 09:54:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\W3i
[2009/06/18 20:57:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WildTangent
[2011/07/06 22:18:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/09/12 20:44:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{ACFC9F59-F1AE-43D2-8CFE-E2F1E0F82ABA}
[2010/08/12 16:29:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\2XClient
[2011/12/02 22:45:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\adawaretb
[2009/03/07 08:30:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Amazon
[2009/03/06 20:50:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AT&T
[2009/07/08 08:06:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ATTToolbar
[2011/12/04 08:06:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\BitZipper
[2011/02/06 03:10:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Canneverbe Limited
[2010/06/30 16:51:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\cerasus.media
[2010/10/26 23:29:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\CheckPoint
[2010/05/14 17:30:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\com.adobe.example.main.52A93B964BBEB0902CC01E05810570B8BA16AEC8.1
[2011/10/09 20:36:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\com.amazon.music.uploader
[2011/10/08 12:17:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\com.moasis
[2011/10/13 15:47:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Fighters
[2011/06/05 21:26:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\FrostWire
[2011/10/15 09:34:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\go
[2011/07/20 20:28:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\gtk-2.0
[2011/02/08 19:56:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\imeshbandmltbpi
[2010/08/06 18:10:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ImgBurn
[2011/07/07 18:52:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ImTOO
[2011/05/19 20:46:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Leadertech
[2011/10/03 17:57:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Nikon
[2009/03/08 22:04:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\OpenOffice.org
[2011/12/04 14:49:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\PCTools
[2011/10/31 17:58:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Personal Finance Software
[2011/09/12 20:35:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\searchquband
[2011/09/12 20:45:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\searchqutoolbar
[2011/12/03 01:27:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\TestApp
[2010/06/25 10:47:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\TuxPaint
[2010/04/02 20:23:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Unity
[2009/10/13 14:32:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\WeatherBug
[2011/12/08 23:34:45 | 000,000,486 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2011/12/09 12:05:01 | 000,000,976 | —- | M] () – C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-1085031214-1682526488-1606980848-1003Core.job
[2011/12/10 09:05:03 | 000,000,998 | —- | M] () – C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-1085031214-1682526488-1606980848-1003UA.job
[2011/11/24 22:53:57 | 000,000,358 | —- | M] () – C:\WINDOWS\Tasks\MotoHelper MUM.job
[2011/12/09 22:53:05 | 000,000,354 | —- | M] () – C:\WINDOWS\Tasks\MotoHelper Routing.job
[2011/11/24 22:53:58 | 000,000,370 | —- | M] () – C:\WINDOWS\Tasks\MotoHelper Update.job
[2011/12/10 05:02:13 | 000,000,422 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{2C5D2369-05C8-4720-B088-78D1B8DB9F44}.job
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.exe >
[2011/12/08 00:24:58 | 004,331,784 | R— | M] (Swearware) – C:\ComboFix.exe
< MD5 for: EXPLORER.EXE >
[2008/04/14 04:42:20 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/14 04:42:20 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/14 04:42:20 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\system32\dllcache\explorer.exe
< MD5 for: SVCHOST.EXE >
[2008/04/14 04:42:38 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ERDNT\cache\svchost.exe
[2008/04/14 04:42:38 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\dllcache\svchost.exe
[2008/04/14 04:42:38 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\svchost.exe
< MD5 for: USERINIT.EXE >
[2008/04/14 04:42:40 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/14 04:42:40 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\dllcache\userinit.exe
[2008/04/14 04:42:40 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe
< MD5 for: WINLOGON.EXE >
[2008/04/14 04:42:40 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/14 04:42:40 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\dllcache\winlogon.exe
[2008/04/14 04:42:40 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe
< C:\Windows\assembly\tmp\U\*.* /s >
========== Alternate Data Streams ==========
@Alternate Data Stream - 187 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:430C6D84
< End of report >
OTL Extras now:
OTL Extras logfile created on: 12/10/2011 10:05:53 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.49 Gb Total Physical Memory | 2.63 Gb Available Physical Memory | 75.23% Memory free
4.82 Gb Paging File | 4.29 Gb Available in Paging File | 89.05% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 372.61 Gb Total Space | 333.59 Gb Free Space | 89.53% Space Free | Partition Type: NTFS
Computer Name: OWNER-84FDF6F64 | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = ChromeHTML] – Reg Error: Key error. File not found
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = exefile] – Reg Error: Key error. File not found
.html [@ = htmlfile] – Reg Error: Key error. File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htafile [open] – "%1" %*
https [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1"
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 1
"ANTIVIRUSDISABLENOTIFY" = 0
"FIREWALLDISABLENOTIFY" = 0
"UPDATESDISABLENOTIFY" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\iMesh Applications\iMesh\iMesh.exe" = C:\Program Files\iMesh Applications\iMesh\iMesh.exe:*:Enabled:iMesh
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\ATT-HSI\McciBrowser.exe" = C:\Program Files\ATT-HSI\McciBrowser.exe:*:Enabled:motivebrowser.exe – (Motive Communications, Inc.)
"C:\Program Files\2X\Client\TSClient.exe" = C:\Program Files\2X\Client\TSClient.exe:*:Enabled:TSClient Application – (2X Software Ltd.)
"C:\Program Files\Windows Savevid Toolbar\Datamngr\ToolBar\dtUser.exe" = C:\Program Files\Windows Savevid Toolbar\Datamngr\ToolBar\dtUser.exe:*:Enabled:DTX broker – (Visicom Media Inc.)
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit – (Apple Inc.)
"C:\Documents and Settings\Owner\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe" = C:\Documents and Settings\Owner\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe:*:Enabled:Facebook Video Calling Plugin – (Skype Limited)
"C:\Program Files\adawaretb\dtUser.exe" = C:\Program Files\adawaretb\dtUser.exe:*:Enabled:Ad-Aware Security Toolbar DTX Broker – (Visicom Media Inc.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1D7CE340-70C3-4848-BCCF-215950328A4C}" = Facebook Video Calling 1.0.0.8953
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2656D0AB-9EA4-4C58-A117-635F3CED8B93}" = Microsoft UI Engine
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java™ 6 Update 26
"{29ED20C9-5E15-4969-9279-25BF3727A3DA}" = iTunes
"{2CCBABCB-6427-4A55-B091-49864623C43F}" = Google Toolbar for Firefox
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{385DD1DD-65AA-408D-8E70-74601C2DB7E6}" = Ad-Aware
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{730E03E4-350E-48E5-9D3E-4329903D454D}" = Itibiti RTC
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{8B9852AF-B0B0-47B7-9BC5-89A95D77B6C9}" = MP3 Player Utilities 4.05
"{8D15E1B2-D2B7-4A17-B44B-D2DDE5981405}" = SaveVid Plug-in
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISER_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{932D0FC7-6DF1-4136-A2EC-166E8DEFD6A4}" = Ad-Aware
"{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{A00B9A50-3090-4CFF-9CDA-82DA0BEDAA21}" = Apple Mobile Device Support
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A651161D-4D8C-435A-8637-6517D12D8151}" = 2X Client
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{ACEB2BAF-96DF-48FD-ADD5-43842D4C443D}" = Adobe AIR
"{B014EE44-9197-4513-9613-71E6EB1B514E}" = Nikon Message Center 2
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C35CCBEB-5A54-4DD8-9EC8-110F2A8154B3}" = Motorola Mobile Drivers Installation 5.1.0
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1696920-9794-4BBC-8A30-7A88763DE5A2}" = ABBYY FineReader 5.0 Sprint
"{D1E7142C-6BC3-49EB-A71A-E5D7ADAC7599}" = Nikon File Uploader 2
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{DDD62492-32A7-412B-8AF1-2CF032AD42E3}" = ViewNX 2
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F18046C5-1C4E-4BE1-A3D6-A6F970E2E8E8}" = ArcSoft Panorama Maker 5
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F44DA61E-720D-4E79-871F-F6E628B33242}" = OpenOffice.org 3.0
"{F45298E5-0083-426F-A668-1A2C5F04B8A0}" = FaxTools
"{F8131A35-47FD-27AD-116D-0E79AF5DE5EE}" = Acrobat.com
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"7-Zip" = 7-Zip 9.22beta
"adawaretb" = Ad-Aware Security Toolbar
"Adobe Acrobat Reader 3.01" = Adobe Acrobat Reader 3.01
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe Type Manager 4.0" = Adobe Type Manager 4.0
"Amazon Kindle" = Amazon Kindle
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.12
"ATT-SST" = AT&T Self Support Tool
"ATTToolbar" = AT&T Toolbar
"AVS Image Converter_is1" = AVS Image Converter [removed]
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"BitZipper_is1" = BitZipper 2010
"Browser Defender_is1" = Browser Defender 4.0
"CCleaner" = CCleaner
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Dave Ramsey's Financial Peace Financial Software 5.45.4" = Dave Ramsey's Financial Peace Financial Software 5.4.1
"Dave Ramsey's Financial Peace Financial Software5.3" = Dave Ramsey's Financial Peace Financial Software
"ENTERPRISER" = Microsoft Office Enterprise 2007
"ESET Online Scanner" = ESET Online Scanner v3
"Google Updater" = Google Updater
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"ImgBurn" = ImgBurn
"InterActual Player" = InterActual Player
"Lexmark X1100 Series" = Lexmark X1100 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MotoHelper" = MotoHelper 2.0.51 Driver 5.1.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NSS" = Norton Security Scan
"RadialpointClientGateway_is1" = AT&T Internet Security Wizard 1.5.11
"SaveVid Plug-in" = SaveVid Plug-in
"Searchqu 405 MediaBar" = Windows Savevid Toolbar
"SoyDominicano.NET Toolbar" = SoyDominicano.NET Toolbar
"Spyware Doctor" = PC Tools Spyware Doctor 9.0
"Trusted Software Assistant_is1" = File Type Assistant
"Tux Paint_is1" = Tux Paint 0.9.21
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! IE Suggest" = Yahoo! Search Suggest Add-on for IE7
"Yahoo! Mail" = AT&T Yahoo! Internet Mail
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"UnityWebPlayer" = Unity Web Player
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 12/9/2011 12:28:11 AM | Computer Name = OWNER-84FDF6F64 | Source = JavaQuickStarterService | ID = 1
Description =
Error - 12/9/2011 12:28:25 AM | Computer Name = OWNER-84FDF6F64 | Source = Application Error | ID = 1000
Description = Faulting application MotoHelperService.exe, version 2.0.51.0, faulting
module MotoHelperService.exe, version 2.0.51.0, fault address 0x000054df.
Error - 12/9/2011 12:28:52 AM | Computer Name = OWNER-84FDF6F64 | Source = Application Error | ID = 1000
Description = Faulting application MotoHelperService.exe, version 2.0.51.0, faulting
module MotoHelperService.exe, version 2.0.51.0, fault address 0x000054df.
Error - 12/9/2011 12:29:36 AM | Computer Name = OWNER-84FDF6F64 | Source = Application Error | ID = 1000
Description = Faulting application MotoHelperService.exe, version 2.0.51.0, faulting
module MotoHelperService.exe, version 2.0.51.0, fault address 0x000054df.
Error - 12/9/2011 12:29:59 AM | Computer Name = OWNER-84FDF6F64 | Source = Application Error | ID = 1000
Description = Faulting application MotoHelperService.exe, version 2.0.51.0, faulting
module MotoHelperService.exe, version 2.0.51.0, fault address 0x000054df.
Error - 12/9/2011 1:05:14 AM | Computer Name = OWNER-84FDF6F64 | Source = Google Update | ID = 20
Description =
Error - 12/9/2011 10:19:41 PM | Computer Name = OWNER-84FDF6F64 | Source = McLogEvent | ID = 5004
Description =
Error - 12/9/2011 10:19:41 PM | Computer Name = OWNER-84FDF6F64 | Source = McLogEvent | ID = 5022
Description =
Error - 12/9/2011 10:19:41 PM | Computer Name = OWNER-84FDF6F64 | Source = McLogEvent | ID = 5004
Description =
Error - 12/9/2011 10:19:41 PM | Computer Name = OWNER-84FDF6F64 | Source = McLogEvent | ID = 5022
Description =
[ Application Events ]
Error - 12/9/2011 12:28:11 AM | Computer Name = OWNER-84FDF6F64 | Source = JavaQuickStarterService | ID = 1
Description =
Error - 12/9/2011 12:28:25 AM | Computer Name = OWNER-84FDF6F64 | Source = Application Error | ID = 1000
Description = Faulting application MotoHelperService.exe, version 2.0.51.0, faulting
module MotoHelperService.exe, version 2.0.51.0, fault address 0x000054df.
Error - 12/9/2011 12:28:52 AM | Computer Name = OWNER-84FDF6F64 | Source = Application Error | ID = 1000
Description = Faulting application MotoHelperService.exe, version 2.0.51.0, faulting
module MotoHelperService.exe, version 2.0.51.0, fault address 0x000054df.
Error - 12/9/2011 12:29:36 AM | Computer Name = OWNER-84FDF6F64 | Source = Application Error | ID = 1000
Description = Faulting application MotoHelperService.exe, version 2.0.51.0, faulting
module MotoHelperService.exe, version 2.0.51.0, fault address 0x000054df.
Error - 12/9/2011 12:29:59 AM | Computer Name = OWNER-84FDF6F64 | Source = Application Error | ID = 1000
Description = Faulting application MotoHelperService.exe, version 2.0.51.0, faulting
module MotoHelperService.exe, version 2.0.51.0, fault address 0x000054df.
Error - 12/9/2011 1:05:14 AM | Computer Name = OWNER-84FDF6F64 | Source = Google Update | ID = 20
Description =
Error - 12/9/2011 10:19:41 PM | Computer Name = OWNER-84FDF6F64 | Source = McLogEvent | ID = 5004
Description =
Error - 12/9/2011 10:19:41 PM | Computer Name = OWNER-84FDF6F64 | Source = McLogEvent | ID = 5022
Description =
Error - 12/9/2011 10:19:41 PM | Computer Name = OWNER-84FDF6F64 | Source = McLogEvent | ID = 5004
Description =
Error - 12/9/2011 10:19:41 PM | Computer Name = OWNER-84FDF6F64 | Source = McLogEvent | ID = 5022
Description =
[ Application Events ]
Error - 12/9/2011 12:28:11 AM | Computer Name = OWNER-84FDF6F64 | Source = JavaQuickStarterService | ID = 1
Description =
Error - 12/9/2011 12:28:25 AM | Computer Name = OWNER-84FDF6F64 | Source = Application Error | ID = 1000
Description = Faulting application MotoHelperService.exe, version 2.0.51.0, faulting
module MotoHelperService.exe, version 2.0.51.0, fault address 0x000054df.
Error - 12/9/2011 12:28:52 AM | Computer Name = OWNER-84FDF6F64 | Source = Application Error | ID = 1000
Description = Faulting application MotoHelperService.exe, version 2.0.51.0, faulting
module MotoHelperService.exe, version 2.0.51.0, fault address 0x000054df.
Error - 12/9/2011 12:29:36 AM | Computer Name = OWNER-84FDF6F64 | Source = Application Error | ID = 1000
Description = Faulting application MotoHelperService.exe, version 2.0.51.0, faulting
module MotoHelperService.exe, version 2.0.51.0, fault address 0x000054df.
Error - 12/9/2011 12:29:59 AM | Computer Name = OWNER-84FDF6F64 | Source = Application Error | ID = 1000
Description = Faulting application MotoHelperService.exe, version 2.0.51.0, faulting
module MotoHelperService.exe, version 2.0.51.0, fault address 0x000054df.
Error - 12/9/2011 1:05:14 AM | Computer Name = OWNER-84FDF6F64 | Source = Google Update | ID = 20
Description =
Error - 12/9/2011 10:19:41 PM | Computer Name = OWNER-84FDF6F64 | Source = McLogEvent | ID = 5004
Description =
Error - 12/9/2011 10:19:41 PM | Computer Name = OWNER-84FDF6F64 | Source = McLogEvent | ID = 5022
Description =
Error - 12/9/2011 10:19:41 PM | Computer Name = OWNER-84FDF6F64 | Source = McLogEvent | ID = 5004
Description =
Error - 12/9/2011 10:19:41 PM | Computer Name = OWNER-84FDF6F64 | Source = McLogEvent | ID = 5022
Description =
[ OSession Events ]
Error - 9/7/2011 3:15:57 AM | Computer Name = OWNER-84FDF6F64 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 21649
seconds with 1500 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 12/4/2011 12:55:21 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:55:23 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:55:26 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:55:27 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:56:30 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:57:19 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:57:34 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:57:47 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:57:55 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:57:57 AM | Computer Name = OWNER-84FDF6F64 | Source = DCOM | ID = 10010
Description = The server {209500FC-6B45-4693-8871-6296C4843751} did not register
with DCOM within the required timeout.
[ System Events ]
Error - 12/4/2011 12:55:21 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:55:23 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:55:26 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:55:27 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:56:30 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:57:19 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:57:34 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:57:47 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:57:55 AM | Computer Name = OWNER-84FDF6F64 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127
Error - 12/4/2011 12:57:57 AM | Computer Name = OWNER-84FDF6F64 | Source = DCOM | ID = 10010
Description = The server {209500FC-6B45-4693-8871-6296C4843751} did not register
with DCOM within the required timeout.
< End of report >
Again, Thanks so much!
Ann
I don't know what happened, but I wanted to let you know that I was able to both install and run last night, on my computer, BOTH TDSSKiller and combofix. When I get home today I will try to find the appropriate logs and post them here for you. *whew!*
Ann
