conduit.search.com redirect/whitesmoke toolbar [Solved]

Hi, I picked up the conduit redirect & the whitesmoke toolbar, the logs follow

OTL logfile created on: 12/30/2011 9:59:18 AM - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\b\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.50 Gb Total Physical Memory | 0.67 Gb Available Physical Memory | 44.54% Memory free
3.35 Gb Paging File | 2.40 Gb Available in Paging File | 71.54% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 56.18 Gb Free Space | 75.38% Space Free | Partition Type: NTFS

Computer Name: A | User Name: b | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
PRC - C:\Documents and Settings\b\My Documents\Downloads\OTL (1).exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG2012\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\system32\WDBtnMgr.exe (Western Digital Technologies, Inc.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
PRC - C:\WINDOWS\system32\TCtrlIOHook.exe (TOSHIBA)
PRC - C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\ZoomingHook.exe (TOSHIBA)
PRC - C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\WINDOWS\system32\acs.exe ()
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe (TOSHIBA)
PRC - C:\Program Files\Dantz\Retrospect\wdsvc.exe (Dantz Development Corporation)
PRC - C:\Program Files\Dantz\Retrospect\retrorun.exe (Dantz Development Corporation)
PRC - C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
PRC - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
PRC - C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)


========== Modules (No Company Name) ==========

MOD - C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll ()
MOD - C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\ppgooglenaclpluginchrome.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\pdf.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\avutil-51.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\avformat-53.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\avcodec-53.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\gcswf32.dll ()
MOD - C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL ()
MOD - C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\WINDOWS\system32\devenum.dll ()
MOD - C:\WINDOWS\system32\acs.exe ()


========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – File not found
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SRV - (avgwd) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (SwitchBoard) – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (ACS) – C:\WINDOWS\system32\acs.exe ()
SRV - (CFSvcs) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (RetroWDSvc) – C:\Program Files\Dantz\Retrospect\wdsvc.exe (Dantz Development Corporation)
SRV - (RetroLauncher) – C:\Program Files\Dantz\Retrospect\retrorun.exe (Dantz Development Corporation)
SRV - (DVD-RAM_Service) – C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)


========== Driver Services (SafeList) ==========

DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (MDC8021X) AEGIS Protocol (IEEE 802.1x) – C:\WINDOWS\system32\drivers\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (ssadmdm) – C:\WINDOWS\system32\drivers\ssadmdm.sys (MCCI Corporation)
DRV - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) – C:\WINDOWS\system32\drivers\ssadbus.sys (MCCI Corporation)
DRV - (ssadmdfl) SAMSUNG Android USB Modem (Filter) – C:\WINDOWS\system32\drivers\ssadmdfl.sys (MCCI Corporation)
DRV - (LVUSBSta) – C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (CamDrL) Logitech QuickCam Pro 3000(CamDrl) – C:\WINDOWS\system32\drivers\Camdrl.sys (Logitech Inc.)
DRV - (TPwSav) – C:\WINDOWS\System32\DRIVERS\TPwSav.sys (TOSHIBA )
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (TCtrlIO) – C:\WINDOWS\system32\drivers\TCtrlIO.sys (TOSHIBA )
DRV - (SrvcSSIOMngr) – C:\WINDOWS\system32\drivers\SSIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (SrvcTPIOMngr) – C:\WINDOWS\system32\drivers\TPIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (SrvcEKIOMngr) – C:\WINDOWS\system32\drivers\EKIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (SerTVOutCtlr) – C:\WINDOWS\system32\drivers\EPIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ESMCR) – C:\WINDOWS\system32\drivers\ESM7SK.sys (ENE Technology Inc.)
DRV - (EMSCR) – C:\WINDOWS\system32\drivers\EMS7SK.sys (ENE Technology Inc.)
DRV - (ESDCR) – C:\WINDOWS\system32\drivers\ESD7SK.sys (ENE Technology Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (AR5211) – C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (ALCXSENS) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (meiudf) – C:\WINDOWS\system32\drivers\meiudf.sys (Matsushita Electric Industrial Co.,Ltd.)
DRV - (caboagp) – C:\WINDOWS\system32\DRIVERS\atisgkaf.sys (ATI Technologies Inc.)
DRV - (Pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (RTL8023) – C:\WINDOWS\system32\drivers\Rtlnic51.sys (Realtek Semiconductor Corporation )
DRV - (Netdevio) – C:\WINDOWS\system32\drivers\Netdevio.sys (TOSHIBA Corporation.)
DRV - (TBiosDrv) – C:\WINDOWS\system32\drivers\Tbiosdrv.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://dts.search-results.com/sr?src=ieb&a;…q={searchTerms}
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/Acrobat,version=5.1: C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\b\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\b\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\b\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\b\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\b\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG2012\Firefox\ [2011/12/22 12:37:10 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2011/12/22 12:37:20 | 000,000,000 | —D | M]


O1 HOSTS File: ([2011/08/26 14:32:49 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()
O2 - BHO: (Yahooo Search Protection) - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [LtMoh] C:\\Program Files\\ltmoh\\Ltmoh.exe ()
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKLM..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe (TOSHIBA)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TCtryIOHook] C:\WINDOWS\system32\TCtrlIOHook.exe (TOSHIBA)
O4 - HKLM..\Run: [TFncKy] File not found
O4 - HKLM..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [WD Button Manager] C:\WINDOWS\System32\WDBtnMgr.exe (Western Digital Technologies, Inc.)
O4 - HKLM..\Run: [ZoomingHook] C:\WINDOWS\system32\ZoomingHook.exe (TOSHIBA)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Java Plug-in 1.4.2_05)
O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Java Plug-in 1.4.2_05)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\b\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\b\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/09/01 23:19:26 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - ff_vfw.dll File not found
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/12/29 14:19:43 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Application Data\Curiolab
[2011/12/29 14:09:47 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Application Data\GetRightToGo
[2011/12/21 21:11:10 | 000,000,000 | —D | C] – C:\Documents and Settings\b\My Documents\Recipes
[2011/12/06 08:15:17 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Local Settings\Application Data\PCHealth
[2011/12/05 23:19:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2011/12/05 23:19:07 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2011/12/05 23:18:48 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2011/12/05 23:17:55 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2011/12/05 23:17:55 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2011/12/05 23:17:54 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2011/12/05 23:17:54 | 000,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2011/12/05 23:17:53 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2011/12/05 23:17:53 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2011/12/05 23:17:52 | 000,000,000 | —D | C] – C:\1f06b41c5dfa3f6ae26115eb697bf52a
[2011/12/03 08:07:40 | 000,274,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll
[2011/12/03 08:07:40 | 000,016,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll.mui
[2011/12/02 14:57:39 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Tracing
[2011/12/02 12:13:52 | 003,426,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_32.dll
[2011/12/02 12:13:28 | 000,000,000 | —D | C] – C:\Program Files\Microsoft SQL Server Compact Edition
[2011/12/02 12:10:04 | 000,000,000 | —D | C] – C:\Program Files\Microsoft
[2011/12/02 12:09:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\microsoft
[2011/12/02 12:09:22 | 000,000,000 | —D | C] – C:\Program Files\Windows Live SkyDrive
[2011/12/02 12:09:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Live
[2011/12/02 12:08:39 | 000,000,000 | —D | C] – C:\Program Files\Windows Live
[2011/12/02 11:54:52 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2011/04/07 17:46:24 | 000,028,672 | —- | C] ( ) – C:\WINDOWS\System32\ControlACS.exe
[2004/09/01 23:03:29 | 000,131,072 | —- | C] ( ) – C:\WINDOWS\System32\ATIDEMGR.dll
[8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/30 09:36:01 | 000,000,962 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-495781045-3759577209-3036343489-1006UA.job
[2011/12/30 09:28:04 | 000,000,876 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/30 09:11:34 | 085,517,702 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/12/30 09:05:11 | 000,000,872 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/30 09:05:06 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/12/30 09:05:04 | 1609,617,408 | -HS- | M] () – C:\hiberfil.sys
[2011/12/29 15:36:00 | 000,000,910 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-495781045-3759577209-3036343489-1006Core.job
[2011/12/28 18:58:34 | 000,210,961 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/12/28 18:46:40 | 000,144,384 | —- | M] () – C:\Documents and Settings\b\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/27 20:10:36 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2011/12/27 02:00:01 | 000,000,334 | —- | M] () – C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-A-b.job
[2011/12/22 12:37:21 | 000,000,713 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2012.lnk
[2011/12/21 17:58:29 | 000,000,991 | —- | M] () – C:\Documents and Settings\b\Desktop\magicJack.lnk
[2011/12/19 09:28:06 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/12/15 19:42:51 | 000,002,241 | —- | M] () – C:\Documents and Settings\b\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/12/15 19:42:49 | 000,002,263 | —- | M] () – C:\Documents and Settings\b\Desktop\Google Chrome.lnk
[2011/12/15 07:43:39 | 003,850,224 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/15 00:41:38 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/12/07 14:09:40 | 000,000,294 | —- | M] () – C:\Documents and Settings\b\My Documents\lost my give a stuff.xml
[2011/12/06 23:56:04 | 000,441,692 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/12/06 23:56:04 | 000,071,462 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/12/02 21:58:19 | 274,972,672 | —- | M] () – C:\WINDOWS\MEMORY.DMP
[8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/07 14:09:40 | 000,000,294 | —- | C] () – C:\Documents and Settings\b\My Documents\lost my give a stuff.xml
[2011/09/10 12:30:39 | 000,000,000 | —- | C] () – C:\WINDOWS\JDSecure31.INI
[2011/08/05 20:24:47 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\06807e882eed5f29381fe74271ecdccf_c
[2011/06/25 09:49:57 | 000,103,509 | —- | C] () – C:\WINDOWS\hpoins04.dat
[2011/06/25 09:49:57 | 000,017,176 | —- | C] () – C:\WINDOWS\hpomdl04.dat
[2011/06/01 19:57:08 | 000,819,200 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2011/06/01 19:57:08 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2011/06/01 16:27:15 | 000,144,384 | —- | C] () – C:\Documents and Settings\b\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/20 06:40:39 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/04/22 12:21:22 | 000,000,113 | —- | C] () – C:\WINDOWS\(null)toolkit.ini
[2011/04/07 17:46:24 | 000,241,664 | —- | C] () – C:\WINDOWS\System32\ControlWZCS.exe
[2011/04/07 17:46:23 | 000,218,003 | —- | C] () – C:\WINDOWS\dssec.dat
[2011/04/07 17:46:23 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2011/04/07 17:46:23 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\acs.exe
[2011/04/07 17:33:17 | 000,128,113 | —- | C] () – C:\WINDOWS\System32\csellang.ini
[2011/04/07 17:33:17 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\csellang.dll
[2011/04/07 17:33:17 | 000,010,165 | —- | C] () – C:\WINDOWS\System32\tosmreg.ini
[2011/04/07 17:33:17 | 000,007,671 | —- | C] () – C:\WINDOWS\System32\cseltbl.ini
[2011/04/07 17:32:33 | 000,006,528 | —- | C] () – C:\WINDOWS\System32\drivers\Tbiosdrv.sys
[2007/02/03 07:59:04 | 000,050,127 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2004/09/02 09:15:57 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/09/02 08:33:41 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/09/02 08:13:04 | 000,000,000 | —- | C] () – C:\WINDOWS\NDSTray.INI
[2004/09/02 08:12:35 | 000,045,163 | —- | C] () – C:\WINDOWS\System32\javaw.exe
[2004/09/02 08:12:35 | 000,045,161 | —- | C] () – C:\WINDOWS\System32\java.exe
[2004/09/02 08:10:55 | 000,000,138 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/09/02 08:10:04 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2004/09/02 08:10:04 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2004/09/02 08:10:04 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2004/09/02 08:10:04 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2004/09/02 08:10:04 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2004/09/02 08:10:04 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2004/09/02 08:06:23 | 000,000,000 | —- | C] () – C:\WINDOWS\TPTray.INI
[2004/09/01 23:30:55 | 000,000,000 | —- | C] () – C:\WINDOWS\CeEKey.INI
[2004/09/01 23:30:40 | 000,356,352 | —- | C] () – C:\WINDOWS\System32\EMCRI.dll
[2004/09/01 23:28:11 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2004/09/01 23:28:11 | 000,001,048 | —- | C] () – C:\WINDOWS\System32\drivers\alcxinit.dat
[2004/09/01 23:28:11 | 000,000,176 | —- | C] () – C:\WINDOWS\System32\drivers\alcxhweq.dat
[2004/09/01 23:23:18 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/09/01 23:21:58 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/09/01 23:17:12 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/09/01 23:03:29 | 000,385,024 | —- | C] () – C:\WINDOWS\System32\ati2evxx.exe
[2004/09/01 23:03:29 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\ati2evxx.dll
[2004/09/01 23:02:55 | 000,002,388 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2004/09/01 23:02:26 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/09/01 23:02:23 | 000,441,692 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/09/01 23:02:23 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/09/01 23:02:23 | 000,071,462 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/09/01 23:02:23 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/09/01 23:02:23 | 000,004,631 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/09/01 23:02:21 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/09/01 23:02:20 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/09/01 23:02:16 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/09/01 23:02:16 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/09/01 23:02:10 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/09/01 23:02:03 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/09/01 16:12:06 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/09/01 16:11:14 | 003,850,224 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/07/12 06:18:22 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini

========== LOP Check ==========

[2011/08/06 18:20:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\!SASCORE
[2011/12/27 20:10:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2011/10/14 14:42:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG
[2011/08/30 22:29:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/10/07 08:33:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG2012
[2011/08/30 22:33:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Backup
[2011/04/09 08:22:45 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/04/10 21:05:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\magicJack
[2011/12/30 09:11:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/07/11 15:25:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MGS
[2011/11/22 07:56:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Panda Security
[2011/10/19 21:52:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Panda Software
[2011/07/17 14:33:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
[2011/07/17 12:41:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Retrospect
[2011/07/20 08:58:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Samsung
[2011/08/10 06:34:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2011/10/14 23:52:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/07/16 11:34:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2011/10/14 10:54:14 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\AVG
[2011/04/09 08:24:04 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\AVG10
[2011/09/30 16:45:50 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\AVG2012
[2011/08/10 07:27:58 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/12/29 14:19:43 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\Curiolab
[2011/12/29 14:12:35 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\GetRightToGo
[2004/09/02 08:08:28 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\InterTrust
[2011/06/04 20:11:41 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\InterVideo
[2011/12/21 22:46:51 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\mjusbsp
[2011/07/16 11:34:49 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\OpenCandy
[2011/12/28 20:47:29 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\OpenOffice.org1.9.79
[2011/11/11 15:18:51 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\SmartDraw
[2004/09/02 08:11:02 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\toshiba
[2011/04/22 12:18:28 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\Trillian
[2011/08/03 17:29:44 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\Unity
[2011/11/24 17:49:05 | 000,000,284 | —- | M] () – C:\WINDOWS\Tasks\expressburnShakeIcon.job
[2011/11/21 08:12:03 | 000,000,272 | —- | M] () – C:\WINDOWS\Tasks\photopadShakeIcon.job
[2011/04/07 17:45:57 | 000,000,258 | —- | M] () – C:\WINDOWS\Tasks\Registration reminder 1.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2004/09/01 23:19:26 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2011/04/07 17:46:00 | 000,000,211 | —- | M] () – C:\Boot.bak
[2011/08/16 20:52:04 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2004/08/03 22:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2004/09/01 23:19:26 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2011/12/30 09:05:04 | 1609,617,408 | -HS- | M] () – C:\hiberfil.sys
[2004/09/01 23:19:26 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2004/09/01 23:19:26 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 04:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2011/08/30 16:09:39 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/12/30 09:05:03 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2011/09/25 08:53:07 | 000,000,232 | -H– | M] () – C:\sqmdata00.sqm
[2011/09/25 16:48:06 | 000,000,232 | -H– | M] () – C:\sqmdata01.sqm
[2011/09/26 08:31:14 | 000,000,232 | -H– | M] () – C:\sqmdata02.sqm
[2011/09/26 19:56:33 | 000,000,232 | -H– | M] () – C:\sqmdata03.sqm
[2011/09/27 05:40:20 | 000,000,232 | -H– | M] () – C:\sqmdata04.sqm
[2011/09/27 15:31:33 | 000,000,232 | -H– | M] () – C:\sqmdata05.sqm
[2011/09/28 05:11:23 | 000,000,232 | -H– | M] () – C:\sqmdata06.sqm
[2011/09/28 15:57:22 | 000,000,232 | -H– | M] () – C:\sqmdata07.sqm
[2011/09/29 06:56:08 | 000,000,232 | -H– | M] () – C:\sqmdata08.sqm
[2011/09/29 21:28:48 | 000,000,232 | -H– | M] () – C:\sqmdata09.sqm
[2011/09/30 05:28:09 | 000,000,232 | -H– | M] () – C:\sqmdata10.sqm
[2011/09/30 15:13:42 | 000,000,232 | -H– | M] () – C:\sqmdata11.sqm
[2011/09/22 17:33:36 | 000,000,232 | -H– | M] () – C:\sqmdata12.sqm
[2011/09/22 22:11:35 | 000,000,232 | -H– | M] () – C:\sqmdata13.sqm
[2011/09/23 09:38:21 | 000,000,232 | -H– | M] () – C:\sqmdata14.sqm
[2011/09/23 09:55:56 | 000,000,232 | -H– | M] () – C:\sqmdata15.sqm
[2011/09/23 14:46:42 | 000,000,232 | -H– | M] () – C:\sqmdata16.sqm
[2011/09/23 14:53:18 | 000,000,232 | -H– | M] () – C:\sqmdata17.sqm
[2011/09/23 21:36:05 | 000,000,232 | -H– | M] () – C:\sqmdata18.sqm
[2011/09/24 09:07:57 | 000,000,232 | -H– | M] () – C:\sqmdata19.sqm
[2011/09/25 08:53:07 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2011/09/25 16:48:06 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2011/09/26 08:31:14 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2011/09/26 19:56:33 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2011/09/27 05:40:20 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2011/09/27 15:31:32 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2011/09/28 05:11:22 | 000,000,244 | -H– | M] () – C:\sqmnoopt06.sqm
[2011/09/28 15:57:22 | 000,000,244 | -H– | M] () – C:\sqmnoopt07.sqm
[2011/09/29 06:56:08 | 000,000,244 | -H– | M] () – C:\sqmnoopt08.sqm
[2011/09/29 21:28:48 | 000,000,244 | -H– | M] () – C:\sqmnoopt09.sqm
[2011/09/30 05:28:09 | 000,000,244 | -H– | M] () – C:\sqmnoopt10.sqm
[2011/09/30 15:13:42 | 000,000,244 | -H– | M] () – C:\sqmnoopt11.sqm
[2011/09/22 17:33:36 | 000,000,244 | -H– | M] () – C:\sqmnoopt12.sqm
[2011/09/22 22:11:35 | 000,000,244 | -H– | M] () – C:\sqmnoopt13.sqm
[2011/09/23 09:38:21 | 000,000,244 | -H– | M] () – C:\sqmnoopt14.sqm
[2011/09/23 09:55:56 | 000,000,244 | -H– | M] () – C:\sqmnoopt15.sqm
[2011/09/23 14:46:42 | 000,000,244 | -H– | M] () – C:\sqmnoopt16.sqm
[2011/09/23 14:53:17 | 000,000,244 | -H– | M] () – C:\sqmnoopt17.sqm
[2011/09/23 21:36:04 | 000,000,244 | -H– | M] () – C:\sqmnoopt18.sqm
[2011/09/24 09:07:56 | 000,000,244 | -H– | M] () – C:\sqmnoopt19.sqm
[2011/10/07 08:26:51 | 001,743,600 | —- | M] () – C:\TPSLog.txt
[2011/08/02 14:59:15 | 000,000,152 | -HS- | M] () – C:\WDRetrospect.dat

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/09/01 23:18:47 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 04:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 02:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2003/10/22 22:17:52 | 000,053,248 | —- | M] (TOSHIBA) – C:\WINDOWS\cfdemo.scr
[2010/04/17 00:04:40 | 000,306,032 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WLXPGSS.SCR
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/09/01 16:10:54 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2004/09/01 16:10:54 | 000,634,880 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2004/09/01 16:10:54 | 000,876,544 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2011/08/30 16:25:43 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/08/30 17:18:25 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\b\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2004/09/01 23:23:07 | 000,000,079 | —- | M] () – C:\Documents and Settings\b\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2003/08/16 11:00:00 | 000,288,256 | —- | M] (Marathon Computer Press) – C:\Documents and Settings\b\Desktop\WipePro.Exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-12-15 08:41:55

========== Alternate Data Streams ==========

@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4

< End of report >

OTL Extras logfile created on: 12/30/2011 9:59:18 AM - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\b\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.50 Gb Total Physical Memory | 0.67 Gb Available Physical Memory | 44.54% Memory free
3.35 Gb Paging File | 2.40 Gb Available in Paging File | 71.54% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 56.18 Gb Free Space | 75.38% Space Free | Partition Type: NTFS

Computer Name: A | User Name: b | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
InternetShortcut [open] – rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] – G:\Adobe InDesign Cs5\Adobe Bridge CS5\Bridge.exe "%L"
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
"DisableMonitoring" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
"DisableMonitoring" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Documents and Settings\b\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\b\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin – (Google)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"C:\Program Files\AVG\AVG2012\avgmfapx.exe" = C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:AVG Installer – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Panda Security\Panda Global Protection 2012\ApVxdWin.exe" = C:\Program Files\Panda Security\Panda Global Protection 2012\ApVxdWin.exe:*:Disabled:Panda permanent protection
"C:\WINDOWS\system32\javaw.exe" = C:\WINDOWS\system32\javaw.exe:*:Enabled:javaw – ()
"C:\Documents and Settings\b\Application Data\mjusbsp\magicJack.exe" = C:\Documents and Settings\b\Application Data\mjusbsp\magicJack.exe:*:Enabled:magicJack – (magicJack L.P.)
"C:\Program Files\AVG\AVG2012\avgnsx.exe" = C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Online Shield – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2012\avgdiagex.exe" = C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostics 2012 – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2012\avgemcx.exe" = C:\Program Files\AVG\AVG2012\avgemcx.exe:*:Enabled:Personal E-mail Scanner – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\eMule\emule.exe" = C:\Program Files\eMule\emule.exe:*:Enabled:eMule


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0
"{02EED746-8C5A-43C8-BB3D-D29C8B363A4D}" = TOSHIBA Zooming Hotkey Hook
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{16DABD39-A174-4C6B-A2C4-A492E64933C8}" = AVG 2012
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F63ED0B-EDD2-4037-B6AB-1358C624AF48}" = Scan
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2FCE4FC5-6930-40E7-A4F1-F862207424EF}" = InterVideo WinDVD Creator 2
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3CF0858D-1AC5-4308-9DE7-AD15288A8BDC}" = TOSHIBA Console
"{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0
"{4447D5B5-95ED-4C4D-A9C3-1D8E892D5377}" = AVG 2012
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4E74D41C-5864-4561-9F6B-069372513A0B}" = AVG 2012
"{50316C0A-CC2A-460A-9EA5-F486E54AC17D}_is1" = AVG PC Tuneup 2011
"{59FDFDFB-52FE-45B1-8A2A-A00079B07FF0}" = TOSHIBA Power Saver Driver
"{5BCA8D15-BCB6-421E-9654-238B43456A4F}" = TOSHIBA Controls Driver
"{5CF6EEE9-86B1-3DB6-A07C-8F6C079C39BA}" = Google Talk Plugin
"{5D96E2B1-D9AC-46E0-9073-425C5F63E338}" = Touch and Launch
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{64212898-097F-4F3F-AECA-6D34A7EF82DF}" = TOSHIBA Zooming Utility
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7148F0A8-6813-11D6-A77B-00B0D0142050}" = Java 2 Runtime Environment, SE v1.4.2_05
"{71D658CF-4E0D-4DA8-AA67-8C0B6F1C01FE}" = Atheros Client Utility
"{730E03E4-350E-48E5-9D3E-4329903D454D}" = Itibiti RTC
"{73B69C5C-87D6-471E-B695-0BD736C4B644}" = Retrospect 6.5
"{7D004944-C4F1-4C44-AAD4-E7F85190ED00}" = AVG 2012
"{80F28669-97B7-4CC9-B256-1F1BCFB7FDCF}" = AVG 2012
"{8398852A-7B61-4808-8F58-D0A40D1B2CB6}" = AVG 2012
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD for TOSHIBA
"{91A10409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office OneNote 2003
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{97AA0C55-AFAD-4126-B21C-F1318FB6DADA}" = Realtek Fast Ethernet Adapter Driver
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D765FA6-F2BC-40AF-8145-50808F9BDF4E}" = DVD-RAM Driver
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A1062847-0846-427A-92A1-BB8251A91E91}" = HP PSC & OfficeJet 4.2
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3DDA019-40B7-491C-AC88-62B94491FE8A}" = TouchPad On/Off Utility
"{A4EA3AB4-E78C-4286-96DF-26035507CE55}" = AiO_Scan
"{A6690C0E-B96E-4F0F-A8EB-D5B332454AC6}" = TOSHIBA Controls
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1940CF0-E2DD-11E0-BB25-B8AC6F97B88E}" = Google Earth
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C3}" = WinZip 15.5
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{D9789BA3-4033-4D81-9B10-7EE99EFA4691}" = OpenOffice.org 1.9.79
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E171F5DA-6F17-472D-A223-92468142C5E8}" = AVG 2012
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications
"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F9450605-65E7-45E4-B071-BD759E10F072}" = TOSHIBA Hotkey Utility
"{F9766AC1-1461-1033-B862-DF8FE1C033BE}" = Adobe InDesign CS5
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"AVG" = AVG 2012
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"ExpressBurn" = Express Burn Disc Burning Software
"ffdshow_is1" = ffdshow [rev 3124] [2009-11-03]
"HP Photo & Imaging" = HP Image Zone 4.2
"InstallShield_{A3DDA019-40B7-491C-AC88-62B94491FE8A}" = TouchPad On/Off Utility
"InstallShield_{F9450605-65E7-45E4-B071-BD759E10F072}" = TOSHIBA Hotkey Utility
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSNINST" = MSN
"PC Diagnostic Tool" = TOSHIBA PC Diagnostic Tool
"PhotoPad" = PhotoPad Image Editor
"Power Saver" = TOSHIBA Power Saver
"Security Task Manager" = Security Task Manager 1.8d
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"Toshiba Tbiosdrv Driver" = Toshiba Tbiosdrv Driver
"Trillian" = Trillian
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"Xvid_is1" = Xvid 1.2.2 final uninstall
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Search Defender" = Yahoo! Search Protection
"Yahoo! Software Update" = Yahoo! Software Update
"ZoomPlayer" = Zoom Player (remove only)

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"magicJack" = magicJack
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/13/2011 1:31:43 PM | Computer Name = A | Source = MsiInstaller | ID = 1013
Description = SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2012 – SA_Error25101:
StandardAction(0xC007620D): We have detected that avast! Free Antivirus, is already
installed on your system, therefore the installation can not continue. We recommend
that you uninstall this product first and then try to launch the installation again.

Error - 12/13/2011 1:31:48 PM | Computer Name = A | Source = MsiInstaller | ID = 1013
Description = SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2012 – SA_Error25101:
StandardAction(0xC007620D): We have detected that avast! Free Antivirus, is already
installed on your system, therefore the installation can not continue. We recommend
that you uninstall this product first and then try to launch the installation again.

Error - 12/22/2011 12:33:48 PM | Computer Name = A | Source = MsiInstaller | ID = 11719
Description = SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2012 – Error
1719. SA_Error1719: StandardAction(0xC00706B7): The Windows Installer Service could
not be accessed. This can occur if you are running Windows in safe mode, or if
the Windows Installer is not correctly installed. Contact your support personnel
for assistance.

Error - 12/22/2011 4:38:47 PM | Computer Name = A | Source = MsiInstaller | ID = 1013
Description = SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2012 – SA_Error25101:
StandardAction(0xC007620D): We have detected that avast! Free Antivirus, is already
installed on your system, therefore the installation can not continue. We recommend
that you uninstall this product first and then try to launch the installation again.

Error - 12/22/2011 4:39:03 PM | Computer Name = A | Source = MsiInstaller | ID = 1013
Description = SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2012 – SA_Error25101:
StandardAction(0xC007620D): We have detected that avast! Free Antivirus, is already
installed on your system, therefore the installation can not continue. We recommend
that you uninstall this product first and then try to launch the installation again.

Error - 12/22/2011 4:39:19 PM | Computer Name = A | Source = MsiInstaller | ID = 1013
Description = SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2012 – SA_Error25101:
StandardAction(0xC007620D): We have detected that avast! Free Antivirus, is already
installed on your system, therefore the installation can not continue. We recommend
that you uninstall this product first and then try to launch the installation again.

Error - 12/22/2011 4:39:37 PM | Computer Name = A | Source = MsiInstaller | ID = 1013
Description = SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2012 – SA_Error25101:
StandardAction(0xC007620D): We have detected that avast! Free Antivirus, is already
installed on your system, therefore the installation can not continue. We recommend
that you uninstall this product first and then try to launch the installation again.

Error - 12/22/2011 4:39:53 PM | Computer Name = A | Source = MsiInstaller | ID = 1013
Description = SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2012 – SA_Error25101:
StandardAction(0xC007620D): We have detected that avast! Free Antivirus, is already
installed on your system, therefore the installation can not continue. We recommend
that you uninstall this product first and then try to launch the installation again.

Error - 12/27/2011 5:48:24 AM | Computer Name = A | Source = .NET Runtime | ID = 1023
Description = Application: chrome.exe CoreCLR Version: 4.0.60831.0 Description: The
process was terminated due to an internal error in the .NET Runtime at IP 7928D2A6
(79150000) with exit code 8013150a.

Error - 12/27/2011 5:48:31 AM | Computer Name = A | Source = Application Error | ID = 1000
Description = Faulting application chrome.exe, version 16.0.912.63, faulting module
coreclr.dll, version 4.0.60831.0, fault address 0x0013d2a6.

[ System Events ]
Error - 12/7/2011 5:14:30 PM | Computer Name = A | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 12/7/2011 5:14:30 PM | Computer Name = A | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 12/8/2011 3:28:05 AM | Computer Name = A | Source = Service Control Manager | ID = 7000
Description = The Google Update Service (gupdate) service failed to start due to
the following error: %%1115

Error - 12/8/2011 3:28:05 AM | Computer Name = A | Source = DCOM | ID = 10005
Description = DCOM got error "%1115" attempting to start the service gupdate with
arguments "/comsvc" in order to run the server: {4EB61BAC-A3B6-4760-9581-655041EF4D69}

Error - 12/21/2011 9:25:48 PM | Computer Name = A | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC000009A'
while processing the file 'kmz' on the volume 'HarddiskVolume1'. It has stopped
monitoring the volume.

Error - 12/22/2011 6:02:33 PM | Computer Name = A | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000001'
while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring
the volume.

Error - 12/23/2011 7:30:57 PM | Computer Name = A | Source = WPDClassInstaller | ID = 90624
Description = It was not possible to install drivers for the device USB\Vid_04e8&Pid;_68a9&Rev;_0400.
Error code 0xe0000217.

Error - 12/27/2011 1:56:34 AM | Computer Name = A | Source = Service Control Manager | ID = 7034
Description = The Yahoo! Updater service terminated unexpectedly. It has done this
1 time(s).

Error - 12/28/2011 12:14:21 AM | Computer Name = A | Source = Service Control Manager | ID = 7031
Description = The InstallBrain Updater Service service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in 30000
milliseconds: Restart the service.

Error - 12/28/2011 6:17:12 PM | Computer Name = A | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000001'
while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring
the volume.


< End of report >

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 4/7/2011 6:46:37 PM
System Uptime: 12/30/2011 9:04:23 AM (1 hours ago)
.
Motherboard: TOSHIBA | | EEQ00/EFQ00
Processor: Mobile Intel® Pentium® 4 CPU 3.06GHz | NWD | 3066/mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 75 GiB total, 56.148 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP74: 12/21/2011 5:26:13 PM - Software Distribution Service 3.0
RP75: 12/22/2011 4:09:56 AM - System Checkpoint
RP76: 12/23/2011 10:13:41 PM - System Checkpoint
RP77: 12/27/2011 8:10:33 PM - avast! Free Antivirus Setup
RP78: 12/29/2011 11:05:18 AM - System Checkpoint
RP79: 12/30/2011 10:01:24 AM - OTL Restore Point - 12/30/2011 10:01:19 AM
.
==== Installed Programs ======================
.
Adobe Acrobat 5.0
Adobe AIR
Adobe Community Help
Adobe Flash Player 10 ActiveX
Adobe InDesign CS5
Adobe Media Player
AiO_Scan
ALPS Touch Pad Driver
Atheros Client Utility
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
AVG 2012
AVG PC Tuneup 2011
CD/DVD Drive Acoustic Silencer
DVD-RAM Driver
Express Burn Disc Burning Software
ffdshow [rev 3124] [2009-11-03]
Google Chrome
Google Earth
Google Talk Plugin
Google Update Helper
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
HP Image Zone 4.2
HP PSC & OfficeJet 4.2
InterVideo WinDVD Creator 2
InterVideo WinDVD for TOSHIBA
Itibiti RTC
Java 2 Runtime Environment, SE v1.4.2_05
Junk Mail filter update
magicJack
Malwarebytes' Anti-Malware version 1.51.1.1800
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2572067)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office OneNote 2003
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft_VC80_ATL_x86
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
MSN
MSVCRT
OpenOffice.org 1.9.79
PDF Settings CS5
PhotoPad Image Editor
QFolder
Realtek AC'97 Audio
Realtek Fast Ethernet Adapter Driver
Retrospect 6.5
SAMSUNG USB Driver for Mobile Phones
Scan
Security Task Manager 1.8d
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2618444)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Segoe UI
Sonic DLA
Sonic RecordNow!
SUPERAntiSpyware
TOSHIBA ConfigFree
TOSHIBA Console
TOSHIBA Controls
TOSHIBA Controls Driver
TOSHIBA Hotkey Utility
TOSHIBA PC Diagnostic Tool
TOSHIBA Power Saver
TOSHIBA Power Saver Driver
TOSHIBA Software Modem
TOSHIBA Speech System Applications
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
Toshiba Tbiosdrv Driver
TOSHIBA Zooming Hotkey Hook
TOSHIBA Zooming Utility
Touch and Launch
TouchPad On/Off Utility
Trillian
Unity Web Player
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB2641690)
Update for Windows XP (KB961503)
WebFldrs XP
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows XP Service Pack 3
WinZip 15.5
Xvid 1.2.2 final uninstall
Yahoo! Messenger
Yahoo! Search Protection
Yahoo! Software Update
Yahoo! Toolbar
Zoom Player (remove only)
.
==== Event Viewer Messages From Past Week ========
.
12/28/2011 2:17:12 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
12/27/2011 8:14:21 PM, error: Service Control Manager [7031] - The InstallBrain Updater Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
12/26/2011 9:56:34 PM, error: Service Control Manager [7034] - The Yahoo! Updater service terminated unexpectedly. It has done this 1 time(s).
12/23/2011 3:30:57 PM, error: WPDClassInstaller [25088] - It was not possible to install drivers for the device USB\Vid_04e8&Pid;_68a9&Rev;_0400. Error code 0xe0000217.
.
==== End Of File ===========================

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 6.0.2900.5512
Run by [removed] at 10:32:21 on 2011-12-30
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1535.531 [GMT -8:00]
.
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\Program Files\AVG\AVG2012\avgrsx.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\ACS.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\System32\ZoomingHook.exe
C:\WINDOWS\System32\TCtrlIOHook.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Apoint2K\Apntex.exe
svchost.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\AVG\AVG2012\avgwdsvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\Program Files\AVG\AVG2012\avgnsx.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\Program Files\AVG\AVG2012\avgemcx.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\b\My Documents\Downloads\OTL (1).exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\notepad.exe
C:\Documents and Settings\b\My Documents\Downloads\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\internet explorer\iexplore.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uSearchAssistant = hxxp://dts.search-results.com/sr?src=ieb&appid;=119&systemid;=406&q;={searchTerms}
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
uURLSearchHooks: H - No File
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
mURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
BHO: &Yahoo;! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx
BHO: Yahooo Search Protection: {25bc7718-0bfa-40ea-b381-4b2d9732d686} - c:\program files\yahoo!\search protection\ysp.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\toscdspd.exe
uRun: [cdloader] "c:\documents and settings\b\application data\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Google Update] "c:\documents and settings\b\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [CeEKEY] c:\program files\toshiba\e-key\CeEKey.exe
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [TPNF] c:\program files\toshiba\touchpad\TPTray.exe
mRun: [NDSTray.exe] NDSTray.exe
mRun: [ZoomingHook] c:\windows\system32\ZoomingHook.exe
mRun: [TCtryIOHook] c:\windows\system32\TCtrlIOHook.exe
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [PadTouch] c:\program files\toshiba\touch and launch\PadExe.exe
mRun: [SmoothView] c:\program files\toshiba\toshiba zooming utility\SmoothView.exe
mRun: [TFncKy] TFncKy.exe
mRun: [LtMoh] c:\\program files\\ltmoh\\Ltmoh.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [WD Button Manager] WDBtnMgr.exe
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"
dRunOnce: [WUAppSetup] c:\program files\common files\logishrd\WUApp32.exe -v 0x046d -p 0x08b2 -f video -m logitech -d 10.5.1.2023
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - c:\program files\yahoo!\search protection\ysp.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
TCP: DhcpNameServer = [removed] [removed] [removed]
TCP: Interfaces\{FA45BDE3-54B5-4737-BA88-B1F605D31D42} : DhcpNameServer = [removed] [removed] [removed]
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-7-11 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-7-11 230608]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 295248]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2011-7-18 116608]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-10-12 4433248]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-7-11 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-7-11 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-7-11 16720]
S0 rebllw;rebllw;c:\windows\system32\drivers\sxsrtabj.sys –> c:\windows\system32\drivers\sxsrtabj.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-7-20 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-7-20 136176]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-8-6 22712]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [2011-7-20 96488]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [2011-7-20 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [2011-7-20 121576]
S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S4 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-8-6 366640]
.
=============== Created Last 30 ================
.
2011-12-29 22:19:43 ——– d—–w- c:\documents and settings\b\application data\Curiolab
2011-12-29 22:09:47 ——– d—–w- c:\documents and settings\b\application data\GetRightToGo
2011-12-06 16:15:17 ——– d—–w- c:\documents and settings\b\local settings\application data\PCHealth
2011-12-06 07:19:18 ——– d—–w- c:\windows\system32\XPSViewer
2011-12-06 07:18:25 89088 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
2011-12-06 07:17:55 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2011-12-06 07:17:55 117760 ——w- c:\windows\system32\prntvpt.dll
2011-12-06 07:17:54 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2011-12-06 07:17:54 597504 ——w- c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2011-12-06 07:17:54 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2011-12-06 07:17:54 575488 ——w- c:\windows\system32\xpsshhdr.dll
2011-12-06 07:17:53 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2011-12-06 07:17:53 1676288 ——w- c:\windows\system32\xpssvcs.dll
2011-12-06 07:17:52 ——– d—–w- C:\1f06b41c5dfa3f6ae26115eb697bf52a
2011-12-03 16:07:40 274288 —-a-w- c:\windows\system32\mucltui.dll
2011-12-03 16:07:40 215920 —-a-w- c:\windows\system32\muweb.dll
2011-12-03 16:07:40 16736 —-a-w- c:\windows\system32\mucltui.dll.mui
2011-12-02 22:57:39 ——– d—–w- c:\documents and settings\b\Tracing
2011-12-02 20:13:52 3426072 —-a-w- c:\windows\system32\d3dx9_32.dll
2011-12-02 20:13:28 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2011-12-02 20:10:04 ——– d—–w- c:\program files\Microsoft
2011-12-02 20:09:22 ——– d—–w- c:\program files\Windows Live SkyDrive
2011-12-02 20:07:08 23510720 —-a-w- c:\program files\common files\windows live\.cache\f805f94c1ccb12d\dotnetfx.exe
2011-12-02 20:05:27 484632 —-a-w- c:\program files\common files\windows live\.cache\b90030461ccb12d\DXSETUP.exe
2011-12-02 20:05:23 1670936 —-a-w- c:\program files\common files\windows live\.cache\b90030461ccb12d\dsetup32.dll
2011-12-02 20:05:22 74520 —-a-w- c:\program files\common files\windows live\.cache\b90030461ccb12d\DSETUP.dll
2011-12-02 20:05:15 1013800 —-a-w- c:\program files\common files\windows live\.cache\b4c5c4aa1ccb12d\WindowsXP-KB954708-x86-ENU.exe
2011-12-02 19:54:52 ——– d—–w- c:\program files\common files\Windows Live
.
==================== Find3M ====================
.
2011-11-23 13:25:32 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-01 20:35:20 81920 —-a-w- c:\windows\system32\ieencode.dll
2011-11-01 20:35:20 667136 —-a-w- c:\windows\system32\wininet.dll
2011-11-01 20:35:20 61952 —-a-w- c:\windows\system32\tdc.ocx
2011-11-01 16:07:10 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-11-01 15:02:49 369664 —-a-w- c:\windows\system32\html.iec
2011-10-28 05:31:48 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37:08 2148864 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52:02 2027008 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13:22 186880 —-a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22:41 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-10-07 13:23:48 230608 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2011-10-04 13:21:42 16720 —-a-w- c:\windows\system32\drivers\AVGIDSShim.sys
.
============= FINISH: 10:32:53.68 ===============

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:11:14 AM, on 12/30/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\Program Files\AVG\AVG2012\avgrsx.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ACS.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\System32\ZoomingHook.exe
C:\WINDOWS\System32\TCtrlIOHook.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\AVG\AVG2012\avgwdsvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\Program Files\AVG\AVG2012\avgnsx.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\Program Files\AVG\AVG2012\avgemcx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\b\My Documents\Downloads\OTL (1).exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\notepad.exe
C:\Documents and Settings\b\My Documents\Downloads\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://dts.search-results.com/sr?src=ieb&a;…q={searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo;! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: YSPManager - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [ZoomingHook] c:\WINDOWS\System32\ZoomingHook.exe
O4 - HKLM\..\Run: [TCtryIOHook] c:\WINDOWS\System32\TCtrlIOHook.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [LtMoh] C:\\Program Files\\ltmoh\\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe"
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\b\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\b\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x08b2 -f video -m logitech -d 10.5.1.2023 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x08b2 -f video -m logitech -d 10.5.1.2023 (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll
O9 - Extra 'Tools' menuitem: Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Spin Palace Casino - Ž`__ø÷÷876¸µµÛÚÚhhg˜——@??íë멦¦PPOÊÅÅ,,,€ÿ - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 10788 bytes
Thank U for your help

Hi Jason1970,



My name is NoodleTech. I would be glad to assist you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• Please be aware that removing malware is not without risk and while unrecoverable damage to systems is rare, it can happen and may require a re-format and re-install of your operating system. Because of this it is a good idea to back-up anything important saved on your computer.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Do not delete anything unless instructed to.
• DO NOT use tools such as ComboFix without supervision.
• Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clean.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.
• Failure to respond within 3 days will result in this topic being closed - If you need more time to complete the steps required, please let me know.

===================================================

Please download aswMBR.exe and save it to your desktop. 

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click Scan

• Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review.
• Note - do NOT attempt any Fix yet.
• You will also notice another file created on the desktop named MBR.dat.
• Right click that file and select Send To>Compressed (zipped) file.
• Attach that zipped file in your next reply as well.

===================================================

Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• Press Start Scan.
  
  • If Malicious objects are found, DO NOT cure them.
  • Choose Skip then click on Continue.
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

here is the combofix log

ComboFix 11-12-31.03 - b 12/31/2011 9:49.4.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1535.970 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\b\System
c:\documents and settings\b\System\win_qs8.jqx
c:\windows\system32\Cache
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\8404fb3aff0d0ef5.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\OLD11.tmp
c:\windows\system32\OLD15.tmp
c:\windows\system32\OLD19.tmp
c:\windows\system32\SET115.tmp
c:\windows\system32\SET119.tmp
c:\windows\system32\SET11A.tmp
c:\windows\system32\SET121.tmp
.
.
((((((((((((((((((((((((( Files Created from 2011-11-28 to 2011-12-31 )))))))))))))))))))))))))))))))
.
.
2011-12-29 22:19 . 2011-12-29 22:19 ——– d—–w- c:\documents and settings\b\Application Data\Curiolab
2011-12-29 22:09 . 2011-12-29 22:12 ——– d—–w- c:\documents and settings\b\Application Data\GetRightToGo
2011-12-28 03:31 . 2008-04-14 00:12 26624 —-a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2011-12-06 16:15 . 2011-12-06 16:15 ——– d—–w- c:\documents and settings\b\Local Settings\Application Data\PCHealth
2011-12-06 07:19 . 2011-12-06 07:19 ——– d—–w- c:\windows\system32\XPSViewer
2011-12-06 07:19 . 2011-12-06 07:19 ——– d—–w- c:\program files\MSBuild
2011-12-06 07:18 . 2011-12-06 07:18 ——– d—–w- c:\program files\Reference Assemblies
2011-12-06 07:18 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2011-12-06 07:17 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2011-12-06 07:17 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2011-12-06 07:17 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2011-12-06 07:17 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2011-12-06 07:17 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2011-12-06 07:17 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2011-12-06 07:17 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2011-12-06 07:17 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2011-12-06 07:17 . 2011-12-06 07:18 ——– d—–w- C:\1f06b41c5dfa3f6ae26115eb697bf52a
2011-12-03 16:07 . 2009-08-07 03:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2011-12-03 16:07 . 2009-08-07 03:23 215920 —-a-w- c:\windows\system32\muweb.dll
2011-12-02 22:57 . 2011-12-31 17:12 ——– d—–w- c:\documents and settings\b\Tracing
2011-12-02 20:13 . 2006-11-29 21:06 3426072 —-a-w- c:\windows\system32\d3dx9_32.dll
2011-12-02 20:13 . 2011-12-02 20:13 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2011-12-02 20:10 . 2011-12-02 20:10 ——– d—–w- c:\program files\Microsoft
2011-12-02 20:09 . 2011-12-02 20:09 ——– d—–w- c:\program files\Windows Live SkyDrive
2011-12-02 20:08 . 2011-12-02 20:27 ——– d—–w- c:\program files\Windows Live
2011-12-02 19:54 . 2011-12-02 19:54 ——– d—–w- c:\program files\Common Files\Windows Live
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-23 13:25 . 2004-09-02 07:02 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-01 20:35 . 2004-09-02 07:02 667136 —-a-w- c:\windows\system32\wininet.dll
2011-11-01 20:35 . 2004-09-02 07:02 61952 —-a-w- c:\windows\system32\tdc.ocx
2011-11-01 20:35 . 2004-09-02 07:02 81920 —-a-w- c:\windows\system32\ieencode.dll
2011-11-01 16:07 . 2004-09-02 07:02 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-11-01 15:02 . 2004-09-02 07:02 369664 —-a-w- c:\windows\system32\html.iec
2011-10-28 05:31 . 2004-09-02 07:02 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37 . 2004-09-02 07:02 2148864 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2004-08-03 22:59 2027008 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13 . 2004-09-02 07:02 186880 —-a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22 . 2004-09-02 07:17 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-10-07 13:23 . 2011-07-11 08:13 230608 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2011-10-04 13:21 . 2011-07-11 08:14 16720 —-a-w- c:\windows\system32\drivers\AVGIDSShim.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-05 65536]
"cdloader"="c:\documents and settings\b\Application Data\mjusbsp\cdloader2.exe" [2011-08-23 50592]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-12-28 4616064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-07-11 339968]
"CeEKEY"="c:\program files\TOSHIBA\E-KEY\CeEKey.exe" [2004-08-06 643072]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2003-10-30 192512]
"TPNF"="c:\program files\TOSHIBA\TouchPad\TPTray.exe" [2004-07-28 53248]
"NDSTray.exe"="NDSTray.exe" [BU]
"ZoomingHook"="c:\windows\System32\ZoomingHook.exe" [2004-07-14 24576]
"TCtryIOHook"="c:\windows\System32\TCtrlIOHook.exe" [2004-08-06 28672]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-07-20 122939]
"PadTouch"="c:\program files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-02-03 1089589]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2004-03-02 135168]
"TFncKy"="TFncKy.exe" [BU]
"LtMoh"="c:\\Program Files\\ltmoh\\Ltmoh.exe" [2003-09-26 184320]
"AGRSMMSG"="AGRSMMSG.exe" [2004-02-20 88363]
"WD Button Manager"="WDBtnMgr.exe" [2011-04-08 331776]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-12-03 2415456]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WUAppSetup"="c:\program files\Common Files\logishrd\WUApp32.exe" [2007-02-03 430080]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Documents and Settings\\b\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\WINDOWS\\system32\\javaw.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Documents and Settings\\b\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [7/11/2011 12:14 AM 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [7/11/2011 12:13 AM 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7/11/2011 12:13 AM 230608]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7/11/2011 12:14 AM 295248]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 8:27 AM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 1:55 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [7/18/2011 4:02 PM 116608]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [8/2/2011 5:09 AM 192776]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [7/11/2011 12:14 AM 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [7/11/2011 12:14 AM 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [7/11/2011 12:14 AM 16720]
S0 rebllw;rebllw;c:\windows\system32\drivers\sxsrtabj.sys –> c:\windows\system32\drivers\sxsrtabj.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/20/2011 9:08 AM 136176]
S3 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [10/12/2011 5:25 AM 4433248]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7/20/2011 9:08 AM 136176]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8/6/2011 11:57 AM 22712]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [7/20/2011 9:01 AM 96488]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [7/20/2011 9:01 AM 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [7/20/2011 9:01 AM 121576]
S3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2/19/2010 12:37 PM 517096]
S4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/6/2011 11:58 AM 366640]
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-27 c:\windows\Tasks\AdobeAAMUpdater-1.0-A-b.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-07-17 10:44]
.
2011-12-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-20 17:07]
.
2011-12-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-20 17:07]
.
2011-12-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-495781045-3759577209-3036343489-1006Core.job
- c:\documents and settings\b\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-04-09 16:03]
.
2011-12-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-495781045-3759577209-3036343489-1006UA.job
- c:\documents and settings\b\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-04-09 16:03]
.
2011-04-08 c:\windows\Tasks\Registration reminder 1.job
- c:\windows\system32\OOBE\oobebaln.exe [2004-09-02 00:12]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchAssistant = hxxp://dts.search-results.com/sr?src=ieb&appid=119&systemid=406&q={searchTerms}
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
TCP: DhcpNameServer = [removed] [removed] [removed]
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
AddRemove-ExpressBurn - c:\program files\NCH Software\ExpressBurn\uninst.exe
AddRemove-PhotoPad - c:\program files\NCH Software\PhotoPad\uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-31 10:11
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(808)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
Completion time: 2011-12-31 10:13:31
ComboFix-quarantined-files.txt 2011-12-31 18:13
.
Pre-Run: 60,082,712,576 bytes free
Post-Run: 60,865,351,680 bytes free
.
- - End Of File - - 30CE34E9A64A15DFD3C602D1148DCF34

My bad, had to think for a min, I didn't add the custom scan/fixes b4 this scan

OTL logfile created on: 12/31/2011 6:24:22 PM - Run 2
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\b\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.50 Gb Total Physical Memory | 0.69 Gb Available Physical Memory | 45.83% Memory free
3.35 Gb Paging File | 2.26 Gb Available in Paging File | 67.53% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 56.42 Gb Free Space | 75.71% Space Free | Partition Type: NTFS

Computer Name: A | User Name: b | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Documents and Settings\b\Desktop\aswMBR.exe (AVAST Software)
PRC - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
PRC - C:\Documents and Settings\b\My Documents\Downloads\OTL (1).exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG2012\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\system32\WDBtnMgr.exe (Western Digital Technologies, Inc.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
PRC - C:\WINDOWS\system32\TCtrlIOHook.exe (TOSHIBA)
PRC - C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\ZoomingHook.exe (TOSHIBA)
PRC - C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\WINDOWS\system32\acs.exe ()
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe (TOSHIBA)
PRC - C:\Program Files\Dantz\Retrospect\wdsvc.exe (Dantz Development Corporation)
PRC - C:\Program Files\Dantz\Retrospect\retrorun.exe (Dantz Development Corporation)
PRC - C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
PRC - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
PRC - C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)


========== Modules (No Company Name) ==========

MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\ppgooglenaclpluginchrome.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\pdf.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\libglesv2.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\libegl.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\avutil-51.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\avformat-53.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\avcodec-53.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\gcswf32.dll ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\WINDOWS\system32\devenum.dll ()
MOD - C:\Program Files\Sonic\RecordNow!\shlext.dll ()
MOD - C:\WINDOWS\system32\acs.exe ()
MOD - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()


========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – File not found
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SRV - (avgwd) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (SwitchBoard) – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (ACS) – C:\WINDOWS\system32\acs.exe ()
SRV - (CFSvcs) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (RetroWDSvc) – C:\Program Files\Dantz\Retrospect\wdsvc.exe (Dantz Development Corporation)
SRV - (RetroLauncher) – C:\Program Files\Dantz\Retrospect\retrorun.exe (Dantz Development Corporation)
SRV - (DVD-RAM_Service) – C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)


========== Driver Services (SafeList) ==========

DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (MDC8021X) AEGIS Protocol (IEEE 802.1x) – C:\WINDOWS\system32\drivers\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (ssadmdm) – C:\WINDOWS\system32\drivers\ssadmdm.sys (MCCI Corporation)
DRV - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) – C:\WINDOWS\system32\drivers\ssadbus.sys (MCCI Corporation)
DRV - (ssadmdfl) SAMSUNG Android USB Modem (Filter) – C:\WINDOWS\system32\drivers\ssadmdfl.sys (MCCI Corporation)
DRV - (LVUSBSta) – C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (CamDrL) Logitech QuickCam Pro 3000(CamDrl) – C:\WINDOWS\system32\drivers\Camdrl.sys (Logitech Inc.)
DRV - (TPwSav) – C:\WINDOWS\System32\DRIVERS\TPwSav.sys (TOSHIBA )
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (TCtrlIO) – C:\WINDOWS\system32\drivers\TCtrlIO.sys (TOSHIBA )
DRV - (SrvcSSIOMngr) – C:\WINDOWS\system32\drivers\SSIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (SrvcTPIOMngr) – C:\WINDOWS\system32\drivers\TPIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (SrvcEKIOMngr) – C:\WINDOWS\system32\drivers\EKIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (SerTVOutCtlr) – C:\WINDOWS\system32\drivers\EPIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ESMCR) – C:\WINDOWS\system32\drivers\ESM7SK.sys (ENE Technology Inc.)
DRV - (EMSCR) – C:\WINDOWS\system32\drivers\EMS7SK.sys (ENE Technology Inc.)
DRV - (ESDCR) – C:\WINDOWS\system32\drivers\ESD7SK.sys (ENE Technology Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (AR5211) – C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (ALCXSENS) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (meiudf) – C:\WINDOWS\system32\drivers\meiudf.sys (Matsushita Electric Industrial Co.,Ltd.)
DRV - (caboagp) – C:\WINDOWS\system32\DRIVERS\atisgkaf.sys (ATI Technologies Inc.)
DRV - (Pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (RTL8023) – C:\WINDOWS\system32\drivers\Rtlnic51.sys (Realtek Semiconductor Corporation )
DRV - (Netdevio) – C:\WINDOWS\system32\drivers\Netdevio.sys (TOSHIBA Corporation.)
DRV - (TBiosDrv) – C:\WINDOWS\system32\drivers\Tbiosdrv.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/Acrobat,version=5.1: C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\b\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\b\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\b\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\b\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\b\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG2012\Firefox\ [2011/12/22 12:37:10 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2011/12/22 12:37:20 | 000,000,000 | —D | M]


O1 HOSTS File: ([2011/12/31 10:11:00 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()
O2 - BHO: (Yahooo Search Protection) - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [LtMoh] C:\\Program Files\\ltmoh\\Ltmoh.exe ()
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKLM..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe (TOSHIBA)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TCtryIOHook] C:\WINDOWS\system32\TCtrlIOHook.exe (TOSHIBA)
O4 - HKLM..\Run: [TFncKy] File not found
O4 - HKLM..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [WD Button Manager] C:\WINDOWS\System32\WDBtnMgr.exe (Western Digital Technologies, Inc.)
O4 - HKLM..\Run: [ZoomingHook] C:\WINDOWS\system32\ZoomingHook.exe (TOSHIBA)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\b\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\b\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/09/01 23:19:26 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/31 16:38:44 | 000,248,480 | —- | C] (Adobe Systems, Inc.) – C:\Documents and Settings\b\Desktop\uninstall_flash_player_32bit.exe
[2011/12/31 16:35:36 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Local Settings\Application Data\Sun
[2011/12/31 16:34:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2011/12/31 16:34:42 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2011/12/31 16:33:58 | 000,637,848 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\npdeployJava1.dll
[2011/12/31 16:33:58 | 000,567,184 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2011/12/31 16:33:58 | 000,223,112 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2011/12/31 16:33:58 | 000,173,960 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2011/12/31 16:33:58 | 000,173,960 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2011/12/31 16:33:58 | 000,141,312 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2011/12/31 16:33:33 | 000,000,000 | —D | C] – C:\Program Files\Java
[2011/12/31 16:32:31 | 020,290,952 | —- | C] (Oracle Corporation) – C:\Documents and Settings\b\Desktop\jre-7u2-windows-i586.exe
[2011/12/31 16:29:45 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/12/31 10:13:33 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2011/12/31 09:47:56 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/12/31 09:47:56 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/12/31 09:47:56 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/12/31 09:45:03 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/12/31 09:44:45 | 000,000,000 | —D | C] – C:\Qoobox
[2011/12/31 09:41:41 | 004,358,797 | R— | C] (Swearware) – C:\Documents and Settings\b\Desktop\ComboFix.exe
[2011/12/30 15:21:06 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Desktop\tdsskiller
[2011/12/30 14:36:52 | 004,702,720 | —- | C] (AVAST Software) – C:\Documents and Settings\b\Desktop\aswMBR.exe
[2011/12/30 10:31:49 | 000,607,260 | R— | C] (Swearware) – C:\Documents and Settings\b\Desktop\dds.scr
[2011/12/29 14:19:43 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Application Data\Curiolab
[2011/12/29 14:09:47 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Application Data\GetRightToGo
[2011/12/21 21:11:10 | 000,000,000 | —D | C] – C:\Documents and Settings\b\My Documents\Recipes
[2011/12/06 08:15:17 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Local Settings\Application Data\PCHealth
[2011/12/05 23:19:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2011/12/05 23:19:07 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2011/12/05 23:18:48 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2011/12/05 23:17:55 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2011/12/05 23:17:55 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2011/12/05 23:17:54 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2011/12/05 23:17:54 | 000,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2011/12/05 23:17:53 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2011/12/05 23:17:53 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2011/12/05 23:17:52 | 000,000,000 | —D | C] – C:\1f06b41c5dfa3f6ae26115eb697bf52a
[2011/12/03 08:07:40 | 000,274,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll
[2011/12/03 08:07:40 | 000,016,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll.mui
[2011/12/02 14:57:39 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Tracing
[2011/12/02 12:13:52 | 003,426,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_32.dll
[2011/12/02 12:13:28 | 000,000,000 | —D | C] – C:\Program Files\Microsoft SQL Server Compact Edition
[2011/12/02 12:10:04 | 000,000,000 | —D | C] – C:\Program Files\Microsoft
[2011/12/02 12:09:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\microsoft
[2011/12/02 12:09:22 | 000,000,000 | —D | C] – C:\Program Files\Windows Live SkyDrive
[2011/12/02 12:09:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Live
[2011/12/02 12:08:39 | 000,000,000 | —D | C] – C:\Program Files\Windows Live
[2011/12/02 11:54:52 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2011/04/07 17:46:24 | 000,028,672 | —- | C] ( ) – C:\WINDOWS\System32\ControlACS.exe
[2004/09/01 23:03:29 | 000,131,072 | —- | C] ( ) – C:\WINDOWS\System32\ATIDEMGR.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/31 18:11:39 | 000,000,544 | —- | M] () – C:\Documents and Settings\b\Desktop\MBR.zip
[2011/12/31 18:07:26 | 000,000,512 | —- | M] () – C:\Documents and Settings\b\Desktop\MBR.dat
[2011/12/31 17:36:00 | 000,000,962 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-495781045-3759577209-3036343489-1006UA.job
[2011/12/31 17:28:00 | 000,000,876 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/31 17:15:04 | 085,621,578 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/12/31 17:11:09 | 000,000,872 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/31 17:11:04 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/12/31 17:11:02 | 1609,617,408 | -HS- | M] () – C:\hiberfil.sys
[2011/12/31 16:38:44 | 000,248,480 | —- | M] (Adobe Systems, Inc.) – C:\Documents and Settings\b\Desktop\uninstall_flash_player_32bit.exe
[2011/12/31 16:33:39 | 000,637,848 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npdeployJava1.dll
[2011/12/31 16:33:39 | 000,567,184 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2011/12/31 16:33:39 | 000,223,112 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2011/12/31 16:33:39 | 000,173,960 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2011/12/31 16:33:39 | 000,173,960 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2011/12/31 16:33:39 | 000,141,312 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2011/12/31 16:32:40 | 020,290,952 | —- | M] (Oracle Corporation) – C:\Documents and Settings\b\Desktop\jre-7u2-windows-i586.exe
[2011/12/31 15:36:00 | 000,000,910 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-495781045-3759577209-3036343489-1006Core.job
[2011/12/31 10:11:00 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/12/31 09:41:47 | 004,358,797 | R— | M] (Swearware) – C:\Documents and Settings\b\Desktop\ComboFix.exe
[2011/12/30 15:38:45 | 000,000,754 | —- | M] () – C:\WINDOWS\WORDPAD.INI
[2011/12/30 15:20:17 | 001,558,406 | —- | M] () – C:\Documents and Settings\b\Desktop\tdsskiller.zip
[2011/12/30 14:36:43 | 004,702,720 | —- | M] (AVAST Software) – C:\Documents and Settings\b\Desktop\aswMBR.exe
[2011/12/30 10:31:49 | 000,607,260 | R— | M] (Swearware) – C:\Documents and Settings\b\Desktop\dds.scr
[2011/12/28 18:58:34 | 000,210,961 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/12/28 18:46:40 | 000,144,384 | —- | M] () – C:\Documents and Settings\b\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/27 20:10:36 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2011/12/27 02:00:01 | 000,000,334 | —- | M] () – C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-A-b.job
[2011/12/22 12:37:21 | 000,000,713 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2012.lnk
[2011/12/21 17:58:29 | 000,000,991 | —- | M] () – C:\Documents and Settings\b\Desktop\magicJack.lnk
[2011/12/19 09:28:06 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/12/15 19:42:51 | 000,002,241 | —- | M] () – C:\Documents and Settings\b\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/12/15 19:42:49 | 000,002,263 | —- | M] () – C:\Documents and Settings\b\Desktop\Google Chrome.lnk
[2011/12/15 07:43:39 | 003,850,224 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/15 00:41:38 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/12/07 14:09:40 | 000,000,294 | —- | M] () – C:\Documents and Settings\b\My Documents\lost my give a stuff.xml
[2011/12/06 23:56:04 | 000,441,692 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/12/06 23:56:04 | 000,071,462 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/12/02 21:58:19 | 274,972,672 | —- | M] () – C:\WINDOWS\MEMORY.DMP
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/31 09:47:56 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/12/31 09:47:56 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/12/31 09:47:56 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/12/31 09:45:03 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/12/31 09:45:03 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/12/30 15:38:25 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2011/12/30 15:20:11 | 001,558,406 | —- | C] () – C:\Documents and Settings\b\Desktop\tdsskiller.zip
[2011/12/30 15:18:13 | 000,000,544 | —- | C] () – C:\Documents and Settings\b\Desktop\MBR.zip
[2011/12/30 15:16:27 | 000,000,512 | —- | C] () – C:\Documents and Settings\b\Desktop\MBR.dat
[2011/12/07 14:09:40 | 000,000,294 | —- | C] () – C:\Documents and Settings\b\My Documents\lost my give a stuff.xml
[2011/09/10 12:30:39 | 000,000,000 | —- | C] () – C:\WINDOWS\JDSecure31.INI
[2011/08/05 20:24:47 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\06807e882eed5f29381fe74271ecdccf_c
[2011/06/25 09:49:57 | 000,103,509 | —- | C] () – C:\WINDOWS\hpoins04.dat
[2011/06/25 09:49:57 | 000,017,176 | —- | C] () – C:\WINDOWS\hpomdl04.dat
[2011/06/01 19:57:08 | 000,819,200 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2011/06/01 19:57:08 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2011/06/01 16:27:15 | 000,144,384 | —- | C] () – C:\Documents and Settings\b\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/20 06:40:39 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/04/22 12:21:22 | 000,000,113 | —- | C] () – C:\WINDOWS\(null)toolkit.ini
[2011/04/07 17:46:24 | 000,241,664 | —- | C] () – C:\WINDOWS\System32\ControlWZCS.exe
[2011/04/07 17:46:23 | 000,218,003 | —- | C] () – C:\WINDOWS\dssec.dat
[2011/04/07 17:46:23 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2011/04/07 17:46:23 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\acs.exe
[2011/04/07 17:33:17 | 000,128,113 | —- | C] () – C:\WINDOWS\System32\csellang.ini
[2011/04/07 17:33:17 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\csellang.dll
[2011/04/07 17:33:17 | 000,010,165 | —- | C] () – C:\WINDOWS\System32\tosmreg.ini
[2011/04/07 17:33:17 | 000,007,671 | —- | C] () – C:\WINDOWS\System32\cseltbl.ini
[2011/04/07 17:32:33 | 000,006,528 | —- | C] () – C:\WINDOWS\System32\drivers\Tbiosdrv.sys
[2007/02/03 07:59:04 | 000,050,127 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2004/09/02 09:15:57 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/09/02 08:33:41 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/09/02 08:13:04 | 000,000,000 | —- | C] () – C:\WINDOWS\NDSTray.INI
[2004/09/02 08:10:55 | 000,000,138 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/09/02 08:10:04 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2004/09/02 08:10:04 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2004/09/02 08:10:04 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2004/09/02 08:10:04 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2004/09/02 08:10:04 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2004/09/02 08:10:04 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2004/09/02 08:06:23 | 000,000,000 | —- | C] () – C:\WINDOWS\TPTray.INI
[2004/09/01 23:30:55 | 000,000,000 | —- | C] () – C:\WINDOWS\CeEKey.INI
[2004/09/01 23:30:40 | 000,356,352 | —- | C] () – C:\WINDOWS\System32\EMCRI.dll
[2004/09/01 23:28:11 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2004/09/01 23:28:11 | 000,001,048 | —- | C] () – C:\WINDOWS\System32\drivers\alcxinit.dat
[2004/09/01 23:28:11 | 000,000,176 | —- | C] () – C:\WINDOWS\System32\drivers\alcxhweq.dat
[2004/09/01 23:23:18 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/09/01 23:21:58 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/09/01 23:17:12 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/09/01 23:03:29 | 000,385,024 | —- | C] () – C:\WINDOWS\System32\ati2evxx.exe
[2004/09/01 23:03:29 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\ati2evxx.dll
[2004/09/01 23:02:55 | 000,002,388 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2004/09/01 23:02:26 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/09/01 23:02:23 | 000,441,692 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/09/01 23:02:23 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/09/01 23:02:23 | 000,071,462 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/09/01 23:02:23 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/09/01 23:02:23 | 000,004,631 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/09/01 23:02:21 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/09/01 23:02:20 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/09/01 23:02:16 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/09/01 23:02:16 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/09/01 23:02:10 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/09/01 23:02:03 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/09/01 16:12:06 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/09/01 16:11:14 | 003,850,224 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/07/12 06:18:22 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini

========== LOP Check ==========

[2011/08/06 18:20:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\!SASCORE
[2011/12/27 20:10:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2011/10/14 14:42:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG
[2011/08/30 22:29:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/10/07 08:33:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG2012
[2011/08/30 22:33:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Backup
[2011/04/09 08:22:45 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/04/10 21:05:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\magicJack
[2011/12/31 17:15:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/07/11 15:25:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MGS
[2011/11/22 07:56:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Panda Security
[2011/10/19 21:52:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Panda Software
[2011/07/17 14:33:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
[2011/07/17 12:41:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Retrospect
[2011/07/20 08:58:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Samsung
[2011/08/10 06:34:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2011/07/16 11:34:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2011/10/14 10:54:14 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\AVG
[2011/04/09 08:24:04 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\AVG10
[2011/09/30 16:45:50 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\AVG2012
[2011/08/10 07:27:58 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/12/29 14:19:43 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\Curiolab
[2011/12/29 14:12:35 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\GetRightToGo
[2004/09/02 08:08:28 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\InterTrust
[2011/06/04 20:11:41 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\InterVideo
[2011/12/21 22:46:51 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\mjusbsp
[2011/07/16 11:34:49 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\OpenCandy
[2011/12/28 20:47:29 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\OpenOffice.org1.9.79
[2011/11/11 15:18:51 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\SmartDraw
[2004/09/02 08:11:02 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\toshiba
[2011/04/22 12:18:28 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\Trillian
[2011/08/03 17:29:44 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\Unity
[2011/04/07 17:45:57 | 000,000,258 | —- | M] () – C:\WINDOWS\Tasks\Registration reminder 1.job

========== Purity Check ==========



< End of report >

My bad, had to think for a min, I didn't add the custom scan/fixes b4 this scan

OTL logfile created on: 12/31/2011 6:24:22 PM - Run 2
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\b\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.50 Gb Total Physical Memory | 0.69 Gb Available Physical Memory | 45.83% Memory free
3.35 Gb Paging File | 2.26 Gb Available in Paging File | 67.53% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 56.42 Gb Free Space | 75.71% Space Free | Partition Type: NTFS

Computer Name: A | User Name: b | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Documents and Settings\b\Desktop\aswMBR.exe (AVAST Software)
PRC - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
PRC - C:\Documents and Settings\b\My Documents\Downloads\OTL (1).exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG2012\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\system32\WDBtnMgr.exe (Western Digital Technologies, Inc.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
PRC - C:\WINDOWS\system32\TCtrlIOHook.exe (TOSHIBA)
PRC - C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\ZoomingHook.exe (TOSHIBA)
PRC - C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\WINDOWS\system32\acs.exe ()
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe (TOSHIBA)
PRC - C:\Program Files\Dantz\Retrospect\wdsvc.exe (Dantz Development Corporation)
PRC - C:\Program Files\Dantz\Retrospect\retrorun.exe (Dantz Development Corporation)
PRC - C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
PRC - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
PRC - C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)


========== Modules (No Company Name) ==========

MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\ppgooglenaclpluginchrome.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\pdf.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\libglesv2.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\libegl.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\avutil-51.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\avformat-53.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\avcodec-53.dll ()
MOD - C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\gcswf32.dll ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\WINDOWS\system32\devenum.dll ()
MOD - C:\Program Files\Sonic\RecordNow!\shlext.dll ()
MOD - C:\WINDOWS\system32\acs.exe ()
MOD - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()


========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – File not found
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SRV - (avgwd) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (SwitchBoard) – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (ACS) – C:\WINDOWS\system32\acs.exe ()
SRV - (CFSvcs) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (RetroWDSvc) – C:\Program Files\Dantz\Retrospect\wdsvc.exe (Dantz Development Corporation)
SRV - (RetroLauncher) – C:\Program Files\Dantz\Retrospect\retrorun.exe (Dantz Development Corporation)
SRV - (DVD-RAM_Service) – C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)


========== Driver Services (SafeList) ==========

DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (MDC8021X) AEGIS Protocol (IEEE 802.1x) – C:\WINDOWS\system32\drivers\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (ssadmdm) – C:\WINDOWS\system32\drivers\ssadmdm.sys (MCCI Corporation)
DRV - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) – C:\WINDOWS\system32\drivers\ssadbus.sys (MCCI Corporation)
DRV - (ssadmdfl) SAMSUNG Android USB Modem (Filter) – C:\WINDOWS\system32\drivers\ssadmdfl.sys (MCCI Corporation)
DRV - (LVUSBSta) – C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (CamDrL) Logitech QuickCam Pro 3000(CamDrl) – C:\WINDOWS\system32\drivers\Camdrl.sys (Logitech Inc.)
DRV - (TPwSav) – C:\WINDOWS\System32\DRIVERS\TPwSav.sys (TOSHIBA )
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (TCtrlIO) – C:\WINDOWS\system32\drivers\TCtrlIO.sys (TOSHIBA )
DRV - (SrvcSSIOMngr) – C:\WINDOWS\system32\drivers\SSIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (SrvcTPIOMngr) – C:\WINDOWS\system32\drivers\TPIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (SrvcEKIOMngr) – C:\WINDOWS\system32\drivers\EKIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (SerTVOutCtlr) – C:\WINDOWS\system32\drivers\EPIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ESMCR) – C:\WINDOWS\system32\drivers\ESM7SK.sys (ENE Technology Inc.)
DRV - (EMSCR) – C:\WINDOWS\system32\drivers\EMS7SK.sys (ENE Technology Inc.)
DRV - (ESDCR) – C:\WINDOWS\system32\drivers\ESD7SK.sys (ENE Technology Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (AR5211) – C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (ALCXSENS) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (meiudf) – C:\WINDOWS\system32\drivers\meiudf.sys (Matsushita Electric Industrial Co.,Ltd.)
DRV - (caboagp) – C:\WINDOWS\system32\DRIVERS\atisgkaf.sys (ATI Technologies Inc.)
DRV - (Pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (RTL8023) – C:\WINDOWS\system32\drivers\Rtlnic51.sys (Realtek Semiconductor Corporation )
DRV - (Netdevio) – C:\WINDOWS\system32\drivers\Netdevio.sys (TOSHIBA Corporation.)
DRV - (TBiosDrv) – C:\WINDOWS\system32\drivers\Tbiosdrv.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/Acrobat,version=5.1: C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\b\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\b\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\b\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\b\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\b\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG2012\Firefox\ [2011/12/22 12:37:10 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2011/12/22 12:37:20 | 000,000,000 | —D | M]


O1 HOSTS File: ([2011/12/31 10:11:00 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()
O2 - BHO: (Yahooo Search Protection) - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [LtMoh] C:\\Program Files\\ltmoh\\Ltmoh.exe ()
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKLM..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe (TOSHIBA)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TCtryIOHook] C:\WINDOWS\system32\TCtrlIOHook.exe (TOSHIBA)
O4 - HKLM..\Run: [TFncKy] File not found
O4 - HKLM..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [WD Button Manager] C:\WINDOWS\System32\WDBtnMgr.exe (Western Digital Technologies, Inc.)
O4 - HKLM..\Run: [ZoomingHook] C:\WINDOWS\system32\ZoomingHook.exe (TOSHIBA)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\b\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\b\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/09/01 23:19:26 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/31 16:38:44 | 000,248,480 | —- | C] (Adobe Systems, Inc.) – C:\Documents and Settings\b\Desktop\uninstall_flash_player_32bit.exe
[2011/12/31 16:35:36 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Local Settings\Application Data\Sun
[2011/12/31 16:34:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2011/12/31 16:34:42 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2011/12/31 16:33:58 | 000,637,848 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\npdeployJava1.dll
[2011/12/31 16:33:58 | 000,567,184 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2011/12/31 16:33:58 | 000,223,112 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2011/12/31 16:33:58 | 000,173,960 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2011/12/31 16:33:58 | 000,173,960 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2011/12/31 16:33:58 | 000,141,312 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2011/12/31 16:33:33 | 000,000,000 | —D | C] – C:\Program Files\Java
[2011/12/31 16:32:31 | 020,290,952 | —- | C] (Oracle Corporation) – C:\Documents and Settings\b\Desktop\jre-7u2-windows-i586.exe
[2011/12/31 16:29:45 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/12/31 10:13:33 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2011/12/31 09:47:56 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/12/31 09:47:56 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/12/31 09:47:56 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/12/31 09:45:03 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/12/31 09:44:45 | 000,000,000 | —D | C] – C:\Qoobox
[2011/12/31 09:41:41 | 004,358,797 | R— | C] (Swearware) – C:\Documents and Settings\b\Desktop\ComboFix.exe
[2011/12/30 15:21:06 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Desktop\tdsskiller
[2011/12/30 14:36:52 | 004,702,720 | —- | C] (AVAST Software) – C:\Documents and Settings\b\Desktop\aswMBR.exe
[2011/12/30 10:31:49 | 000,607,260 | R— | C] (Swearware) – C:\Documents and Settings\b\Desktop\dds.scr
[2011/12/29 14:19:43 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Application Data\Curiolab
[2011/12/29 14:09:47 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Application Data\GetRightToGo
[2011/12/21 21:11:10 | 000,000,000 | —D | C] – C:\Documents and Settings\b\My Documents\Recipes
[2011/12/06 08:15:17 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Local Settings\Application Data\PCHealth
[2011/12/05 23:19:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2011/12/05 23:19:07 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2011/12/05 23:18:48 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2011/12/05 23:17:55 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2011/12/05 23:17:55 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2011/12/05 23:17:54 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2011/12/05 23:17:54 | 000,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2011/12/05 23:17:53 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2011/12/05 23:17:53 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2011/12/05 23:17:52 | 000,000,000 | —D | C] – C:\1f06b41c5dfa3f6ae26115eb697bf52a
[2011/12/03 08:07:40 | 000,274,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll
[2011/12/03 08:07:40 | 000,016,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll.mui
[2011/12/02 14:57:39 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Tracing
[2011/12/02 12:13:52 | 003,426,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_32.dll
[2011/12/02 12:13:28 | 000,000,000 | —D | C] – C:\Program Files\Microsoft SQL Server Compact Edition
[2011/12/02 12:10:04 | 000,000,000 | —D | C] – C:\Program Files\Microsoft
[2011/12/02 12:09:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\microsoft
[2011/12/02 12:09:22 | 000,000,000 | —D | C] – C:\Program Files\Windows Live SkyDrive
[2011/12/02 12:09:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Live
[2011/12/02 12:08:39 | 000,000,000 | —D | C] – C:\Program Files\Windows Live
[2011/12/02 11:54:52 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2011/04/07 17:46:24 | 000,028,672 | —- | C] ( ) – C:\WINDOWS\System32\ControlACS.exe
[2004/09/01 23:03:29 | 000,131,072 | —- | C] ( ) – C:\WINDOWS\System32\ATIDEMGR.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/31 18:11:39 | 000,000,544 | —- | M] () – C:\Documents and Settings\b\Desktop\MBR.zip
[2011/12/31 18:07:26 | 000,000,512 | —- | M] () – C:\Documents and Settings\b\Desktop\MBR.dat
[2011/12/31 17:36:00 | 000,000,962 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-495781045-3759577209-3036343489-1006UA.job
[2011/12/31 17:28:00 | 000,000,876 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/31 17:15:04 | 085,621,578 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/12/31 17:11:09 | 000,000,872 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/31 17:11:04 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/12/31 17:11:02 | 1609,617,408 | -HS- | M] () – C:\hiberfil.sys
[2011/12/31 16:38:44 | 000,248,480 | —- | M] (Adobe Systems, Inc.) – C:\Documents and Settings\b\Desktop\uninstall_flash_player_32bit.exe
[2011/12/31 16:33:39 | 000,637,848 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npdeployJava1.dll
[2011/12/31 16:33:39 | 000,567,184 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2011/12/31 16:33:39 | 000,223,112 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2011/12/31 16:33:39 | 000,173,960 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2011/12/31 16:33:39 | 000,173,960 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2011/12/31 16:33:39 | 000,141,312 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2011/12/31 16:32:40 | 020,290,952 | —- | M] (Oracle Corporation) – C:\Documents and Settings\b\Desktop\jre-7u2-windows-i586.exe
[2011/12/31 15:36:00 | 000,000,910 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-495781045-3759577209-3036343489-1006Core.job
[2011/12/31 10:11:00 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/12/31 09:41:47 | 004,358,797 | R— | M] (Swearware) – C:\Documents and Settings\b\Desktop\ComboFix.exe
[2011/12/30 15:38:45 | 000,000,754 | —- | M] () – C:\WINDOWS\WORDPAD.INI
[2011/12/30 15:20:17 | 001,558,406 | —- | M] () – C:\Documents and Settings\b\Desktop\tdsskiller.zip
[2011/12/30 14:36:43 | 004,702,720 | —- | M] (AVAST Software) – C:\Documents and Settings\b\Desktop\aswMBR.exe
[2011/12/30 10:31:49 | 000,607,260 | R— | M] (Swearware) – C:\Documents and Settings\b\Desktop\dds.scr
[2011/12/28 18:58:34 | 000,210,961 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/12/28 18:46:40 | 000,144,384 | —- | M] () – C:\Documents and Settings\b\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/27 20:10:36 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2011/12/27 02:00:01 | 000,000,334 | —- | M] () – C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-A-b.job
[2011/12/22 12:37:21 | 000,000,713 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2012.lnk
[2011/12/21 17:58:29 | 000,000,991 | —- | M] () – C:\Documents and Settings\b\Desktop\magicJack.lnk
[2011/12/19 09:28:06 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/12/15 19:42:51 | 000,002,241 | —- | M] () – C:\Documents and Settings\b\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/12/15 19:42:49 | 000,002,263 | —- | M] () – C:\Documents and Settings\b\Desktop\Google Chrome.lnk
[2011/12/15 07:43:39 | 003,850,224 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/15 00:41:38 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/12/07 14:09:40 | 000,000,294 | —- | M] () – C:\Documents and Settings\b\My Documents\lost my give a stuff.xml
[2011/12/06 23:56:04 | 000,441,692 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/12/06 23:56:04 | 000,071,462 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/12/02 21:58:19 | 274,972,672 | —- | M] () – C:\WINDOWS\MEMORY.DMP
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/31 09:47:56 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/12/31 09:47:56 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/12/31 09:47:56 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/12/31 09:45:03 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/12/31 09:45:03 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/12/30 15:38:25 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2011/12/30 15:20:11 | 001,558,406 | —- | C] () – C:\Documents and Settings\b\Desktop\tdsskiller.zip
[2011/12/30 15:18:13 | 000,000,544 | —- | C] () – C:\Documents and Settings\b\Desktop\MBR.zip
[2011/12/30 15:16:27 | 000,000,512 | —- | C] () – C:\Documents and Settings\b\Desktop\MBR.dat
[2011/12/07 14:09:40 | 000,000,294 | —- | C] () – C:\Documents and Settings\b\My Documents\lost my give a stuff.xml
[2011/09/10 12:30:39 | 000,000,000 | —- | C] () – C:\WINDOWS\JDSecure31.INI
[2011/08/05 20:24:47 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\06807e882eed5f29381fe74271ecdccf_c
[2011/06/25 09:49:57 | 000,103,509 | —- | C] () – C:\WINDOWS\hpoins04.dat
[2011/06/25 09:49:57 | 000,017,176 | —- | C] () – C:\WINDOWS\hpomdl04.dat
[2011/06/01 19:57:08 | 000,819,200 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2011/06/01 19:57:08 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2011/06/01 16:27:15 | 000,144,384 | —- | C] () – C:\Documents and Settings\b\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/20 06:40:39 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/04/22 12:21:22 | 000,000,113 | —- | C] () – C:\WINDOWS\(null)toolkit.ini
[2011/04/07 17:46:24 | 000,241,664 | —- | C] () – C:\WINDOWS\System32\ControlWZCS.exe
[2011/04/07 17:46:23 | 000,218,003 | —- | C] () – C:\WINDOWS\dssec.dat
[2011/04/07 17:46:23 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2011/04/07 17:46:23 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\acs.exe
[2011/04/07 17:33:17 | 000,128,113 | —- | C] () – C:\WINDOWS\System32\csellang.ini
[2011/04/07 17:33:17 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\csellang.dll
[2011/04/07 17:33:17 | 000,010,165 | —- | C] () – C:\WINDOWS\System32\tosmreg.ini
[2011/04/07 17:33:17 | 000,007,671 | —- | C] () – C:\WINDOWS\System32\cseltbl.ini
[2011/04/07 17:32:33 | 000,006,528 | —- | C] () – C:\WINDOWS\System32\drivers\Tbiosdrv.sys
[2007/02/03 07:59:04 | 000,050,127 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2004/09/02 09:15:57 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/09/02 08:33:41 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/09/02 08:13:04 | 000,000,000 | —- | C] () – C:\WINDOWS\NDSTray.INI
[2004/09/02 08:10:55 | 000,000,138 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/09/02 08:10:04 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2004/09/02 08:10:04 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2004/09/02 08:10:04 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2004/09/02 08:10:04 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2004/09/02 08:10:04 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2004/09/02 08:10:04 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2004/09/02 08:06:23 | 000,000,000 | —- | C] () – C:\WINDOWS\TPTray.INI
[2004/09/01 23:30:55 | 000,000,000 | —- | C] () – C:\WINDOWS\CeEKey.INI
[2004/09/01 23:30:40 | 000,356,352 | —- | C] () – C:\WINDOWS\System32\EMCRI.dll
[2004/09/01 23:28:11 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2004/09/01 23:28:11 | 000,001,048 | —- | C] () – C:\WINDOWS\System32\drivers\alcxinit.dat
[2004/09/01 23:28:11 | 000,000,176 | —- | C] () – C:\WINDOWS\System32\drivers\alcxhweq.dat
[2004/09/01 23:23:18 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/09/01 23:21:58 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/09/01 23:17:12 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/09/01 23:03:29 | 000,385,024 | —- | C] () – C:\WINDOWS\System32\ati2evxx.exe
[2004/09/01 23:03:29 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\ati2evxx.dll
[2004/09/01 23:02:55 | 000,002,388 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2004/09/01 23:02:26 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/09/01 23:02:23 | 000,441,692 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/09/01 23:02:23 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/09/01 23:02:23 | 000,071,462 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/09/01 23:02:23 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/09/01 23:02:23 | 000,004,631 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/09/01 23:02:21 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/09/01 23:02:20 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/09/01 23:02:16 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/09/01 23:02:16 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/09/01 23:02:10 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/09/01 23:02:03 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/09/01 16:12:06 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/09/01 16:11:14 | 003,850,224 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/07/12 06:18:22 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini

========== LOP Check ==========

[2011/08/06 18:20:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\!SASCORE
[2011/12/27 20:10:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2011/10/14 14:42:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG
[2011/08/30 22:29:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/10/07 08:33:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG2012
[2011/08/30 22:33:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Backup
[2011/04/09 08:22:45 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/04/10 21:05:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\magicJack
[2011/12/31 17:15:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/07/11 15:25:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MGS
[2011/11/22 07:56:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Panda Security
[2011/10/19 21:52:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Panda Software
[2011/07/17 14:33:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
[2011/07/17 12:41:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Retrospect
[2011/07/20 08:58:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Samsung
[2011/08/10 06:34:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2011/07/16 11:34:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2011/10/14 10:54:14 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\AVG
[2011/04/09 08:24:04 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\AVG10
[2011/09/30 16:45:50 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\AVG2012
[2011/08/10 07:27:58 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/12/29 14:19:43 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\Curiolab
[2011/12/29 14:12:35 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\GetRightToGo
[2004/09/02 08:08:28 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\InterTrust
[2011/06/04 20:11:41 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\InterVideo
[2011/12/21 22:46:51 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\mjusbsp
[2011/07/16 11:34:49 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\OpenCandy
[2011/12/28 20:47:29 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\OpenOffice.org1.9.79
[2011/11/11 15:18:51 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\SmartDraw
[2004/09/02 08:11:02 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\toshiba
[2011/04/22 12:18:28 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\Trillian
[2011/08/03 17:29:44 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\Unity
[2011/04/07 17:45:57 | 000,000,258 | —- | M] () – C:\WINDOWS\Tasks\Registration reminder 1.job

========== Purity Check ==========



< End of report >