Spyware / Malware / Virus Removal

DS's PC doesn't run executables without admin [Solved]

12 min read

Looking for the outcome? Ask AI

Patrick's Mom Topic Starter

Post #1January 4, 2012, 5:03 AM UTC

My DS has a problem running programs from shortcuts, or from the menus. I can run exe's if I run them as administrator. He "thinks" he saw a pop-up that said it was "Vista Anti-virus 2012" or something like that. He did NOT click on it. Also his screen is all jumbo sized icons with really bad resolution.

I'd love to fix this before he leaves for college on Saturday. I'm hoping.

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.19170 BrowserJavaVersion: 1.6.0_22
Run by [removed] at 22:58:02 on 2012-01-03
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.3571.2315 [GMT -6:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Outdated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Outdated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_820ff26a\STacSV.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\rundll32.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\WLANExt.exe
C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe
C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_820ff26a\aestsrv.exe
C:\Program Files\Dell\Ambient Light Sensor\AlsSvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe
C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
C:\Windows\system32\mfevtps.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchFilterHost.exe
c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uWindow Title = Internet Explorer provided by Dell
uInternet Settings,ProxyOverride =
uInternet Settings,ProxyServer = http=127.0.0.1:56990
uURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20110919182915.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7018.1622\swg.dll
BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
uRun: [PPS Accelerator] d:\pps.tv\ppstream\ppsap.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [conhost] c:\users\pat\appdata\roaming\microsoft\conhost.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [Apoint] c:\program files\delltpad\Apoint.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NVHotkey] rundll32.exe c:\windows\system32\nvHotkey.dll,Start
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [ChangeTPMAuth] c:\program files\wave systems corp\common\ChangeTPMAuth.exe /T:NTRU12
mRun: [WavXMgr] c:\program files\wave systems corp\services manager\docmgr\bin\WavXDocMgr.exe
mRun: [SecureUpgrade] "c:\program files\wave systems corp\SecureUpgrade.exe"
mRun: [EmbassySecurityCheck] "c:\program files\wave systems corp\embassy security setup\EMBASSYSecurityCheck.exe"
mRun: [DellControlPoint] "c:\program files\dell\dell controlpoint\Dell.ControlPoint.exe"
mRun: [USCService] c:\program files\dell\dell controlpoint\security manager\BcmDeviceAndTaskStatusService.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [DellConnectionManager] "c:\program files\dell\dell controlpoint\connection manager\Dell.UCM.exe"
mRun: []
mRun: [Dell Webcam Central] "c:\program files\dell webcam\dell webcam central\WebcamDell.exe" /mode2
mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [MRT] "c:\windows\system32\MRT.exe" /R
StartupFolder: c:\users\pat\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\dellco~1.lnk - c:\program files\dell\dell controlpoint\system manager\DCPSysMgr.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Trusted Zone: pps.tv
Trusted Zone: ppstream.com
Trusted Zone: webscache.com
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{33E54B51-85C7-43D9-9B1E-E62E246F8B3E} : DhcpNameServer = [removed] [removed]
TCP: Interfaces\{668F2365-103C-4367-8410-54A568D7C419} : DhcpNameServer = 192.168.1.254
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~1\mcafee\msc\McSnIePl.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
LSA: Authentication Packages = msv1_0 wvauth
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\pat\appdata\roaming\mozilla\firefox\profiles\y9f7b9iy.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=DLRBDF&PC=MDDR&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.teefury.com/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=DLRBDF&PC=MDDR&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 56990
FF - prefs.js: network.proxy.type - 0
FF - component: c:\program files\mozilla firefox\distribution\bundles\{d19ca586-dd6c-4a0a-96f8-14644f340d60}\components\scriptff.dll
FF - plugin: c:\progra~1\mcafee\msc\npMcSnFFPl.dll
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mcafee\siteadvisor\NPMcFFPlg32.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\pat\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: XUL Cache: {dd9e014f-d7e8-4066-8621-b1e2e12d120f} - %profile%\extensions\{dd9e014f-d7e8-4066-8621-b1e2e12d120f}
.
—- FIREFOX POLICIES —-
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-10-13 461864]
R1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\drivers\mfenlfk.sys [2010-11-24 64712]
R1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-11-24 164776]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\driverstore\filerepository\stwrt.inf_820ff26a\AEstSrv.exe [2009-7-27 81920]
R2 alssvc;Ambient Light Sensor;c:\program files\dell\ambient light sensor\AlsSvc.exe [2008-6-3 382232]
R2 ASFAgent;ASF Agent;c:\program files\intel\asf agent\ASFAgent.exe [2007-4-19 133968]
R2 BBUpdate;BBUpdate;c:\program files\microsoft\bingbar\SeaPort.EXE [2011-6-15 249648]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\dell\dell controlpoint\DCPButtonSvc.exe [2008-12-29 320800]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostControlService.exe [2009-1-22 808296]
R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostStorageService.exe [2009-1-22 20840]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\dell\dell controlpoint\system manager\DCPSysMgrSvc.exe [2009-4-9 447264]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-11-24 214904]
R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-11-24 214904]
R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-11-24 214904]
R2 McProxy;McAfee Proxy Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-11-24 214904]
R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-11-24 166024]
R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-11-24 160344]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2010-11-24 148520]
R2 SMManager;Smith Micro Connection Manager Service;c:\program files\dell\dell controlpoint\connection manager\SMManager.exe [2009-4-10 77824]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-11-24 57432]
R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [2009-7-27 32808]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y6032.sys [2009-7-27 224384]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-11-24 180072]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-11-24 59288]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-11-24 338040]
R3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\drivers\OA001Ufd.sys [2009-7-27 133632]
R3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\drivers\OA001Vid.sys [2009-7-27 280096]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-31 135664]
S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-7-7 195336]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-31 135664]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-11-24 87808]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service –> c:\windows\system32\GameMon.des -service [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 rimspci;rimspci;c:\windows\system32\drivers\rimspe86.sys [2009-7-27 45056]
S4 risdpcie;risdpcie;c:\windows\system32\drivers\risdpe86.sys [2009-7-27 48640]
S4 rixdpcie;rixdpcie;c:\windows\system32\drivers\rixdpe86.sys [2009-7-27 38400]
.
=============== File Associations ===============
.
.exe=2U1
.
=============== Created Last 30 ================
.
2074-05-18 23:44:52 607296 —-a-w- c:\program files\microsoft games\age of empires iii\deformerdllyD.dll
2074-05-08 00:38:48 203576 ——w- c:\program files\microsoft games\age of empires iii\autopatcher2.exe
2012-01-04 04:21:25 ——– d—–w- c:\program files\Trend Micro
2011-12-29 00:58:52 ——– d—–w- c:\windows\system32\URTTEMP
2011-12-28 21:55:38 ——– d—–w- c:\program files\SEGA
2011-12-28 18:34:11 77824 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll
2011-12-28 18:34:11 32768 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll
2011-12-28 18:34:11 221184 —-a-w- c:\program files\common files\installshield\iscript\iscript.dll
2011-12-28 18:34:11 221184 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll
2011-12-14 09:04:57 ——– d—–w- c:\windows\system32\MpEngineStore
.
==================== Find3M ====================
.
2011-11-23 13:37:27 2043904 —-a-w- c:\windows\system32\win32k.sys
2011-11-08 14:42:19 2048 —-a-w- c:\windows\system32\tzres.dll
2011-11-03 06:22:04 916992 —-a-w- c:\windows\system32\wininet.dll
2011-11-03 06:17:38 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-03 06:17:23 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2011-11-03 06:17:08 71680 —-a-w- c:\windows\system32\iesetup.dll
2011-11-03 06:17:08 109056 —-a-w- c:\windows\system32\iesysprep.dll
2011-11-03 05:22:43 385024 —-a-w- c:\windows\system32\html.iec
2011-11-03 04:45:39 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2011-11-03 04:43:59 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-10-27 08:01:53 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-27 08:01:53 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 15:56:04 49152 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-16 19:16:01 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-14 16:02:19 429056 —-a-w- c:\windows\system32\EncDec.dll
.
============= FINISH: 22:58:51.43 ===============

Thank you in advance! You guys are always so great!

oldman960

Post #2January 6, 2012, 11:19 AM UTC

Hi Patrick's Mom,

This will give us a better look.

If asked to download Avast's definition databse when you run this next tool please do so.

Download aswMBR.exe to your desktop.

Right click aswMBR.exe and click "Run as Administrator" to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.

Next

Download OTL to your desktop.

Right click on OTL.exe and click "Run as Administrator" to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
In the window under Custom Scans/Fixes copy and paste the following

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lîk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Deskuop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
%USERPROFILE%\..|smtmp;true;true;true /FP
/md5start
mdm.exe
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
consrv.dll
/md5stop
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in. No need for a new HJT log.

Please post back with

aswMBR log
mbr.zip (attached)
both OTL logs

Patrick's Mom

Post #3January 6, 2012, 10:19 PM UTC

Thank you for responding. I also noticed that Explorer does not connect to the internet. I had to use firefox to get here, which is what I prefer, but it might be relevant that IE is "sick". Content of aswMBR.txt: aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software Run date: 2012-01-06 14:20:07 —————————– 14:20:07.163 OS Version: Windows 6.0.6002 Service Pack 2 14:20:07.163 Number of processors: 2 586 0x170A 14:20:07.164 ComputerName: PAT-PC UserName: Pat 14:20:09.714 Initialize success 14:20:43.721 AVAST engine download error: 0 14:21:04.905 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 14:21:04.907 Disk 0 Vendor: ST916041 0002 Size: 152627MB BusType: 8 14:21:04.941 Disk 0 MBR read successfully 14:21:04.947 Disk 0 MBR scan 14:21:04.952 Disk 0 Windows VISTA default MBR code 14:21:04.958 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 180 MB offset 63 14:21:04.968 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 2048 MB offset 370688 14:21:04.989 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 150397 MB offset 4564992 14:21:04.998 Disk 0 scanning sectors +312578048 14:21:05.088 Disk 0 scanning C:\Windows\system32\drivers 14:21:18.948 Service scanning 14:21:46.631 Disk 0 MBR has been saved successfully to "C:\Users\Pat\Contacts\Desktop\MBR.dat" 14:21:46.684 The log file has been saved successfully to "C:\Users\Pat\Contacts\Desktop\aswMBR.txt" I had a terrible time compressing that file. But I think I did it. I'm going to send this and add the OTLs to another post. Thanks!

Attachments:

📎aswMBR.zip

oldman960

Post #4January 6, 2012, 10:31 PM UTC

Hi Patrick's Mom, Ok we'll start once you post the OTL logs.

Patrick's Mom

Post #5January 6, 2012, 11:13 PM UTC

Doing anything on this PC takes forever, and tons of manipulation. SOrry for the delay.

Here is the otl.txt. It didn't open it automatically. I had to go find it No big deal, but thought i'd mention it. It did NOT create an EXTRAS.txt file. I searched everywhere, and did not find it.

OTL logfile created on: 1/6/2012 4:36:09 PM - Run 4
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Pat\Contacts\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.49 Gb Total Physical Memory | 2.18 Gb Available Physical Memory | 62.40% Memory free
7.17 Gb Paging File | 5.90 Gb Available in Paging File | 82.23% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 146.87 Gb Total Space | 51.30 Gb Free Space | 34.93% Space Free | Partition Type: NTFS
Drive D: | 2.00 Gb Total Space | 1.12 Gb Free Space | 55.89% Space Free | Partition Type: NTFS
Drive E: | 4.23 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: PAT-PC | User Name: Pat | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Pat\Contacts\Desktop\OTL(2).exe (OldTimer Tools)
PRC - C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Windows\System32\spool\drivers\w32x86\3\HP1006MC.EXE (Software 2000 Limited)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_820ff26a\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_820ff26a\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe (Smith Micro Software, Inc.)
PRC - C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (Dell Inc.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe (Broadcom Corporation)
PRC - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe (Broadcom Corporation)
PRC - C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe (Dell Inc.)
PRC - C:\Program Files\Dell\Ambient Light Sensor\AlsSvc.exe (Dell Inc.)
PRC - C:\Program Files\Intel\ASF Agent\ASFAgent.exe (Intel Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\Windows\System32\wxvault.dll ()

========== Win32 Services (SafeList) ==========

SRV - (mfevtp) – C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe ()
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (BBSvc) – C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (BBUpdate) – C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (McProxy) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (npggsvc) – C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (STacSV) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_820ff26a\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_820ff26a\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (TdmService) – C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.)
SRV - (SMManager) – C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe (Smith Micro Software, Inc.)
SRV - (dcpsysmgrsvc) – C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (Dell Inc.)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (Credential Vault Host Control Service) – C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe (Broadcom Corporation)
SRV - (Credential Vault Host Storage) – C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe (Broadcom Corporation)
SRV - (buttonsvc32) – C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe (Dell Inc.)
SRV - (SecureStorageService) – C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe (Wave Systems Corp.)
SRV - (tcsd_win32.exe) – C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe ()
SRV - (alssvc) – C:\Program Files\Dell\Ambient Light Sensor\AlsSvc.exe (Dell Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ASFAgent) – C:\Program Files\Intel\ASF Agent\ASFAgent.exe (Intel Corporation)

========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfewfpk) – C:\Windows\System32\drivers\mfewfpk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\Windows\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfenlfk) – C:\Windows\System32\drivers\mfenlfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (cfwids) – C:\Windows\System32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (BCM42RLY) – C:\Windows\System32\drivers\bcm42rly.sys (Broadcom Corporation)
DRV - (HECI) Intel® – C:\Windows\system32\drivers\heci.sys (Intel Corporation)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (WavxDMgr) – C:\Windows\System32\drivers\WavxDMgr.sys (Wave Systems Corp.)
DRV - (cvusbdrv) – C:\Windows\System32\drivers\cvusbdrv.sys (Broadcom Corporation)
DRV - (USBCCID) – C:\Windows\System32\drivers\usbccid.sys (Microsoft Corporation)
DRV - (rismxdp) – C:\Windows\system32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\system32\drivers\rimsptsk.sys (REDC)
DRV - (rixdpcie) – C:\Windows\system32\drivers\rixdpe86.sys (REDC)
DRV - (risdpcie) – C:\Windows\system32\drivers\risdpe86.sys (REDC)
DRV - (rimspci) – C:\Windows\system32\drivers\rimspe86.sys (REDC)
DRV - (OA001Ufd) – C:\Windows\System32\drivers\OA001Ufd.sys (Creative Technology Ltd.)
DRV - (OA001Vid) – C:\Windows\System32\drivers\OA001Vid.sys (Creative Technology Ltd.)
DRV - (e1yexpress) Intel® – C:\Windows\System32\drivers\e1y6032.sys (Intel Corporation)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (PBADRV) – C:\Windows\system32\DRIVERS\PBADRV.sys (Dell Inc)
DRV - (NAL) – C:\Windows\System32\drivers\iqvw32.sys (Intel Corporation )
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USREL/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MDDR&ocid=bb7hp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3D C7 14 10 B8 16 40 4E AC 49 3A 44 E7 4F E3 08 [binary data]
IE - HKCU\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:56990

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=DLRBDF&PC=MDDR&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.teefury.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {dd9e014f-d7e8-4066-8621-b1e2e12d120f}:1.0
FF - prefs.js..extensions.enabledItems: {74c841e3-b59f-479e-8d7a-e26a942a87c8}:3.5
FF - prefs.js..keyword.URL: "http://www.bing.com/search?FORM=DLRBDF&PC=MDDR&q="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 56990
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll File not found
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@winzip.com/Winzip Courier: C:\Program Files\WinZip Courier\npwzwmc.dll (WinZip Computing, S.L.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Pat\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2011/11/16 14:34:23 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{74c841e3-b59f-479e-8d7a-e26a942a87c8}: C:\Program Files\WinZip Courier\FFExt [2012/01/06 15:52:52 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.25\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/12/23 13:26:44 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.25\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/12/23 13:26:44 | 000,000,000 | —D | M]

[2009/10/02 00:52:54 | 000,000,000 | —D | M] (No name found) – C:\Users\Pat\AppData\Roaming\Mozilla\Extensions
[2012/01/06 02:29:40 | 000,000,000 | —D | M] (No name found) – C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\y9f7b9iy.default\extensions
[2011/07/28 01:24:56 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\y9f7b9iy.default\extensions\{dd9e014f-d7e8-4066-8621-b1e2e12d120f}
[2011/10/29 11:16:10 | 000,000,000 | —D | M] (Default Manager) – C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\y9f7b9iy.default\extensions\DefaultManager@Microsoft
[2011/10/29 11:20:29 | 000,001,832 | —- | M] () – C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\y9f7b9iy.default\searchplugins\bing.xml
[2011/04/01 17:51:15 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/04/01 17:51:15 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2012/01/06 15:52:52 | 000,000,000 | —D | M] (WinZip Courier) – C:\PROGRAM FILES\WINZIP COURIER\FFEXT
[2011/04/14 13:01:38 | 000,024,376 | —- | M] (McAfee, Inc.) – C:\Program Files\mozilla firefox\components\Scriptff.dll
[2011/04/01 17:51:07 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

========== Chrome ==========

CHR - default_search_provider: ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =

O1 HOSTS File: ([2010/11/24 01:47:49 | 000,000,098 | —- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\Mcafee\SystemCore\ScriptSn.20110919182915.dll (McAfee, Inc.)
O2 - BHO: (WinZip Courier BHO) - {A8FB70FA-0FDF-4601-9DC4-BFA1B357204F} - C:\Program Files\WinZip Courier\wzwmcie.dll (WinZip Computing, S.L.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.)
O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (AIM Toolbar) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [ChangeTPMAuth] C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [DellConnectionManager] C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe (Smith Micro Software, Inc.)
O4 - HKLM..\Run: [DellControlPoint] C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.)
O4 - HKLM..\Run: [EmbassySecurityCheck] C:\Program Files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SecureUpgrade] C:\Program Files\Wave Systems Corp\SecureUpgrade.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [USCService] C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation)
O4 - HKLM..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [conhost] C:\Users\Pat\AppData\Roaming\Microsoft\conhost.exe File not found
O4 - HKCU..\Run: [PPS Accelerator] D:\PPS.tv\PPStream\ppsap.exe File not found
O4 - Startup: C:\Users\Pat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: pps.tv ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: ppstream.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: webscache.com ([]http in Trusted sites)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{33E54B51-85C7-43D9-9B1E-E62E246F8B3E}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{668F2365-103C-4367-8410-54A568D7C419}: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Pat\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Pat\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O30 - LSA: Authentication Packages - (wvauth) -C:\Windows\System32\wvauth.dll (Wave Systems Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 15:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2007/07/16 03:07:53 | 000,000,044 | R— | M] () - E:\Autorun.inf – [ CDFS ]
O33 - MountPoints2\{7fa058a5-7af0-11de-abfb-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{7fa058a5-7af0-11de-abfb-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Launch.exe – [2007/08/07 15:57:39 | 004,444,160 | R— | M] (Macrovision Corporation)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = 2U1] – "C:\Users\Pat\AppData\Local\sel.exe" -a "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/01/06 16:12:14 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Pat\Contacts\Desktop\OTL(2).exe
[2012/01/06 15:52:53 | 000,000,000 | —D | C] – C:\ProgramData\WinZipEC
[2012/01/06 15:52:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Courier
[2012/01/06 15:52:52 | 000,000,000 | —D | C] – C:\Program Files\WinZip Courier
[2012/01/06 14:46:33 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
[2012/01/06 14:46:27 | 000,000,000 | —D | C] – C:\Users\Pat\AppData\Local\WinZip
[2012/01/06 14:46:15 | 000,000,000 | —D | C] – C:\ProgramData\WinZip
[2012/01/06 14:46:03 | 000,000,000 | —D | C] – C:\Program Files\WinZip
[2012/01/06 14:18:36 | 004,713,472 | —- | C] (AVAST Software) – C:\Users\Pat\Contacts\Desktop\aswMBR.exe
[2012/01/06 12:58:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2012/01/03 22:21:25 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/01/03 22:21:25 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis
[2011/12/28 18:58:52 | 000,000,000 | —D | C] – C:\Windows\System32\URTTEMP
[2011/12/28 18:30:00 | 000,000,000 | RH-D | C] – C:\Users\Pat\AppData\Roaming\SecuROM
[2011/12/28 16:18:41 | 000,229,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_1.dll
[2011/12/28 16:18:41 | 000,062,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xinput1_1.dll
[2011/12/28 16:18:32 | 002,388,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_30.dll
[2011/12/28 16:18:31 | 002,332,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_29.dll
[2011/12/28 16:18:31 | 000,230,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_0.dll
[2011/12/28 16:18:31 | 000,014,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\x3daudio1_0.dll
[2011/12/28 16:18:07 | 002,323,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_28.dll
[2011/12/28 16:18:05 | 002,319,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_27.dll
[2011/12/28 16:17:55 | 002,222,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_24.dll
[2011/12/28 15:55:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SEGA
[2011/12/28 15:55:38 | 000,000,000 | —D | C] – C:\Program Files\SEGA
[2011/12/14 03:04:57 | 000,000,000 | —D | C] – C:\Windows\System32\MpEngineStore
[2011/12/13 16:09:56 | 003,602,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/12/13 16:09:56 | 003,550,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/12/13 16:09:55 | 000,429,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EncDec.dll
[2011/12/13 16:09:54 | 002,043,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/12/13 16:09:50 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\csrsrv.dll
[2011/12/13 16:09:46 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2011/12/13 16:09:31 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/12/13 16:09:29 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/12/13 16:09:27 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/12/13 16:09:27 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/12/13 16:09:26 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/12/13 16:09:26 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/12/13 16:09:26 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/12/13 16:09:25 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/12/13 16:09:25 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/12/13 16:09:25 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/12/13 16:09:25 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/12/13 16:09:25 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/12/13 16:09:25 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/12/13 16:09:24 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/12/13 16:09:24 | 000,174,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/12/13 16:09:24 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/12/13 16:09:24 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/12/13 16:09:24 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/01/06 16:22:30 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/06 16:22:24 | 000,027,649 | —- | M] () – C:\ProgramData\nvModes.001
[2012/01/06 16:12:22 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Pat\Contacts\Desktop\OTL(2).exe
[2012/01/06 15:59:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/06 14:53:06 | 000,003,744 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/06 14:53:06 | 000,003,744 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/06 14:46:33 | 000,001,856 | —- | M] () – C:\Users\Public\Desktop\WinZip.lnk
[2012/01/06 14:46:33 | 000,001,800 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
[2012/01/06 14:38:40 | 054,314,312 | —- | M] () – C:\Users\Pat\Contacts\Desktop\winzip160.exe
[2012/01/06 14:21:46 | 000,000,512 | —- | M] () – C:\Users\Pat\Contacts\Desktop\MBR.dat
[2012/01/06 14:19:53 | 004,713,472 | —- | M] (AVAST Software) – C:\Users\Pat\Contacts\Desktop\aswMBR.exe
[2012/01/06 13:26:35 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/01/06 12:58:21 | 000,001,737 | —- | M] () – C:\Users\Public\Desktop\McAfee AntiVirus Plus.lnk
[2012/01/05 02:01:44 | 000,613,270 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/01/05 02:01:44 | 000,108,196 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/01/05 01:54:25 | 3745,411,072 | -HS- | M] () – C:\hiberfil.sys
[2012/01/03 22:21:25 | 000,001,894 | —- | M] () – C:\Users\Pat\Contacts\Desktop\HijackThis.lnk
[2012/01/03 21:35:09 | 000,027,649 | —- | M] () – C:\ProgramData\nvModes.dat
[2012/01/03 21:32:40 | 000,000,680 | —- | M] () – C:\Users\Pat\AppData\Local\d3d9caps.dat
[2012/01/01 17:48:10 | 000,013,228 | -HS- | M] () – C:\Users\Pat\AppData\Local\210ix62kx62y12744267ukpick4g023cen2wf40834k
[2012/01/01 17:48:10 | 000,013,228 | -HS- | M] () – C:\ProgramData\210ix62kx62y12744267ukpick4g023cen2wf40834k
[2012/01/01 16:25:16 | 000,000,272 | —- | M] () – C:\Sonic-and-Knuckles-(JUE)-[!].srm
[2012/01/01 15:55:11 | 000,000,980 | —- | M] () – C:\SonicandKnuckles3.srm
[2012/01/01 15:34:24 | 000,000,000 | —- | M] () – C:\Users\Pat\AppData\Local\WavXMapDrive.bat
[2011/12/28 19:57:50 | 000,001,952 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Teutonic.lnk
[2011/12/28 19:40:03 | 000,001,952 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Crusades.lnk
[2011/12/28 19:36:47 | 000,001,962 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Britannia.lnk
[2011/12/28 19:33:41 | 000,001,952 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Americas.lnk
[2011/12/28 19:00:51 | 000,001,894 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War.lnk
[2011/12/28 18:24:27 | 000,002,148 | —- | M] () – C:\Users\Public\Desktop\Hyrule Total War.lnk
[2011/12/15 11:41:52 | 000,028,766 | —- | M] () – C:\Users\Pat\Documents\native americans final exaM.odt
[2011/12/14 22:00:26 | 000,021,082 | —- | M] () – C:\Users\Pat\Documents\The blackfoot tribes.odt
[2011/12/14 13:58:20 | 000,394,056 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/12/14 03:04:57 | 000,000,127 | —- | M] () – C:\Windows\System32\MRT.INI
[2011/12/12 22:12:50 | 000,001,536 | —- | M] () – C:\Users\Pat\Contacts\Desktop\NO$GBA.INP
[2011/12/08 08:16:52 | 000,024,674 | —- | M] () – C:\Users\Pat\Documents\Geologiy take hoime examisnaiton.odt
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/01/06 14:46:33 | 000,001,856 | —- | C] () – C:\Users\Public\Desktop\WinZip.lnk
[2012/01/06 14:46:30 | 000,001,800 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
[2012/01/06 14:35:28 | 054,314,312 | —- | C] () – C:\Users\Pat\Contacts\Desktop\winzip160.exe
[2012/01/06 14:21:46 | 000,000,512 | —- | C] () – C:\Users\Pat\Contacts\Desktop\MBR.dat
[2012/01/03 22:21:25 | 000,001,894 | —- | C] () – C:\Users\Pat\Contacts\Desktop\HijackThis.lnk
[2011/12/31 14:58:29 | 000,000,980 | —- | C] () – C:\SonicandKnuckles3.srm
[2011/12/31 14:05:00 | 000,013,228 | -HS- | C] () – C:\Users\Pat\AppData\Local\210ix62kx62y12744267ukpick4g023cen2wf40834k
[2011/12/31 14:05:00 | 000,013,228 | -HS- | C] () – C:\ProgramData\210ix62kx62y12744267ukpick4g023cen2wf40834k
[2011/12/28 19:57:50 | 000,001,952 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Teutonic.lnk
[2011/12/28 19:40:03 | 000,001,952 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Crusades.lnk
[2011/12/28 19:36:47 | 000,001,962 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Britannia.lnk
[2011/12/28 19:33:41 | 000,001,952 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Americas.lnk
[2011/12/28 18:24:27 | 000,002,148 | —- | C] () – C:\Users\Public\Desktop\Hyrule Total War.lnk
[2011/12/28 16:17:01 | 000,001,894 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War.lnk
[2011/12/21 12:01:03 | 000,000,680 | —- | C] () – C:\Users\Pat\AppData\Local\d3d9caps.dat
[2011/12/15 00:51:28 | 000,028,766 | —- | C] () – C:\Users\Pat\Documents\native americans final exaM.odt
[2011/12/14 22:00:24 | 000,021,082 | —- | C] () – C:\Users\Pat\Documents\The blackfoot tribes.odt
[2011/12/08 00:45:39 | 000,024,674 | —- | C] () – C:\Users\Pat\Documents\Geologiy take hoime examisnaiton.odt
[2011/09/29 10:11:14 | 000,000,127 | —- | C] () – C:\Windows\System32\MRT.INI
[2011/07/23 12:40:07 | 000,011,884 | -HS- | C] () – C:\Users\Pat\AppData\Local\15ho16v480qtjopuusb031qp2362v1q
[2011/07/23 12:40:07 | 000,011,884 | -HS- | C] () – C:\ProgramData\15ho16v480qtjopuusb031qp2362v1q
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\Users\Pat\AppData\Local\yqte.exe
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\ProgramData\rlwt.exe
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\ProgramData\rgwh.exe
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\ProgramData\poye.exe
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\Users\Pat\AppData\Local\oxqk.exe
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\Users\Pat\AppData\Local\obtb.exe
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\Users\Pat\AppData\Local\jwom.exe
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\ProgramData\amih.exe
[2011/07/03 00:43:38 | 000,027,153 | —- | C] () – C:\Users\Pat\AppData\Roaming\BE00.3FB
[2011/05/16 18:03:10 | 000,013,454 | -HS- | C] () – C:\Users\Pat\AppData\Local\cmkfrvyt0bnt68542gr60wphcn5u5b
[2011/05/16 18:03:10 | 000,013,454 | -HS- | C] () – C:\ProgramData\cmkfrvyt0bnt68542gr60wphcn5u5b
[2010/07/02 19:35:00 | 000,056,320 | —- | C] () – C:\Windows\System32\iyvu9_32.dll
[2010/07/02 19:28:22 | 000,000,039 | —- | C] () – C:\Windows\WININIT.INI
[2010/06/30 20:12:11 | 000,000,208 | —- | C] () – C:\Windows\TLCAPPS.INI
[2010/06/30 20:11:31 | 000,000,000 | —- | C] () – C:\Windows\setup32.INI
[2010/06/28 11:35:30 | 000,000,000 | —- | C] () – C:\Windows\PowerReg.dat
[2010/05/18 12:16:03 | 000,065,536 | —- | C] () – C:\Windows\System32\HPPLVS.dll
[2010/05/11 11:02:13 | 000,000,552 | —- | C] () – C:\Users\Pat\AppData\Local\d3d8caps.dat
[2010/03/17 21:19:09 | 000,010,390 | -HS- | C] () – C:\Users\Pat\AppData\Local\ru6R
[2010/03/17 21:19:09 | 000,010,390 | -HS- | C] () – C:\ProgramData\ru6R
[2009/09/16 20:32:38 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/09/16 20:32:38 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/08/31 18:43:20 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2009/08/30 13:01:10 | 000,012,288 | —- | C] () – C:\Windows\impborl.dll
[2009/08/07 21:30:08 | 000,000,036 | -H– | C] () – C:\Windows\System32\swk.ini
[2009/08/07 21:27:49 | 000,014,848 | —- | C] () – C:\Users\Pat\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/08/01 13:13:07 | 000,027,649 | —- | C] () – C:\ProgramData\nvModes.001
[2009/08/01 13:05:21 | 000,027,649 | —- | C] () – C:\ProgramData\nvModes.dat
[2009/08/01 10:06:42 | 000,000,000 | —- | C] () – C:\Users\Pat\AppData\Local\WavXMapDrive.bat
[2009/07/27 20:32:24 | 000,055,808 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2009/07/27 20:32:24 | 000,024,064 | —- | C] () – C:\Windows\System32\WLTRYSVC.EXE
[2009/07/27 20:21:57 | 000,279,888 | —- | C] () – C:\Windows\System32\brcmbsp.dll
[2009/07/27 20:19:21 | 000,080,368 | —- | C] () – C:\Windows\System32\pbadrvdll.dll
[2009/07/08 19:03:02 | 000,058,880 | —- | C] () – C:\Windows\System32\bdmpegv.dll
[2009/04/22 08:58:30 | 000,126,976 | —- | C] () – C:\Windows\System32\DTMessageLib.dll
[2009/04/11 13:18:37 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/04/11 11:26:38 | 000,000,000 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2009/04/10 11:01:12 | 000,143,360 | R— | C] () – C:\Windows\System32\preflib.dll
[2009/02/26 15:54:52 | 000,098,304 | —- | C] () – C:\Windows\System32\Internationalization_tr.dll
[2009/02/26 15:54:50 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_ro.dll
[2009/02/26 15:54:48 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_pt-BR.dll
[2009/02/26 15:54:48 | 000,098,304 | —- | C] () – C:\Windows\System32\Internationalization_hu.dll
[2009/02/26 15:54:46 | 000,094,208 | —- | C] () – C:\Windows\System32\Internationalization_he.dll
[2009/02/26 15:54:44 | 000,106,496 | —- | C] () – C:\Windows\System32\Internationalization_el.dll
[2009/02/26 15:54:44 | 000,098,304 | —- | C] () – C:\Windows\System32\Internationalization_fi.dll
[2009/02/26 15:54:42 | 000,098,304 | —- | C] () – C:\Windows\System32\Internationalization_cs.dll
[2009/02/26 15:54:40 | 000,094,208 | —- | C] () – C:\Windows\System32\Internationalization_ar.dll
[2009/02/26 15:54:40 | 000,081,920 | —- | C] () – C:\Windows\System32\Internationalization_zh-CHT.dll
[2009/02/26 15:54:38 | 000,081,920 | —- | C] () – C:\Windows\System32\Internationalization_zh-CHS.dll
[2009/02/26 15:54:36 | 000,098,304 | —- | C] () – C:\Windows\System32\Internationalization_sv.dll
[2009/02/26 15:54:34 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_pt.dll
[2009/02/26 15:54:34 | 000,098,304 | —- | C] () – C:\Windows\System32\Internationalization_ru.dll
[2009/02/26 15:54:32 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_pl.dll
[2009/02/26 15:54:32 | 000,098,304 | —- | C] () – C:\Windows\System32\Internationalization_no.dll
[2009/02/26 15:54:30 | 000,106,496 | —- | C] () – C:\Windows\System32\Internationalization_nl.dll
[2009/02/26 15:54:28 | 000,090,112 | —- | C] () – C:\Windows\System32\Internationalization_ja.dll
[2009/02/26 15:54:28 | 000,086,016 | —- | C] () – C:\Windows\System32\Internationalization_ko.dll
[2009/02/26 15:54:26 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_it.dll
[2009/02/26 15:54:24 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_fr.dll
[2009/02/26 15:54:24 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_es.dll
[2009/02/26 15:54:20 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_de.dll
[2009/02/26 15:54:20 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_da.dll
[2009/02/17 08:51:28 | 000,540,672 | —- | C] () – C:\Windows\System32\AmRes_es.dll
[2009/02/17 08:51:28 | 000,512,000 | —- | C] () – C:\Windows\System32\AmRes_en.dll
[2009/02/17 08:51:26 | 000,540,672 | —- | C] () – C:\Windows\System32\AmRes_fr.dll
[2009/02/17 08:51:24 | 000,536,576 | —- | C] () – C:\Windows\System32\AmRes_it.dll
[2009/02/17 08:51:24 | 000,520,192 | —- | C] () – C:\Windows\System32\AmRes_ja.dll
[2009/02/17 08:51:24 | 000,503,808 | —- | C] () – C:\Windows\System32\AmRes_ko.dll
[2009/02/17 08:51:22 | 000,565,248 | —- | C] () – C:\Windows\System32\AmRes_ru.dll
[2009/02/17 08:51:22 | 000,524,288 | —- | C] () – C:\Windows\System32\AmRes_pt-BR.dll
[2009/02/17 08:51:20 | 000,520,192 | —- | C] () – C:\Windows\System32\AmRes_fi.dll
[2009/02/17 08:51:20 | 000,479,232 | —- | C] () – C:\Windows\System32\AmRes_zh-CHT.dll
[2009/02/17 08:51:20 | 000,475,136 | —- | C] () – C:\Windows\System32\AmRes_zh-CHS.dll
[2009/02/17 08:51:18 | 000,516,096 | —- | C] () – C:\Windows\System32\AmRes_da.dll
[2009/02/17 08:51:16 | 000,540,672 | —- | C] () – C:\Windows\System32\AmRes_nl.dll
[2009/02/17 08:51:16 | 000,528,384 | —- | C] () – C:\Windows\System32\AmRes_pl.dll
[2009/02/17 08:51:16 | 000,512,000 | —- | C] () – C:\Windows\System32\AmRes_no.dll
[2009/02/17 08:51:14 | 000,516,096 | —- | C] () – C:\Windows\System32\AmRes_sv.dll
[2009/02/17 08:51:04 | 000,528,384 | —- | C] () – C:\Windows\System32\AmRes_cs.dll
[2009/02/17 08:51:04 | 000,512,000 | —- | C] () – C:\Windows\System32\AmRes_ar.dll
[2009/02/17 08:51:02 | 000,536,576 | —- | C] () – C:\Windows\System32\AmRes_el.dll
[2009/02/17 08:51:02 | 000,503,808 | —- | C] () – C:\Windows\System32\AmRes_he.dll
[2009/02/17 08:51:00 | 000,532,480 | —- | C] () – C:\Windows\System32\AmRes_pt-PT.dll
[2009/02/17 08:51:00 | 000,528,384 | —- | C] () – C:\Windows\System32\AmRes_hu.dll
[2009/02/17 08:50:58 | 000,532,480 | —- | C] () – C:\Windows\System32\AmRes_ro.dll
[2009/02/17 08:50:58 | 000,524,288 | —- | C] () – C:\Windows\System32\AmRes_tr.dll
[2009/02/17 07:46:36 | 000,544,768 | —- | C] () – C:\Windows\System32\AmRes_de.dll
[2009/01/06 15:25:36 | 000,010,752 | —- | C] () – C:\Windows\System32\Wavx_ESC_Logging.dll
[2008/12/22 13:13:54 | 000,249,856 | —- | C] () – C:\Windows\System32\wxvault.dll
[2008/10/06 17:36:56 | 000,839,680 | —- | C] () – C:\Windows\System32\DemoLicense.dll
[2008/03/25 08:46:00 | 000,077,536 | —- | C] () – C:\Windows\System32\xltZlib.dll
[2007/04/19 04:52:16 | 000,080,720 | —- | C] () – C:\Windows\System32\AsfBios.dll
[2007/04/19 04:28:10 | 000,025,424 | —- | C] () – C:\Windows\System32\drivers\netamsg.dll
[2006/11/02 06:53:49 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 06:44:53 | 000,394,056 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 04:33:01 | 000,613,270 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 04:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 04:33:01 | 000,108,196 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 04:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 04:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 04:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 02:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 02:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 01:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 01:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/06/30 11:58:44 | 000,176,128 | R— | C] () – C:\Windows\System32\bioapi_mds300.dll
[2006/06/30 11:58:44 | 000,126,976 | R— | C] () – C:\Windows\System32\bioapi100.dll
[2004/09/10 12:34:00 | 000,917,504 | —- | C] () – C:\Windows\System32\lmgr10.dll
[2004/09/10 12:34:00 | 000,057,344 | —- | C] () – C:\Windows\System32\ADsSecurity.dll

========== LOP Check ==========

[2011/05/26 11:31:14 | 000,000,000 | —D | M] – C:\Users\Pat\AppData\Roaming\.minecraft
[2009/11/03 22:45:29 | 000,000,000 | —D | M] – C:\Users\Pat\AppData\Roaming\acccore
[2009/08/01 10:06:40 | 000,000,000 | —D | M] – C:\Users\Pat\AppData\Roaming\Broadcom
[2011/12/04 13:17:30 | 000,000,000 | —D | M] – C:\Users\Pat\AppData\Roaming\Caxie
[2010/10/24 02:21:23 | 000,000,000 | —D | M] – C:\Users\Pat\AppData\Roaming\GetRightToGo
[2011/09/19 13:48:54 | 000,000,000 | —D | M] – C:\Users\Pat\AppData\Roaming\LPECommon
[2010/02/08 22:59:13 | 000,000,000 | —D | M] – C:\Users\Pat\AppData\Roaming\NeopleLauncherDFO
[2011/04/01 17:59:31 | 000,000,000 | —D | M] – C:\Users\Pat\AppData\Roaming\OpenOffice.org
[2011/05/28 15:13:07 | 000,000,000 | —D | M] – C:\Users\Pat\AppData\Roaming\PPStream
[2009/10/24 20:33:13 | 000,000,000 | —D | M] – C:\Users\Pat\AppData\Roaming\Recruitment Viewer
[2011/12/14 13:54:56 | 000,000,000 | —D | M] – C:\Users\Pat\AppData\Roaming\Urcyas
[2009/08/01 10:06:58 | 000,000,000 | —D | M] – C:\Users\Pat\AppData\Roaming\Wave Systems Corp
[2011/08/11 20:55:08 | 000,000,000 | —D | M] – C:\Users\Pat\AppData\Roaming\Wizards of the Coast
[2012/01/04 03:00:17 | 000,032,602 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 15:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 00:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2006/09/18 15:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2009/07/27 22:58:15 | 000,004,848 | RH– | M] () – C:\dell.sdr
[2012/01/05 01:54:25 | 3745,411,072 | -HS- | M] () – C:\hiberfil.sys
[2011/05/25 14:27:22 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/11/03 22:45:18 | 000,000,362 | -H– | M] () – C:\IPH.PH
[2011/05/25 14:27:22 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2010/05/18 12:17:13 | 000,020,012 | —- | M] () – C:\P1005.log
[2012/01/05 01:54:24 | 4059,033,600 | -HS- | M] () – C:\pagefile.sys
[2010/11/24 13:21:00 | 000,042,848 | —- | M] () – C:\RootRepeal report 11-24-10 (13-21-00).txt
[2012/01/01 16:25:16 | 000,000,272 | —- | M] () – C:\Sonic-and-Knuckles-(JUE)-[!].srm
[2012/01/01 15:55:11 | 000,000,980 | —- | M] () – C:\SonicandKnuckles3.srm

< %systemroot%\Fonts\*.com >
[2006/11/02 06:35:34 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 06:35:34 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 06:35:34 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2011/01/08 11:11:55 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 15:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/09/22 10:50:36 | 000,293,888 | —- | M] (Hewlett-Packard ) – C:\Windows\system32\spool\prtprocs\w32x86\HP1006S.DLL

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2008/12/04 21:55:20 | 000,307,560 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2011/09/27 10:23:53 | 000,000,151 | —- | M] () – C:\Users\Pat\AppData\Roaming\Microsoft\gb_63664.bat
[2011/09/24 10:42:18 | 000,000,133 | —- | M] () – C:\Users\Pat\AppData\Roaming\Microsoft\gb_96564.bat

< %PROGRAMFILES%\*.* >
[2008/01/20 20:57:01 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/01/20 21:31:11 | 015,716,352 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 21:31:01 | 000,102,400 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 21:31:12 | 000,020,480 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 04:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 04:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Deskuop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-01-04 03:47:18

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< MD5 for: EXPLORER.EXE >
[2009/04/11 13:16:17 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2009/04/11 13:16:16 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2009/04/11 13:16:16 | 002,927,616 | —- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009/04/11 00:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\explorer.exe
[2009/04/11 00:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2009/04/11 13:16:17 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008/01/20 20:34:05 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2006/11/02 06:38:53 | 000,036,864 | —- | M] (Microsoft Corporation) MD5=192DD053B43250E264383CDC3D564A18 – C:\Windows\en-US\explorer.exe.mui
[2006/11/02 06:38:53 | 000,036,864 | —- | M] (Microsoft Corporation) MD5=192DD053B43250E264383CDC3D564A18 – C:\Windows\winsxs\x86_microsoft-windows-explorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_03bbc52176b6ba20\explorer.exe.mui

< MD5 for: EXPLORER.EXE-D5E97654.PF >
[2012/01/06 16:22:30 | 000,210,566 | —- | M] () MD5=305BC75FEAA0CE3B99C060C533CB2FCA – C:\Windows\Prefetch\EXPLORER.EXE-D5E97654.pf

< MD5 for: IEXPLORE.EXE >
[2010/09/08 11:30:52 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=02FF22F3AF0108DA2A563ABC9867049F – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18527_none_2f536bb51a085bcf\iexplore.exe
[2009/10/27 07:11:33 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=03EF289E8F82CBC4E492658864C7C51A – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22550_none_2fb594d03344a0e4\iexplore.exe
[2011/07/23 05:02:27 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=04D1DC458C723B291179F8449ACC281D – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19120_none_12355fcb2fdc2111\iexplore.exe
[2009/04/11 13:10:03 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=0844F5B9CB3BB85A917D347EF1565B6C – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16809_none_2d84c7c91ccfce35\iexplore.exe
[2011/09/30 17:49:11 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=0E1695AD4C30E72D68170F01B4818A80 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23250_none_129e8cd2491214ae\iexplore.exe
[2009/12/18 06:28:58 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=115076DAD84312F3A51698C15BC39D39 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21184_none_2db2bdca3632ff3d\iexplore.exe
[2009/07/18 06:16:49 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=1D5A01AA2DE47C052AF46D7EBCB003A3 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16890_none_2d1a75e31d20e59f\iexplore.exe
[2009/07/18 15:39:09 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=1D8163DBFECAEDB9C48C5F55084BC491 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18294_none_2f04b5b11a43dbec\iexplore.exe
[2009/07/27 22:55:52 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=1DD66A2851DACDEC32EAE8F9A8865ABD – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21023_none_2df29b2236034119\iexplore.exe
[2010/03/09 10:56:18 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=259E27152180B895DF395ED3E412B90E – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.17037_none_2d6231791cea1fc3\iexplore.exe
[2010/05/04 12:56:53 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=29A7F81290165264010B784A7D217561 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18470_none_2f16582d1a3738fc\iexplore.exe
[2011/11/03 01:33:09 | 000,638,240 | —- | M] (Microsoft Corporation) MD5=2A268DF89913A0E927091077878EDB3E – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23266_none_1299bea24914c8a9\iexplore.exe
[2009/04/11 00:27:44 | 000,636,080 | —- | M] (Microsoft Corporation) MD5=2C5168C856455CC43C4B4E1CC1920001 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6002.18005_none_314d791517204c15\iexplore.exe
[2010/09/09 09:50:19 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=3EF3476EF687FE18856A6148C6082452 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22760_none_2faac8b0334cb723\iexplore.exe
[2010/05/04 12:31:09 | 000,634,656 | —- | M] (Microsoft Corporation) MD5=424CEA5CB5999B2A6A3ED643EA20C97F – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22685_none_2f9a286433587091\iexplore.exe
[2010/09/08 00:26:34 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=4A719476A6393B1DCACFEB4F3AC6599C – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23067_none_129abb204913e7b2\iexplore.exe
[2011/07/23 05:42:34 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=4D08A4234D645EFCB30605CC0BFA87F4 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23216_none_12cfce3e48ec3cf4\iexplore.exe
[2009/10/27 09:11:10 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=4F9B04D546C23A295F3F0AE015BE51DB – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16945_none_2d5588d71cf3d5c4\iexplore.exe
[2010/11/02 00:03:13 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=5AB037B17F8A87D052F5A88E0D29A3C8 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18999_none_11f2d8e9300c984e\iexplore.exe
[2008/01/20 20:33:22 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=5B92133D3E7FB2644677686305E29E81 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18000_none_2f62000919fe80c9\iexplore.exe
[2010/03/11 10:40:22 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=67C769016A79E6FC65D1755E5D6ADAB3 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22653_none_2fb897943341ea10\iexplore.exe
[2009/12/18 09:42:45 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=6C8AC3469BBEFE194BB18B2D84D98252 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18385_none_2f1087cd1a3ad679\iexplore.exe
[2010/03/09 10:30:03 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=74E60C93D1C9A40354D839776CCF53DF – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18444_none_2f3ac9191a1b4a85\iexplore.exe
[2010/12/18 01:19:44 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=7852371DA9EFBC17B645558E23780EAC – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23111_none_12cacae648f0c11a\iexplore.exe
[2009/10/27 07:24:29 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=79B60CC26404F8FC2B351A7551D93C17 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18349_none_2f3fc8a51a16cc11\iexplore.exe
[2011/09/30 17:07:49 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=7ACBBC85FCE4989B533220FC3B291633 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19154_none_1218f12f2ff0da40\iexplore.exe
[2011/05/28 01:09:20 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=7EE10C5413AD7ED1AF9E8FAE1B58FC3E – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23181_none_127f1b72492984b1\iexplore.exe
[2009/07/18 06:16:45 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=7FCF4E704A48D95202F3E7A1E1A21412 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21089_none_2db7bd56362e80c9\iexplore.exe
[2009/10/27 07:22:34 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=80675329E0FD54F016C4F8A83C616349 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21148_none_2de1fea2360ef4d5\iexplore.exe
[2010/06/28 10:33:13 | 000,634,656 | —- | M] (Microsoft Corporation) MD5=867D06F3C473F65921F5EDF35866FF14 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22720_none_2fd60860332c475f\iexplore.exe
[2009/07/27 22:55:49 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=8BA2B7A05F88BE0D45237A0994AD8366 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22389_none_2f9e23da3354de78\iexplore.exe
[2010/11/02 01:13:47 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=92A17B0A89D14815AACC62CD190B6CE3 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23091_none_127449a04931a37b\iexplore.exe
[2010/03/09 10:32:31 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=97496AA4590CB101EF990060F7055F3D – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21242_none_2ddbfecc361459f2\iexplore.exe
[2011/02/22 01:18:28 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=9CE5543464432CA73134F170FA2BF823 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23143_none_12ac5bb64907479b\iexplore.exe
[2009/08/27 08:04:53 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=9E45866CD349219784CD5A7620DBEB8A – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16916_none_2d76f8e51cda9b48\iexplore.exe
[2009/07/27 22:55:49 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=9E6C1527D9A2C64BFD780AA23075380F – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18226_none_2f5265b91a094b03\iexplore.exe
[2009/08/27 07:43:41 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=A76AFC309AA55CD607A28AC41C7D7603 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21116_none_2e006dd235f86e54\iexplore.exe
[2009/03/08 15:09:24 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18702_none_124d22632fc9f126\iexplore.exe
[2010/06/28 10:19:40 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B6D7D54B736056991109F169737592C7 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18498_none_2f08baa51a403b96\iexplore.exe
[2010/12/18 00:28:35 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=B988D7F127B94BD5BF8356FE81B985C4 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19019_none_1249306b2fcbec08\iexplore.exe
[2009/08/27 07:38:13 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=BBF84F317553520BB78AEF7B047325C1 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18319_none_2f60386919fe783e\iexplore.exe
[2009/12/18 06:56:05 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=C071905121F6DE5F399550FC70138FEC – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16982_none_2d2748491d16f983\iexplore.exe
[2011/02/22 00:21:12 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=C1D36A2CBE0CEC4DF593DB1288CF586E – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19048_none_1227c05d2fe52684\iexplore.exe
[2011/11/03 00:23:19 | 000,638,240 | —- | M] (Microsoft Corporation) MD5=CCDB0B2D1F2E016966B1DB1097E24842 – C:\Program Files\Internet Explorer\iexplore.exe
[2011/11/03 00:23:19 | 000,638,240 | —- | M] (Microsoft Corporation) MD5=CCDB0B2D1F2E016966B1DB1097E24842 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19170_none_11ff502f3004acc6\iexplore.exe
[2010/09/08 00:02:42 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=D5A730DFDEAE005373E62BC2A866E3BB – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18975_none_120477992ffffb10\iexplore.exe
[2009/07/27 22:55:52 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=EA4BE33726155F89D89A3FE7142878E0 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16830_none_2d5b556b1cf03df9\iexplore.exe
[2009/07/18 05:55:42 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=EBEE9E4421F35CD861107DDA0266FBB1 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22475_none_2fa4f48433505a52\iexplore.exe
[2011/05/28 00:09:21 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=ED65737D70FDEAC29F738E77D2496EE5 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19088_none_11fc80ad30059648\iexplore.exe
[2009/04/11 13:10:03 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=F0B1CA517977BA2FF6DA33F1B966C488 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20996_none_2daa146a36391d73\iexplore.exe
[2009/12/18 06:27:08 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=F47755101C622AF18EE669ECEB3A97AD – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22585_none_2f9a267e3358736a\iexplore.exe
[2009/08/27 07:19:25 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=FE2DFF83B7753AC47C553EF7D5289BEE – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22508_none_2ff3a6bc3314dfe7\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2006/11/02 06:38:50 | 000,016,384 | —- | M] (Microsoft Corporation) MD5=3CCDDDBC49DEACA370F39A9F0E146A1B – C:\Windows\winsxs\x86_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_3b55b11a57da5590\iexplore.exe.mui
[2009/03/08 15:27:11 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 15:27:11 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Windows\winsxs\x86_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_8.0.6001.18702_en-us_207795706a90d6c1\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-058FE8F5.PF >
[2012/01/06 13:20:27 | 000,148,460 | —- | M] () MD5=90DD63A55B69F4FCCBA466B8BB162B32 – C:\Windows\Prefetch\IEXPLORE.EXE-058FE8F5.pf

< MD5 for: WINLOGON.EXE >
[2009/04/11 00:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\System32\winlogon.exe
[2009/04/11 00:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008/01/20 20:34:38 | 000,314,880 | —- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2008/01/20 20:35:28 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=26AC28BF50DC112BAA794A83E08588F0 – C:\Windows\System32\en-US\winlogon.exe.mui
[2008/01/20 20:35:28 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=26AC28BF50DC112BAA794A83E08588F0 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6001.18000_en-us_caf8918b0416723a\winlogon.exe.mui
[2006/11/02 06:38:26 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=A1D2856F3EC3C86EBBF1442B0245A8B3 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6000.16386_en-us_c8c1cf8f072b6166\winlogon.exe.mui

< MD5 for: WINLOGON.EXE-DEDDC9B6.PF >
[2012/01/06 16:22:16 | 000,032,196 | —- | M] () MD5=7DD38E0847A3A02A3710376312627885 – C:\Windows\Prefetch\WINLOGON.EXE-DEDDC9B6.pf

< MD5 for: WINLOGON.MOF >
[2006/09/18 15:41:56 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\System32\wbem\winlogon.mof
[2006/09/18 15:41:56 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\winsxs\x86_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.0.6000.16386_none_7e0207d478fccc94\winlogon.mof

========== Files - Unicode (All) ==========
[2010/11/15 09:52:24 | 000,000,000 | —D | M](C:\Users\Pat\Documents\?? ???) – C:\Users\Pat\Documents\넥슨 플러그
[2010/11/15 09:52:24 | 000,000,000 | —D | C](C:\Users\Pat\Documents\?? ???) – C:\Users\Pat\Documents\넥슨 플러그

========== Alternate Data Streams ==========

@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:BEB15613

< End of report >

EXTRAS.txt:

oldman960

Post #6January 6, 2012, 11:46 PM UTC

Hi Patrick's Mom,

It's ok we'll get an extra.txt next time.

You should be able to connect with IE after this fix. The .exe problem should also be fixed. Let me know if those 2 problems have been corrected.

Next, Right click on OTL.exe and chose Run as Administrator to run it

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:56990
FF - prefs.js..network.proxy.http_port: 56990
[2011/07/28 01:24:56 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\y9f7b9iy.default\extensions\{dd9e014f-d7e8-4066-8621-b1e2e12d120f}
O37 - HKCU\…exe [@ = 2U1] – "C:\Users\Pat\AppData\Local\sel.exe" -a "%1" %*
[2011/07/23 12:40:07 | 000,011,884 | -HS- | C] () – C:\Users\Pat\AppData\Local\15ho16v480qtjopuusb031qp2362v1q
[2011/07/23 12:40:07 | 000,011,884 | -HS- | C] () – C:\ProgramData\15ho16v480qtjopuusb031qp2362v1q
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\Users\Pat\AppData\Local\yqte.exe
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\ProgramData\rlwt.exe
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\ProgramData\rgwh.exe
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\ProgramData\poye.exe
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\Users\Pat\AppData\Local\oxqk.exe
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\Users\Pat\AppData\Local\obtb.exe
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\Users\Pat\AppData\Local\jwom.exe
[2011/07/23 12:40:06 | 000,000,000 | —- | C] () – C:\ProgramData\amih.exe
[2011/07/03 00:43:38 | 000,027,153 | —- | C] () – C:\Users\Pat\AppData\Roaming\BE00.3FB
[2011/05/16 18:03:10 | 000,013,454 | -HS- | C] () – C:\Users\Pat\AppData\Local\cmkfrvyt0bnt68542gr60wphcn5u5b
[2011/05/16 18:03:10 | 000,013,454 | -HS- | C] () – C:\ProgramData\cmkfrvyt0bnt68542gr60wphcn5u5b
[2010/03/17 21:19:09 | 000,010,390 | -HS- | C] () – C:\Users\Pat\AppData\Local\ru6R
[2010/03/17 21:19:09 | 000,010,390 | -HS- | C] () – C:\ProgramData\ru6R

:Reg

:Files
C:\Users\Pat\AppData\Local\sel.exe
C:\Users\Pat\AppData\Local\210ix62kx62y12744267ukpick4g023cen2wf40834k
C:\ProgramData\210ix62kx62y12744267ukpick4g023cen2wf40834k

:Commands
[createrestorepoint]
[emptytemp]
[purity]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log.

Next

Open OTL is it isn't still open

When the window appears, underneath Output at the top change it to Minimal Output
UNCheck the boxes beside LOP Check and Purity Check.
In the Extra Registry section change it to All
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

OTL fix log
Both OTL logs from the last scan

How's the computer?

Patrick's Mom

Post #7January 7, 2012, 5:10 AM UTC

I ran the first code fix, and here is the result:

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Prefs.js: 56990 removed from network.proxy.http_port
C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\y9f7b9iy.default\extensions\{dd9e014f-d7e8-4066-8621-b1e2e12d120f}\defaults\preferences folder moved successfully.
C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\y9f7b9iy.default\extensions\{dd9e014f-d7e8-4066-8621-b1e2e12d120f}\defaults folder moved successfully.
C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\y9f7b9iy.default\extensions\{dd9e014f-d7e8-4066-8621-b1e2e12d120f}\chrome folder moved successfully.
C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\y9f7b9iy.default\extensions\{dd9e014f-d7e8-4066-8621-b1e2e12d120f} folder moved successfully.
Registry key HKEY_CURRENT_USER\Software\Classes\.exe\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Classes\2U1\ deleted successfully.
HKEY_LOCAL_MACHINE\Software\Classes\.exe\\|exefile /E : value set successfully!
C:\Users\Pat\AppData\Local\15ho16v480qtjopuusb031qp2362v1q moved successfully.
C:\ProgramData\15ho16v480qtjopuusb031qp2362v1q moved successfully.
C:\Users\Pat\AppData\Local\yqte.exe moved successfully.
C:\ProgramData\rlwt.exe moved successfully.
C:\ProgramData\rgwh.exe moved successfully.
C:\ProgramData\poye.exe moved successfully.
C:\Users\Pat\AppData\Local\oxqk.exe moved successfully.
C:\Users\Pat\AppData\Local\obtb.exe moved successfully.
C:\Users\Pat\AppData\Local\jwom.exe moved successfully.
C:\ProgramData\amih.exe moved successfully.
C:\Users\Pat\AppData\Roaming\BE00.3FB moved successfully.
C:\Users\Pat\AppData\Local\cmkfrvyt0bnt68542gr60wphcn5u5b moved successfully.
C:\ProgramData\cmkfrvyt0bnt68542gr60wphcn5u5b moved successfully.
C:\Users\Pat\AppData\Local\ru6R moved successfully.
C:\ProgramData\ru6R moved successfully.
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\Users\Pat\AppData\Local\sel.exe not found.
C:\Users\Pat\AppData\Local\210ix62kx62y12744267ukpick4g023cen2wf40834k moved successfully.
C:\ProgramData\210ix62kx62y12744267ukpick4g023cen2wf40834k moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Pat
->Temp folder emptied: 31832 bytes
->Temporary Internet Files folder emptied: 39907 bytes
->Java cache emptied: 16197853 bytes
->FireFox cache emptied: 80905532 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 4655450 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2048 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 97.00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 01062012_222714

Files\Folders moved on Reboot…
File\Folder C:\Windows\temp\mcafee_sk8p2mDPghusPmG not found!

Registry entries deleted on Reboot…

Then the second run:

OTL,txt looks like this:

OTL logfile created on: 1/6/2012 10:46:05 PM - Run 5
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Pat\Contacts\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.49 Gb Total Physical Memory | 1.94 Gb Available Physical Memory | 55.72% Memory free
7.18 Gb Paging File | 5.51 Gb Available in Paging File | 76.77% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 146.87 Gb Total Space | 50.61 Gb Free Space | 34.46% Space Free | Partition Type: NTFS
Drive D: | 2.00 Gb Total Space | 1.12 Gb Free Space | 55.89% Space Free | Partition Type: NTFS
Drive E: | 4.23 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: PAT-PC | User Name: Pat | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Pat\Contacts\Desktop\OTL(2).exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\WinZip\WZQKPICK32.EXE (WinZip Computing, S.L.)
PRC - C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Windows\System32\consent.exe (Microsoft Corporation)
PRC - C:\Windows\System32\spool\drivers\w32x86\3\HP1006MC.EXE (Software 2000 Limited)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_820ff26a\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_820ff26a\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation)
PRC - C:\Program Files\Wave Systems Corp\SecureUpgrade.exe (Wave Systems Corp.)
PRC - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe (Smith Micro Software, Inc.)
PRC - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe (Smith Micro Software, Inc.)
PRC - C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (Dell Inc.)
PRC - C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe (Dell Inc.)
PRC - C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe (Broadcom Corporation)
PRC - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe (Broadcom Corporation)
PRC - C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe (Dell Inc.)
PRC - C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
PRC - C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe (Creative Technology Ltd.)
PRC - C:\Program Files\Dell\Ambient Light Sensor\AlsSvc.exe (Dell Inc.)
PRC - C:\Program Files\Intel\ASF Agent\ASFAgent.exe (Intel Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\311bc26c3ed83409589eb6bae0eeb86e\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\fecd1103dd16dc1192402770caf56575\System.Web.ni.dll ()
MOD - C:\Program Files\Mozilla Firefox\js3250.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6bc98e9b5eedaa8f71c5454d36a4b772\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\40da9084d0863e07d7ce55953833b8b0\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\c1c06a392871267db27f7cbc40e1c4fb\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1363115565fff5a641243a48f396f107\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\367c4043efc2f32d843cb588b0dc97fc\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\f9c36ea806e77872dce891c77b68fac3\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll ()
MOD - C:\Program Files\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\Windows\System32\bcmwlrmt.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Status Lib\1.6.210.21640__f25c74fcad379103\Status Lib.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\StatusInterfaces\1.6.210.21639__4ca2a925deedf37d\StatusInterfaces.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\SecurityDeviceInfoSetReg\1.6.210.21658__3a60a70419922317\SecurityDeviceInfoSetReg.dll ()
MOD - C:\Windows\System32\Wavx_ESC_Logging.dll ()
MOD - C:\Windows\System32\wxvault.dll ()
MOD - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\TspPopup_ENU.dll ()

========== Win32 Services (SafeList) ==========

SRV - (mfevtp) – C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe ()
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (BBSvc) – C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (BBUpdate) – C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (McProxy) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (npggsvc) – C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (STacSV) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_820ff26a\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_820ff26a\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (TdmService) – C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.)
SRV - (SMManager) – C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe (Smith Micro Software, Inc.)
SRV - (dcpsysmgrsvc) – C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (Dell Inc.)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (Credential Vault Host Control Service) – C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe (Broadcom Corporation)
SRV - (Credential Vault Host Storage) – C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe (Broadcom Corporation)
SRV - (buttonsvc32) – C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe (Dell Inc.)
SRV - (SecureStorageService) – C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe (Wave Systems Corp.)
SRV - (tcsd_win32.exe) – C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe ()
SRV - (alssvc) – C:\Program Files\Dell\Ambient Light Sensor\AlsSvc.exe (Dell Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ASFAgent) – C:\Program Files\Intel\ASF Agent\ASFAgent.exe (Intel Corporation)

========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfewfpk) – C:\Windows\System32\drivers\mfewfpk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\Windows\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfenlfk) – C:\Windows\System32\drivers\mfenlfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (cfwids) – C:\Windows\System32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (BCM42RLY) – C:\Windows\System32\drivers\bcm42rly.sys (Broadcom Corporation)
DRV - (HECI) Intel® – C:\Windows\system32\drivers\heci.sys (Intel Corporation)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (WavxDMgr) – C:\Windows\System32\drivers\WavxDMgr.sys (Wave Systems Corp.)
DRV - (cvusbdrv) – C:\Windows\System32\drivers\cvusbdrv.sys (Broadcom Corporation)
DRV - (USBCCID) – C:\Windows\System32\drivers\usbccid.sys (Microsoft Corporation)
DRV - (rismxdp) – C:\Windows\system32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\system32\drivers\rimsptsk.sys (REDC)
DRV - (rixdpcie) – C:\Windows\system32\drivers\rixdpe86.sys (REDC)
DRV - (risdpcie) – C:\Windows\system32\drivers\risdpe86.sys (REDC)
DRV - (rimspci) – C:\Windows\system32\drivers\rimspe86.sys (REDC)
DRV - (OA001Ufd) – C:\Windows\System32\drivers\OA001Ufd.sys (Creative Technology Ltd.)
DRV - (OA001Vid) – C:\Windows\System32\drivers\OA001Vid.sys (Creative Technology Ltd.)
DRV - (e1yexpress) Intel® – C:\Windows\System32\drivers\e1y6032.sys (Intel Corporation)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (PBADRV) – C:\Windows\system32\DRIVERS\PBADRV.sys (Dell Inc)
DRV - (NAL) – C:\Windows\System32\drivers\iqvw32.sys (Intel Corporation )
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USREL/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MDDR&ocid=bb7hp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3D C7 14 10 B8 16 40 4E AC 49 3A 44 E7 4F E3 08 [binary data]
IE - HKCU\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=DLRBDF&PC=MDDR&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.teefury.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {74c841e3-b59f-479e-8d7a-e26a942a87c8}:3.5
FF - prefs.js..keyword.URL: "http://www.bing.com/search?FORM=DLRBDF&PC=MDDR&q="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll File not found
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@winzip.com/Winzip Courier: C:\Program Files\WinZip Courier\npwzwmc.dll (WinZip Computing, S.L.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Pat\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2011/11/16 14:34:23 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{74c841e3-b59f-479e-8d7a-e26a942a87c8}: C:\Program Files\WinZip Courier\FFExt [2012/01/06 15:52:52 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.25\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/12/23 13:26:44 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.25\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/12/23 13:26:44 | 000,000,000 | —D | M]

[2009/10/02 00:52:54 | 000,000,000 | —D | M] (No name found) – C:\Users\Pat\AppData\Roaming\Mozilla\Extensions
[2012/01/06 22:39:40 | 000,000,000 | —D | M] (No name found) – C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\y9f7b9iy.default\extensions
[2012/01/06 22:39:40 | 000,000,000 | —D | M] (No name found) – C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\y9f7b9iy.default\extensions\{dd9e014f-d7e8-4066-8621-b1e2e12d120f}
[2011/10/29 11:16:10 | 000,000,000 | —D | M] (Default Manager) – C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\y9f7b9iy.default\extensions\DefaultManager@Microsoft
[2011/10/29 11:20:29 | 000,001,832 | —- | M] () – C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\y9f7b9iy.default\searchplugins\bing.xml
[2011/04/01 17:51:15 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/04/01 17:51:15 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2012/01/06 15:52:52 | 000,000,000 | —D | M] (WinZip Courier) – C:\PROGRAM FILES\WINZIP COURIER\FFEXT
[2011/04/14 13:01:38 | 000,024,376 | —- | M] (McAfee, Inc.) – C:\Program Files\mozilla firefox\components\Scriptff.dll
[2011/04/01 17:51:07 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

========== Chrome ==========

CHR - default_search_provider: ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =

O1 HOSTS File: ([2010/11/24 01:47:49 | 000,000,098 | —- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\Mcafee\SystemCore\ScriptSn.20110919182915.dll (McAfee, Inc.)
O2 - BHO: (WinZip Courier BHO) - {A8FB70FA-0FDF-4601-9DC4-BFA1B357204F} - C:\Program Files\WinZip Courier\wzwmcie.dll (WinZip Computing, S.L.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.)
O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (AIM Toolbar) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [ChangeTPMAuth] C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [DellConnectionManager] C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe (Smith Micro Software, Inc.)
O4 - HKLM..\Run: [DellControlPoint] C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.)
O4 - HKLM..\Run: [EmbassySecurityCheck] C:\Program Files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SecureUpgrade] C:\Program Files\Wave Systems Corp\SecureUpgrade.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [USCService] C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation)
O4 - HKLM..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [conhost] C:\Users\Pat\AppData\Roaming\Microsoft\conhost.exe File not found
O4 - HKCU..\Run: [PPS Accelerator] D:\PPS.tv\PPStream\ppsap.exe File not found
O4 - Startup: C:\Users\Pat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: pps.tv ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: ppstream.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: webscache.com ([]http in Trusted sites)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{33E54B51-85C7-43D9-9B1E-E62E246F8B3E}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{668F2365-103C-4367-8410-54A568D7C419}: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Pat\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Pat\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O30 - LSA: Authentication Packages - (wvauth) -C:\Windows\System32\wvauth.dll (Wave Systems Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 15:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2007/07/16 03:07:53 | 000,000,044 | R— | M] () - E:\Autorun.inf – [ CDFS ]
O33 - MountPoints2\{7fa058a5-7af0-11de-abfb-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{7fa058a5-7af0-11de-abfb-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Launch.exe – [2007/08/07 15:57:39 | 004,444,160 | R— | M] (Macrovision Corporation)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/01/06 22:31:50 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2012/01/06 16:12:14 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Pat\Contacts\Desktop\OTL(2).exe
[2012/01/06 15:52:53 | 000,000,000 | —D | C] – C:\ProgramData\WinZipEC
[2012/01/06 15:52:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Courier
[2012/01/06 15:52:52 | 000,000,000 | —D | C] – C:\Program Files\WinZip Courier
[2012/01/06 14:46:33 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
[2012/01/06 14:46:27 | 000,000,000 | —D | C] – C:\Users\Pat\AppData\Local\WinZip
[2012/01/06 14:46:15 | 000,000,000 | —D | C] – C:\ProgramData\WinZip
[2012/01/06 14:46:03 | 000,000,000 | —D | C] – C:\Program Files\WinZip
[2012/01/06 14:18:36 | 004,713,472 | —- | C] (AVAST Software) – C:\Users\Pat\Contacts\Desktop\aswMBR.exe
[2012/01/03 22:21:25 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/01/03 22:21:25 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis
[2011/12/28 18:58:52 | 000,000,000 | —D | C] – C:\Windows\System32\URTTEMP
[2011/12/28 18:30:00 | 000,000,000 | RH-D | C] – C:\Users\Pat\AppData\Roaming\SecuROM
[2011/12/28 16:18:41 | 000,229,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_1.dll
[2011/12/28 16:18:41 | 000,062,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xinput1_1.dll
[2011/12/28 16:18:32 | 002,388,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_30.dll
[2011/12/28 16:18:31 | 002,332,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_29.dll
[2011/12/28 16:18:31 | 000,230,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_0.dll
[2011/12/28 16:18:31 | 000,014,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\x3daudio1_0.dll
[2011/12/28 16:18:07 | 002,323,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_28.dll
[2011/12/28 16:18:05 | 002,319,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_27.dll
[2011/12/28 16:17:55 | 002,222,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_24.dll
[2011/12/28 15:55:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SEGA
[2011/12/28 15:55:38 | 000,000,000 | —D | C] – C:\Program Files\SEGA
[2011/12/13 16:09:56 | 003,602,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/12/13 16:09:56 | 003,550,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/12/13 16:09:55 | 000,429,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EncDec.dll
[2011/12/13 16:09:54 | 002,043,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/12/13 16:09:50 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\csrsrv.dll
[2011/12/13 16:09:46 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2011/12/13 16:09:31 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/12/13 16:09:29 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/12/13 16:09:27 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/12/13 16:09:27 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/12/13 16:09:26 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/12/13 16:09:26 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/12/13 16:09:26 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/12/13 16:09:25 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/12/13 16:09:25 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/12/13 16:09:25 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/12/13 16:09:25 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/12/13 16:09:25 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/12/13 16:09:25 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/12/13 16:09:24 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/12/13 16:09:24 | 000,174,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/12/13 16:09:24 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/12/13 16:09:24 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/12/13 16:09:24 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe

========== Files - Modified Within 30 Days ==========

[2012/01/06 22:38:51 | 000,027,649 | —- | M] () – C:\ProgramData\nvModes.001
[2012/01/06 22:38:40 | 000,000,000 | —- | M] () – C:\Users\Pat\AppData\Local\WavXMapDrive.bat
[2012/01/06 22:38:28 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/06 22:36:07 | 000,613,270 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/01/06 22:36:07 | 000,108,196 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/01/06 22:31:50 | 000,001,737 | —- | M] () – C:\Users\Public\Desktop\McAfee AntiVirus Plus.lnk
[2012/01/06 22:29:23 | 000,003,744 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/06 22:29:23 | 000,003,744 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/06 22:29:17 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/01/06 22:29:12 | 3745,411,072 | -HS- | M] () – C:\hiberfil.sys
[2012/01/06 22:19:40 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/06 16:12:22 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Pat\Contacts\Desktop\OTL(2).exe
[2012/01/06 14:46:33 | 000,001,856 | —- | M] () – C:\Users\Public\Desktop\WinZip.lnk
[2012/01/06 14:46:33 | 000,001,800 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
[2012/01/06 14:21:46 | 000,000,512 | —- | M] () – C:\Users\Pat\Contacts\Desktop\MBR.dat
[2012/01/06 14:19:53 | 004,713,472 | —- | M] (AVAST Software) – C:\Users\Pat\Contacts\Desktop\aswMBR.exe
[2012/01/03 22:21:25 | 000,001,894 | —- | M] () – C:\Users\Pat\Contacts\Desktop\HijackThis.lnk
[2012/01/03 21:35:09 | 000,027,649 | —- | M] () – C:\ProgramData\nvModes.dat
[2012/01/03 21:32:40 | 000,000,680 | —- | M] () – C:\Users\Pat\AppData\Local\d3d9caps.dat
[2012/01/01 16:25:16 | 000,000,272 | —- | M] () – C:\Sonic-and-Knuckles-(JUE)-[!].srm
[2012/01/01 15:55:11 | 000,000,980 | —- | M] () – C:\SonicandKnuckles3.srm
[2011/12/28 19:57:50 | 000,001,952 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Teutonic.lnk
[2011/12/28 19:40:03 | 000,001,952 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Crusades.lnk
[2011/12/28 19:36:47 | 000,001,962 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Britannia.lnk
[2011/12/28 19:33:41 | 000,001,952 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Americas.lnk
[2011/12/28 19:00:51 | 000,001,894 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War.lnk
[2011/12/28 18:24:27 | 000,002,148 | —- | M] () – C:\Users\Public\Desktop\Hyrule Total War.lnk
[2011/12/15 11:41:52 | 000,028,766 | —- | M] () – C:\Users\Pat\Documents\native americans final exaM.odt
[2011/12/14 22:00:26 | 000,021,082 | —- | M] () – C:\Users\Pat\Documents\The blackfoot tribes.odt
[2011/12/14 13:58:20 | 000,394,056 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/12/14 03:04:57 | 000,000,127 | —- | M] () – C:\Windows\System32\MRT.INI
[2011/12/12 22:12:50 | 000,001,536 | —- | M] () – C:\Users\Pat\Contacts\Desktop\NO$GBA.INP
[2011/12/08 08:16:52 | 000,024,674 | —- | M] () – C:\Users\Pat\Documents\Geologiy take hoime examisnaiton.odt

========== Files Created - No Company Name ==========

[2012/01/06 14:46:33 | 000,001,856 | —- | C] () – C:\Users\Public\Desktop\WinZip.lnk
[2012/01/06 14:46:30 | 000,001,800 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
[2012/01/06 14:21:46 | 000,000,512 | —- | C] () – C:\Users\Pat\Contacts\Desktop\MBR.dat
[2012/01/03 22:21:25 | 000,001,894 | —- | C] () – C:\Users\Pat\Contacts\Desktop\HijackThis.lnk
[2011/12/31 14:58:29 | 000,000,980 | —- | C] () – C:\SonicandKnuckles3.srm
[2011/12/28 19:57:50 | 000,001,952 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Teutonic.lnk
[2011/12/28 19:40:03 | 000,001,952 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Crusades.lnk
[2011/12/28 19:36:47 | 000,001,962 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Britannia.lnk
[2011/12/28 19:33:41 | 000,001,952 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Americas.lnk
[2011/12/28 18:24:27 | 000,002,148 | —- | C] () – C:\Users\Public\Desktop\Hyrule Total War.lnk
[2011/12/28 16:17:01 | 000,001,894 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War.lnk
[2011/12/21 12:01:03 | 000,000,680 | —- | C] () – C:\Users\Pat\AppData\Local\d3d9caps.dat
[2011/12/15 00:51:28 | 000,028,766 | —- | C] () – C:\Users\Pat\Documents\native americans final exaM.odt
[2011/12/14 22:00:24 | 000,021,082 | —- | C] () – C:\Users\Pat\Documents\The blackfoot tribes.odt
[2011/12/08 00:45:39 | 000,024,674 | —- | C] () – C:\Users\Pat\Documents\Geologiy take hoime examisnaiton.odt
[2011/09/29 10:11:14 | 000,000,127 | —- | C] () – C:\Windows\System32\MRT.INI
[2010/07/02 19:35:00 | 000,056,320 | —- | C] () – C:\Windows\System32\iyvu9_32.dll
[2010/07/02 19:28:22 | 000,000,039 | —- | C] () – C:\Windows\WININIT.INI
[2010/06/30 20:12:11 | 000,000,208 | —- | C] () – C:\Windows\TLCAPPS.INI
[2010/06/30 20:11:31 | 000,000,000 | —- | C] () – C:\Windows\setup32.INI
[2010/06/28 11:35:30 | 000,000,000 | —- | C] () – C:\Windows\PowerReg.dat
[2010/05/18 12:16:03 | 000,065,536 | —- | C] () – C:\Windows\System32\HPPLVS.dll
[2010/05/11 11:02:13 | 000,000,552 | —- | C] () – C:\Users\Pat\AppData\Local\d3d8caps.dat
[2009/09/16 20:32:38 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/09/16 20:32:38 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/08/31 18:43:20 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2009/08/30 13:01:10 | 000,012,288 | —- | C] () – C:\Windows\impborl.dll
[2009/08/07 21:30:08 | 000,000,036 | -H– | C] () – C:\Windows\System32\swk.ini
[2009/08/07 21:27:49 | 000,014,848 | —- | C] () – C:\Users\Pat\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/08/01 13:13:07 | 000,027,649 | —- | C] () – C:\ProgramData\nvModes.001
[2009/08/01 13:05:21 | 000,027,649 | —- | C] () – C:\ProgramData\nvModes.dat
[2009/08/01 10:06:42 | 000,000,000 | —- | C] () – C:\Users\Pat\AppData\Local\WavXMapDrive.bat
[2009/07/27 20:32:24 | 000,055,808 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2009/07/27 20:32:24 | 000,024,064 | —- | C] () – C:\Windows\System32\WLTRYSVC.EXE
[2009/07/27 20:21:57 | 000,279,888 | —- | C] () – C:\Windows\System32\brcmbsp.dll
[2009/07/27 20:19:21 | 000,080,368 | —- | C] () – C:\Windows\System32\pbadrvdll.dll
[2009/07/08 19:03:02 | 000,058,880 | —- | C] () – C:\Windows\System32\bdmpegv.dll
[2009/04/22 08:58:30 | 000,126,976 | —- | C] () – C:\Windows\System32\DTMessageLib.dll
[2009/04/11 13:18:37 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/04/11 11:26:38 | 000,000,000 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2009/04/10 11:01:12 | 000,143,360 | R— | C] () – C:\Windows\System32\preflib.dll
[2009/02/26 15:54:52 | 000,098,304 | —- | C] () – C:\Windows\System32\Internationalization_tr.dll
[2009/02/26 15:54:50 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_ro.dll
[2009/02/26 15:54:48 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_pt-BR.dll
[2009/02/26 15:54:48 | 000,098,304 | —- | C] () – C:\Windows\System32\Internationalization_hu.dll
[2009/02/26 15:54:46 | 000,094,208 | —- | C] () – C:\Windows\System32\Internationalization_he.dll
[2009/02/26 15:54:44 | 000,106,496 | —- | C] () – C:\Windows\System32\Internationalization_el.dll
[2009/02/26 15:54:44 | 000,098,304 | —- | C] () – C:\Windows\System32\Internationalization_fi.dll
[2009/02/26 15:54:42 | 000,098,304 | —- | C] () – C:\Windows\System32\Internationalization_cs.dll
[2009/02/26 15:54:40 | 000,094,208 | —- | C] () – C:\Windows\System32\Internationalization_ar.dll
[2009/02/26 15:54:40 | 000,081,920 | —- | C] () – C:\Windows\System32\Internationalization_zh-CHT.dll
[2009/02/26 15:54:38 | 000,081,920 | —- | C] () – C:\Windows\System32\Internationalization_zh-CHS.dll
[2009/02/26 15:54:36 | 000,098,304 | —- | C] () – C:\Windows\System32\Internationalization_sv.dll
[2009/02/26 15:54:34 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_pt.dll
[2009/02/26 15:54:34 | 000,098,304 | —- | C] () – C:\Windows\System32\Internationalization_ru.dll
[2009/02/26 15:54:32 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_pl.dll
[2009/02/26 15:54:32 | 000,098,304 | —- | C] () – C:\Windows\System32\Internationalization_no.dll
[2009/02/26 15:54:30 | 000,106,496 | —- | C] () – C:\Windows\System32\Internationalization_nl.dll
[2009/02/26 15:54:28 | 000,090,112 | —- | C] () – C:\Windows\System32\Internationalization_ja.dll
[2009/02/26 15:54:28 | 000,086,016 | —- | C] () – C:\Windows\System32\Internationalization_ko.dll
[2009/02/26 15:54:26 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_it.dll
[2009/02/26 15:54:24 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_fr.dll
[2009/02/26 15:54:24 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_es.dll
[2009/02/26 15:54:20 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_de.dll
[2009/02/26 15:54:20 | 000,102,400 | —- | C] () – C:\Windows\System32\Internationalization_da.dll
[2009/02/17 08:51:28 | 000,540,672 | —- | C] () – C:\Windows\System32\AmRes_es.dll
[2009/02/17 08:51:28 | 000,512,000 | —- | C] () – C:\Windows\System32\AmRes_en.dll
[2009/02/17 08:51:26 | 000,540,672 | —- | C] () – C:\Windows\System32\AmRes_fr.dll
[2009/02/17 08:51:24 | 000,536,576 | —- | C] () – C:\Windows\System32\AmRes_it.dll
[2009/02/17 08:51:24 | 000,520,192 | —- | C] () – C:\Windows\System32\AmRes_ja.dll
[2009/02/17 08:51:24 | 000,503,808 | —- | C] () – C:\Windows\System32\AmRes_ko.dll
[2009/02/17 08:51:22 | 000,565,248 | —- | C] () – C:\Windows\System32\AmRes_ru.dll
[2009/02/17 08:51:22 | 000,524,288 | —- | C] () – C:\Windows\System32\AmRes_pt-BR.dll
[2009/02/17 08:51:20 | 000,520,192 | —- | C] () – C:\Windows\System32\AmRes_fi.dll
[2009/02/17 08:51:20 | 000,479,232 | —- | C] () – C:\Windows\System32\AmRes_zh-CHT.dll
[2009/02/17 08:51:20 | 000,475,136 | —- | C] () – C:\Windows\System32\AmRes_zh-CHS.dll
[2009/02/17 08:51:18 | 000,516,096 | —- | C] () – C:\Windows\System32\AmRes_da.dll
[2009/02/17 08:51:16 | 000,540,672 | —- | C] () – C:\Windows\System32\AmRes_nl.dll
[2009/02/17 08:51:16 | 000,528,384 | —- | C] () – C:\Windows\System32\AmRes_pl.dll
[2009/02/17 08:51:16 | 000,512,000 | —- | C] () – C:\Windows\System32\AmRes_no.dll
[2009/02/17 08:51:14 | 000,516,096 | —- | C] () – C:\Windows\System32\AmRes_sv.dll
[2009/02/17 08:51:04 | 000,528,384 | —- | C] () – C:\Windows\System32\AmRes_cs.dll
[2009/02/17 08:51:04 | 000,512,000 | —- | C] () – C:\Windows\System32\AmRes_ar.dll
[2009/02/17 08:51:02 | 000,536,576 | —- | C] () – C:\Windows\System32\AmRes_el.dll
[2009/02/17 08:51:02 | 000,503,808 | —- | C] () – C:\Windows\System32\AmRes_he.dll
[2009/02/17 08:51:00 | 000,532,480 | —- | C] () – C:\Windows\System32\AmRes_pt-PT.dll
[2009/02/17 08:51:00 | 000,528,384 | —- | C] () – C:\Windows\System32\AmRes_hu.dll
[2009/02/17 08:50:58 | 000,532,480 | —- | C] () – C:\Windows\System32\AmRes_ro.dll
[2009/02/17 08:50:58 | 000,524,288 | —- | C] () – C:\Windows\System32\AmRes_tr.dll
[2009/02/17 07:46:36 | 000,544,768 | —- | C] () – C:\Windows\System32\AmRes_de.dll
[2009/01/06 15:25:36 | 000,010,752 | —- | C] () – C:\Windows\System32\Wavx_ESC_Logging.dll
[2008/12/22 13:13:54 | 000,249,856 | —- | C] () – C:\Windows\System32\wxvault.dll
[2008/10/06 17:36:56 | 000,839,680 | —- | C] () – C:\Windows\System32\DemoLicense.dll
[2008/03/25 08:46:00 | 000,077,536 | —- | C] () – C:\Windows\System32\xltZlib.dll
[2007/04/19 04:52:16 | 000,080,720 | —- | C] () – C:\Windows\System32\AsfBios.dll
[2007/04/19 04:28:10 | 000,025,424 | —- | C] () – C:\Windows\System32\drivers\netamsg.dll
[2006/11/02 06:53:49 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 06:44:53 | 000,394,056 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 04:33:01 | 000,613,270 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 04:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 04:33:01 | 000,108,196 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 04:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 04:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 04:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 02:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 02:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 01:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 01:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/06/30 11:58:44 | 000,176,128 | R— | C] () – C:\Windows\System32\bioapi_mds300.dll
[2006/06/30 11:58:44 | 000,126,976 | R— | C] () – C:\Windows\System32\bioapi100.dll
[2004/09/10 12:34:00 | 000,917,504 | —- | C] () – C:\Windows\System32\lmgr10.dll
[2004/09/10 12:34:00 | 000,057,344 | —- | C] () – C:\Windows\System32\ADsSecurity.dll

========== Files - Unicode (All) ==========
[2010/11/15 09:52:24 | 000,000,000 | —D | M](C:\Users\Pat\Documents\?? ???) – C:\Users\Pat\Documents\넥슨 플러그
[2010/11/15 09:52:24 | 000,000,000 | —D | C](C:\Users\Pat\Documents\?? ???) – C:\Users\Pat\Documents\넥슨 플러그

========== Alternate Data Streams ==========

@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:BEB15613

< End of report >

The EXTRAS.txt looks like this:

OTL Extras logfile created on: 1/6/2012 10:46:05 PM - Run 5
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Pat\Contacts\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.49 Gb Total Physical Memory | 1.94 Gb Available Physical Memory | 55.72% Memory free
7.18 Gb Paging File | 5.51 Gb Available in Paging File | 76.77% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 146.87 Gb Total Space | 50.61 Gb Free Space | 34.46% Space Free | Partition Type: NTFS
Drive D: | 2.00 Gb Total Space | 1.12 Gb Free Space | 55.89% Space Free | Partition Type: NTFS
Drive E: | 4.23 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: PAT-PC | User Name: Pat | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (All) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.bat [@ = batfile] – "%1" %*
.chm [@ = chm.file] – C:\Windows\hh.exe (Microsoft Corporation)
.cmd [@ = cmdfile] – "%1" %*
.com [@ = comfile] – "%1" %*
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.exe [@ = exefile] – "%1" %*
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.hta [@ = htafile] – C:\Windows\System32\mshta.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.inf [@ = inffile] – C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.ini [@ = inifile] – C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] – C:\Windows\System32\rundll32.exe (Microsoft Corporation)
.js [@ = JSFile] – C:\Windows\System32\WScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] – C:\Windows\System32\WScript.exe (Microsoft Corporation)
.pif [@ = piffile] – "%1" %*
.reg [@ = regfile] – C:\Windows\regedit.exe (Microsoft Corporation)
.scr [@ = scrfile] – "%1" /S
.txt [@ = txtfile] – C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.vbe [@ = VBEFile] – C:\Windows\System32\WScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] – C:\Windows\System32\WScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] – C:\Windows\System32\WScript.exe (Microsoft Corporation)
.wsh [@ = WSHFile] – C:\Windows\System32\WScript.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
batfile [open] – "%1" %*
batfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
chm.file [open] – "%SystemRoot%\hh.exe" %1 (Microsoft Corporation)
cmdfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
cmdfile [open] – "%1" %*
cmdfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] – C:\Windows\system32\mshta.exe "%1" %* (Microsoft Corporation)
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
inffile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
inffile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
inifile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
inifile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile – C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)
jsfile [open] – C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsfile [print] – C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)
jsefile – C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)
jsefile [open] – C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsefile [print] – C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile – %SystemRoot%\system32\notepad.exe "%1" (Microsoft Corporation)
regfile [open] – regedit.exe "%1" (Microsoft Corporation)
regfile [merge] – Reg Error: Key error.
regfile [print] – %SystemRoot%\system32\notepad.exe /p "%1" (Microsoft Corporation)
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
txtfile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
txtfile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
txtfile [printto] – %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)
vbefile – "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
vbefile [open] – "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
vbefile [print] – "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
vbsfile – "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
vbsfile [open] – "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
vbsfile [print] – "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
wsffile – "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
wsffile [open] – "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
wsffile [print] – "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
wshfile [open] – "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2D5CDB5B-24D0-4104-908E-D6B082A02396}" = lport=2869 | protocol=6 | dir=in | app=system |
"{9F8D2359-04C3-4611-98A1-26BF3B933726}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05128281-0438-4E44-BDBE-7FCAA6A03A48}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{173D0E09-BFA3-433A-AAFF-53E096AC8F05}" = protocol=17 | dir=in | app=c:\program files\microsoft games\age of empires iii\age3y.exe |
"{1F5BDB5F-427A-4387-A322-0B24057539A2}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{23CE22F3-84B8-421D-A12F-5EF235E579D6}" = protocol=6 | dir=in | app=c:\program files\aim\aim.exe |
"{23FA1FFE-2603-4600-B2D0-DD69F675810E}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{3ECE04F1-553F-4146-8601-41D51B463E8D}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{420F21E6-9FC7-476C-A122-8FCEDB73AAB1}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\pdvddxsrv.exe |
"{5ADCDF6F-293A-4C61-B9C7-5F80B70C7BE5}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{641BA14C-3609-4E3D-93F6-DC68CB78B019}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\hp1006mc.exe |
"{69062C4B-C3A0-4C7A-BBD9-0F4B68E7BC1D}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{69AD2EE9-25E3-4965-B55A-7874F898E8B0}" = protocol=6 | dir=in | app=c:\program files\microsoft games\age of empires iii\age3x.exe |
"{712C0BCD-E2C0-4911-8C6F-C146F244B4C0}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{79115D63-94D0-4CDA-87E4-971EB9D36D81}" = protocol=17 | dir=in | app=c:\program files\microsoft games\age of empires iii\age3x.exe |
"{7C36CAD5-F6C3-4AC0-BF0C-D48ECA79E86F}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{7CE9C38A-7345-438F-8DDF-85712CD0CF2E}" = protocol=6 | dir=in | app=c:\program files\microsoft games\age of empires iii\age3y.exe |
"{8C5AF45F-CC6D-434E-A21B-95799617B9F2}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\hp1006mc.exe |
"{91F5B763-B607-4432-AF65-B952E03484F7}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{945817F6-38D1-45E6-9996-DE95BBF2DE92}" = dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{B935B986-C31C-4672-B1E5-10A13CB4A13D}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{BC047E26-F2D5-407A-88B4-85938961B511}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{BF6C7D7F-0306-451D-BFEA-74225DDB862A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C4C34B1B-6F9A-410D-86CC-6E366187AF33}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{C78631D8-6EAC-49F7-A9C4-EA5A9D43751B}" = protocol=17 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe |
"{CD88E44B-7724-4AD8-A33A-0C283A6E879C}" = protocol=17 | dir=in | app=c:\program files\aim\aim.exe |
"{D41B1B59-ECE4-4A94-ACF5-0D090198F49B}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{D65C970B-CC58-44D6-9D28-2DB1F9FC80AD}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{D90BC12F-5C7E-4775-B99C-98474E032BC8}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{F914F5B0-16BF-4E59-BB3B-C180244204FA}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\powerdvd.exe |
"{FECBC724-A526-4E10-A650-BE1B085EB0FE}" = protocol=6 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe |
"TCP Query User{0E6CC991-DFA1-4E7C-9EC1-D566616DC538}C:\program files\lucasarts\star wars galactic battlegrounds saga\game\battlegrounds_x1.exe" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars galactic battlegrounds saga\game\battlegrounds_x1.exe |
"TCP Query User{203E858A-550D-4152-B8A0-BA61D4A7CCE5}C:\nexon\vindictus\en-us\nmservice.exe" = protocol=6 | dir=in | app=c:\nexon\vindictus\en-us\nmservice.exe |
"TCP Query User{3C3E48B0-EE80-45C0-B50D-767B0E3705BA}C:\users\pat\contacts\desktop\age of mythology\aom.exe" = protocol=6 | dir=in | app=c:\users\pat\contacts\desktop\age of mythology\aom.exe |
"TCP Query User{42B96B34-23A3-48F6-8BAF-5ED69CC75A92}C:\program files\lucasarts\star wars galactic battlegrounds saga\game\battlegrounds.exe" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars galactic battlegrounds saga\game\battlegrounds.exe |
"TCP Query User{8B59B9DB-510B-4F3D-B45E-643F64B37E8C}C:\nexon\vindictus\en-us\nmservice.exe" = protocol=6 | dir=in | app=c:\nexon\vindictus\en-us\nmservice.exe |
"TCP Query User{8FCD378D-E8AE-4358-8DAF-FC4FCF81EF4B}C:\users\pat\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\pat\program files\dna\btdna.exe |
"TCP Query User{B1903BA0-C013-4097-8F78-3970B0EADE9F}C:\users\pat\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\pat\program files\dna\btdna.exe |
"TCP Query User{EDBA7BAE-DEA5-4A92-A368-FD71C705C4FB}C:\program files\lucasarts\star wars galactic battlegrounds saga\game\battlegrounds_x1.exe" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars galactic battlegrounds saga\game\battlegrounds_x1.exe |
"UDP Query User{025BF687-FFAE-43CE-A167-E44036761C61}C:\program files\lucasarts\star wars galactic battlegrounds saga\game\battlegrounds.exe" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars galactic battlegrounds saga\game\battlegrounds.exe |
"UDP Query User{0A89863C-14FC-4F46-9456-9C4219566277}C:\users\pat\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\pat\program files\dna\btdna.exe |
"UDP Query User{1E46DA87-C59B-4C50-B2A9-80CE5D24F82C}C:\nexon\vindictus\en-us\nmservice.exe" = protocol=17 | dir=in | app=c:\nexon\vindictus\en-us\nmservice.exe |
"UDP Query User{3477C977-4216-4D9B-BB6E-ED319E0A5A4D}C:\nexon\vindictus\en-us\nmservice.exe" = protocol=17 | dir=in | app=c:\nexon\vindictus\en-us\nmservice.exe |
"UDP Query User{655E4FE9-75C0-4996-9019-3BFF8C3D5EA4}C:\users\pat\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\pat\program files\dna\btdna.exe |
"UDP Query User{78B8CB36-8117-47A1-8663-70F472E6BE88}C:\program files\lucasarts\star wars galactic battlegrounds saga\game\battlegrounds_x1.exe" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars galactic battlegrounds saga\game\battlegrounds_x1.exe |
"UDP Query User{7F9800BB-CB29-42FB-B0DB-0E0BC94A4030}C:\program files\lucasarts\star wars galactic battlegrounds saga\game\battlegrounds_x1.exe" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars galactic battlegrounds saga\game\battlegrounds_x1.exe |
"UDP Query User{90F59E27-A25B-4279-8BAB-5AF6046F3F95}C:\users\pat\contacts\desktop\age of mythology\aom.exe" = protocol=17 | dir=in | app=c:\users\pat\contacts\desktop\age of mythology\aom.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{020D8396-D6D9-4B53-A9A1-83C47E2E27AA}" = Windows Live Call
"{02A10468-2F1C-447C-AD8E-4DEDDEA25AE2}" = Medieval II Total War : Kingdoms : Crusades
"{0394CDC8-FABD-4ED8-B104-03393876DFDF}" = Roxio Creator Tools
"{07159635-9DFE-4105-BFC0-2817DB540C68}" = Roxio Activation Module
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"{095B1DCF-5E8B-47EC-9B18-481918A731DB}" = Microsoft Default Manager
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"{0D397393-9B50-4C52-84D5-77E344289F87}" = Roxio Creator Data
"{167E549E-5E88-4F52-A759-C37335D18F6B}" = Install Hyrule Total War 1.0
"{16D0F2D2-242C-4885-BEF1-4B1655C141AE}" = Bing Bar
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{2220CF3A-EBD6-4070-94D0-0C7337B537A7}" = All Day Battery Life Configuration
"{2223FC2F-B862-4F83-BC9E-DDF2DADF2859}" = Intel® Network Connections 13.0.42.0
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2484631E-A7B3-4847-ACBB-4D881E6E9D5A}" = Dell ControlPoint Connection Manager
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 22
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3138EAD3-700B-4A10-B617-B3F8096EE30D}" = Dell Edoc Viewer
"{3A6BE9F4-5FC8-44BB-BE7B-32A29607FEF6}" = Preboot Manager
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{4994A7CB-2BF4-4664-8FCE-DB66055ECEBC}" = Broadcom USH Host Components
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"{51D386C4-0227-46A9-AC45-61F0A50E7AFF}" = Rome - Total War
"{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"{5AF4F4C5-C71C-418F-B0B1-3903A345BD71}" = Ambient Light Sensor
"{619CDD8A-14B6-43A1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{63C1109E-D977-49ED-BCE3-D00D0BF187D6}" = Windows Live Mail
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module
"{67436268-FB14-4DFB-AE73-1B1EFA2B0213}" = Dell ControlPoint System Manager
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}" = Windows Live Writer
"{6D3963B0-E13B-4FC3-B0FF-506A304BB043}" = Cisco EAP-FAST Module
"{6EA8A52B-8EA1-4A59-85AB-48132299061A}" = Intel® PRO Alerting Agent
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{75983B66-804C-40D1-BA13-64DAF652A6F1}" = Medieval II Total War : Kingdoms : Americas
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7AEE1963-7001-4C37-BC20-2FAEB74AA41C}" = Medieval II Total War : Kingdoms : Teutonic
"{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}" = Age of Empires III
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module
"{83FFCFC7-88C6-41C6-8752-958A45325C82}" = Roxio Creator Audio
"{86A8FD76-3268-4102-9674-7118881EC2C0}" = Wave Infrastructure Installer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{88038160-9BCB-47BE-A5C3-5CE2DC115509}" = Star Wars Galaxies
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{9593C6E5-205E-45C3-B785-05CF146CA76A}" = biolsp patch
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{99E39418-A6C1-4D2B-AF9F-9152C93F03A9}" = Dell Control Point
"{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}" = iTunes
"{9BCAC864-84C0-409F-8D12-364109622D18}_is1" = Europa Barbarorum 1.1
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F655A94-0B80-4C15-BF18-8273A7A2CC9D}" = Install Hyrule Total War Core Files
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A093D83F-429A-4AB2-A0CD-1F7E9C7B764A}" = Trusted Drive Manager
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABBA2EA4-740E-4052-902B-9CA70B081E3F}" = Dell Embassy Trust Suite by Wave Systems
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
"{AF7E4468-E364-4991-BC2A-6E8293E1055B}" = BioAPI Framework
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{BAA11826-70EF-4E44-9E97-8476793E022F}" = Launchpad Enhanced
"{BB93D30B-B395-44BB-A9ED-A0E057F07E53}" = NTRU TCG Software Stack
"{BC52E419-B185-488F-9973-049A88E5DCBE}" = Gemalto
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C0698BDA-0D29-40EE-8570-A31106DF9AB1}" = Medieval II Total War
"{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}" = Apple Mobile Device Support
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CD95F661-A5C4-11AF-B2CC-ABCD21A325B8}" = WinZip Courier
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240CA}" = WinZip 16.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEDDEE73-3D36-41C2-AA40-29355D9FBD63}" = Medieval II Total War : Kingdoms : Britannia
"{D1E829E9-88B8-47C6-A75E-0D40E2C09D50}" = Secure Update
"{D9D754A1-EAC5-406C-A28B-C49B1E846711}" = Windows Live Essentials
"{DAC07FB2-2C63-44B2-8344-AB7542C936D2}" = DCP32MMWrapper
"{DB58A549-42CA-4081-986A-633479DE413F}" = SO32MMWrapper
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F4487649-7368-4217-AEA3-1E04DB3E2C5C}" = Dell ControlPoint Security Manager
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F73A5B18-EB75-4B2C-B32D-9457576E2417}" = Windows Live Photo Gallery
"{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}" = Windows Live Sync
"{FF1DDCF4-3A28-4F7F-96D8-E3F4BD1C1702}" = Dell Security Device Driver Pack
"9D57DE505B6D8C710EF3B74BE638DBB936EED8A3" = Windows Driver Package - Dell Inc. PBADRV System (01/07/2008 1.0.1.5)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AIM Toolbar" = AIM Toolbar
"AU10_is1" = Advanced Uninstaller PRO - Version 10
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"AVS4YOU Video Converter 6_is1" = AVS Video Converter 6
"BandiMPEG1" = Bandisoft MPEG-1 Decoder
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card Utility
"CleanUp!" = CleanUp!
"Creative OA001" = Integrated Webcam Driver (1.06.03.0309)
"Dell Webcam Central" = Dell Webcam Central
"DVD Player_is1" = DVD Player 1.0
"EB Documentation_is1" = EB Documentation 1.1
"EB Trivial Script_is1" = EB Trivial Script 0.125
"ESET Online Scanner" = ESET Online Scanner v3
"GOM Player" = GOM Player
"HijackThis" = HijackThis 2.0.2
"InstallShield_{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"InstallShield_{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"InstallShield_{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"InstallShield_{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"InstallShield_{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"InstallShield_{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}" = Age of Empires III
"InstallShield_{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties
"InstallShield_{D1E829E9-88B8-47C6-A75E-0D40E2C09D50}" = Secure Update
"InstallShield_{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"InstallShield_{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"InstallShield_{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.6.25)" = Mozilla Firefox (3.6.25)
"MSC" = McAfee AntiVirus Plus
"NVIDIA Drivers" = NVIDIA Drivers
"PROSetDX" = Intel® Network Connections 13.0.42.0
"Recruitment Viewer_is1" = Recruitment Viewer 0.9
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"Sonic and Knuckles 2_is1" = Sonic and Knuckles 2 1.0
"Sonic and Knuckles 3_is1" = Sonic and Knuckles 3 1.0
"Sonic and Knuckles_is1" = Sonic and Knuckles
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/5/2012 3:57:03 AM | Computer Name = Pat-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 1/5/2012 3:57:03 AM | Computer Name = Pat-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 1/6/2012 2:58:22 PM | Computer Name = Pat-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 1/6/2012 2:58:22 PM | Computer Name = Pat-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 1/6/2012 6:21:34 PM | Computer Name = Pat-PC | Source = Application Hang | ID = 1002
Description = The program OTL(2).exe version 3.2.31.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Problem Reports and Solutions control panel. Process
ID: 1638 Start Time: 01ccccc11e0aea40 Termination Time: 0

Error - 1/7/2012 12:29:24 AM | Computer Name = Pat-PC | Source = WinMgmt | ID = 10
Description =

Error - 1/7/2012 12:31:51 AM | Computer Name = Pat-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 1/7/2012 12:31:51 AM | Computer Name = Pat-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 1/7/2012 12:39:14 AM | Computer Name = Pat-PC | Source = Wave TCG Client Services | ID = 123
Description = The NTRU TSS is not running, Wave Software is unable to communicate
to TPM

Error - 1/7/2012 12:39:14 AM | Computer Name = Pat-PC | Source = Wave TCG Client Services | ID = 123
Description = The NTRU TSS is not running, Wave Software is unable to communicate
to TPM

[ Broadcom Wireless LAN Events ]
Error - 12/16/2011 3:06:47 AM | Computer Name = Pat-PC | Source = WLAN-Tray | ID = 0
Description = 01:06:47, Fri, Dec 16, 11 Error - User "" does not have administrative
privileges on this system

[ System Events ]
Error - 1/3/2012 6:29:22 PM | Computer Name = Pat-PC | Source = bowser | ID = 8003
Description =

Error - 1/3/2012 11:33:59 PM | Computer Name = Pat-PC | Source = BROWSER | ID = 8032
Description =

Error - 1/3/2012 11:39:16 PM | Computer Name = Pat-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 1/3/2012 11:47:55 PM | Computer Name = Pat-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

Error - 1/5/2012 3:54:38 AM | Computer Name = Pat-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 1/5/2012 4:15:07 AM | Computer Name = Pat-PC | Source = iaStor | ID = 262153
Description = The device, \Device\Ide\iaStor0, did not respond within the timeout
period.

Error - 1/6/2012 6:24:27 PM | Computer Name = Pat-PC | Source = DCOM | ID = 10010
Description =

Error - 1/7/2012 12:27:15 AM | Computer Name = Pat-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 1/7/2012 12:29:25 AM | Computer Name = Pat-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 1/7/2012 12:40:26 AM | Computer Name = Pat-PC | Source = DCOM | ID = 10010
Description =

< End of report >

The executables seem to be running fine.

IE is running well too!

The resolution of the icons is fixed too. Things seem pretty stable! Thanks a ton.

Is there anything else I should do?

oldman960

Post #8January 7, 2012, 6:05 AM UTC

Hi Patrick's Mom,

Your java is out of date. Go to Start > Control Panel , switch to Classic View if it isn't already.

Locate the Java icon (it looks like a coffee cup)
double click it to open it
click the Update tab
Click update now

Next, Right click on OTL.exe and chose Run as Administrator to run it

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:OTL
O4 - HKCU..\Run: [conhost] C:\Users\Pat\AppData\Roaming\Microsoft\conhost.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
[2009/04/11 11:26:38 | 000,000,000 | —- | C] () – C:\Windows\System32\atiicdxx.dat

:Files

:Commands
[createrestorepoint]
[emptytemp]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log.

Next

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

Click the Update tab
Click Check for Updates
If an update is found, it will download and install the latest version.
The program will close to update and reopen.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Next

As a Vista/Win7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.

Do not use this instance of your browser for anything besides doing this scan
When the scan is complete and the results saved, close that instance of your browser
Open a new one the usual way and post the results in this topic.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
Click Start
Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
Click Scan.
Wait for the scan to finish.
When the scan completes, click List of found threats
click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
Include the contents of this report in your next reply

Note - when ESET doesn't find any threats, no report will be created.
Push the back button.
Push Finish
Re-enable your Antivirus software.

Please post back with

OTL fix log
MBAM log
ESET log if one was produced

How's the computer?

Patrick's Mom

Post #9January 7, 2012, 4:03 PM UTC

Thank you so much for helping me with this. The PC is running better than ever. Here is the log of the OTL run: All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\conhost deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoControlPanel deleted successfully. C:\Windows\System32\atiicdxx.dat moved successfully. ========== FILES ========== ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Pat ->Temp folder emptied: 37218 bytes ->Temporary Internet Files folder emptied: 33572 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 27317633 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 456 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 26.00 mb OTL by OldTimer - Version 3.2.31.0 log created on 01072012_013649 Files\Folders moved on Reboot… Registry entries deleted on Reboot… ANd here is the MBAM log: Malwarebytes Anti-Malware 1.60.0.1800 www.malwarebytes.org Database version: v2012.01.06.06 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 8.0.6001.19170 Pat :: PAT-PC [administrator] 1/7/2012 1:46:41 AM mbam-log-2012-01-07 (01-46-41).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 177630 Time elapsed: 5 minute(s), 40 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) And here is the ESET log: But I think I forgot to uncheck the fix button, so it cleaned the threats off. C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Default\lmkeehildgehdofiiphogimmomnnbmki\contentscript.js Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined C:\_OTL\MovedFiles\01062012_222714\C_Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\y9f7b9iy.default\extensions\{dd9e014f-d7e8-4066-8621-b1e2e12d120f}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined Thanks so much! I will send you guys a donation for sure!

oldman960

Post #10January 7, 2012, 5:15 PM UTC

Hi Patrick's Mom,

From your desktop, please delete, if present

any notepads/logs that we created
mbr.dat
mbr.zip
aswMBR.exe

First

*We'll reset your restore points

Click on the Start button to open your Start Menu.
Click on the Control Panel menu option.
Click on the System and Maintenance menu option.
Click on the System menu option.
Click on System Protection in the left-hand task list.
Create the manual restore point you should click on the Create button. When you press this button a prompt will appear asking you to provide a title for this manual restore point.
Type in a title for the manual restore point and press the Create button.
Close the System window after you have been advised that the procedure has been successfully completed.
Next, go to Start > Run and type in cleanmgr
Select the More options tab
Choose the option to clean up system restore and Ok it

This will remove all restore points except the most recent one.

Next

Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.

I suggest you keep MBAM. Keep it updated and use it regularly.

Updates and upgrades

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources. If you choose to use Foxit make sure to decline the Foxit Toolbar offered during the install.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 9.1 first. Be sure to move any PDF documents to another folder first though.

Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. Yuo have them.

You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.

-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.

- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis

- Make sure you have reset Automatic Updates to your chosen optionClick your start button > Control Panel > System Updates tab

- Keep your antivirus program updated, as well as any other security programs you have.

-More tips and programs can be found HERE

Please post back if you have any problems.

Take care

oldman960

Post #11January 11, 2012, 5:16 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

DS's PC doesn't run executables without admin [Solved]

✨ Ask AI

Ask AI