What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

searchqu.com405

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have tried several of the suggested methods found online but have had no success. I found your post and started by downloading and scanning with the OTL. I have saved the results on my notepad and then realized that I needed someone to help with the rest. This is the first time I have heard of you guys and I do appreciate what help you have to offer. I hope to here from you soon
Post #2
Hello and Welcome apti2de to WhatTheTech Forums

My name is BlackPegasus and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

  • please follow all instructions in the order posted
  • please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
  • all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
  • if you don't understand something, please don't hesitate to ask for clarification before proceeding
  • the fixes are specific to your problem and should only be used for this issue on this machine.
  • please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested
================
Please post the OTL.Txt and Extras.Txt.

NEXT

Please download aswMBR to your desktop.
  • Double click the aswMBR.exe icon to run it
  • When asked if you want to download Avast's virus definitions please select Yes.
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.


Summary of the logs I need from you in your next post:
OTL.Txt and Extras.Txt
aswMBR log
Post #3

Hello and Welcome apti2de to WhatTheTech Forums

My name is BlackPegasus and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

  • please follow all instructions in the order posted
  • please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
  • all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
  • if you don't understand something, please don't hesitate to ask for clarification before proceeding
  • the fixes are specific to your problem and should only be used for this issue on this machine.
  • please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested
================
Please post the OTL.Txt and Extras.Txt.

NEXT

Please download aswMBR to your desktop.
  • Double click the aswMBR.exe icon to run it
  • When asked if you want to download Avast's virus definitions please select Yes.
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.


Summary of the logs I need from you in your next post:
OTL.Txt and Extras.Txt
aswMBR log

Post #4
OTL logfile created on: 1/6/2012 1:16:04 AM - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\RobertWiedemann\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.05 Mb Total Physical Memory | 344.95 Mb Available Physical Memory | 34.02% Memory free
2.38 Gb Paging File | 1.77 Gb Available in Paging File | 74.13% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.88 Gb Total Space | 3.11 Gb Free Space | 5.57% Space Free | Partition Type: NTFS

Computer Name: EASTWOOD-8D7477 | User Name: RobertWiedemann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\RobertWiedemann\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Windows Savevid Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
PRC - C:\Program Files\WeatherBlink\bar\1.bin\gcmedint.exe (WeatherBlink)
PRC - C:\Program Files\WeatherBlink\bar\1.bin\gcbrmon.exe (WeatherBlink)
PRC - C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe (Smith Micro Software, Inc.)
PRC - C:\WINDOWS\system32\ptumlcmsvc.exe (DEVGURU Co., LTD)
PRC - C:\Program Files\Freecorder\FLVSrvc.exe (Applian Technologies, Inc.)
PRC - C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
PRC - C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe (IObit)
PRC - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\WLKEEPER.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
PRC - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\hidfind.exe (Alps Electric Co., Ltd.)


========== Modules (No Company Name) ==========

MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{1283e7d0-b598-4b2d-a20f-59a9dde270a8}\components\RadioWMPCoreGecko8.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\IObit\IObit SmartDefrag\taskdll.dll ()
MOD - C:\Program Files\IObit\IObit SmartDefrag\NtfsData.dll ()
MOD - C:\Program Files\Intel\WiFi\bin\iWMSProv.dll ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (WeatherBlinkService) – C:\Program Files\WeatherBlink\bar\1.bin\gcbarsvc.exe (WeatherBlink)
SRV - (ptumlcmsvc) – C:\WINDOWS\system32\ptumlcmsvc.exe (DEVGURU Co., LTD)
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
SRV - (EvtEng) – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV - (WLANKEEPER) Intel® – C:\Program Files\Intel\WiFi\bin\WLKEEPER.exe (Intel® Corporation)
SRV - (S24EventMonitor) – C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
SRV - (RegSrvc) – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)


========== Driver Services (SafeList) ==========

DRV - (MpKsle02e653c) – C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{467607AE-DCB0-4418-B08E-9D830CBF3D4E}\MpKsle02e653c.sys (Microsoft Corporation)
DRV - (PTUMLVsp) – C:\WINDOWS\system32\drivers\PTUMLVsp.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (PTUMLRMNET) – C:\WINDOWS\system32\drivers\PTUMLRMNET.sys (DEVGURU Co., LTD.)
DRV - (PTUMLNVsp) – C:\WINDOWS\system32\drivers\PTUMLNVsp.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (PTUMLMdm) – C:\WINDOWS\system32\drivers\PTUMLMdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (PTUMLCVsp) – C:\WINDOWS\system32\drivers\PTUMLCVsp.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (PTUMLNET) – C:\WINDOWS\system32\drivers\PTUMLNET.sys (DEVGURU Co., LTD.)
DRV - (PTUMLBUS) – C:\WINDOWS\system32\drivers\PTUMLBUS.sys (DEVGURU Co., LTD.)
DRV - (SMSIVZAM5) – C:\Program Files\Verizon Wireless\VZAccess Manager\SMSIVZAM5.sys (Smith Micro Inc.)
DRV - (NETw5x32) Intel® – C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (USBCCID) – C:\WINDOWS\system32\drivers\usbccid.sys (Microsoft Corporation)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) – C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (SMCIRDA) – C:\WINDOWS\system32\drivers\smcirda.sys (SMC)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local



IE - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://toolbar.inbox.com/search/dispatcher…d&%language
IE - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://int.ask.com/ar?l=dis&siteid;=10000947
IE - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\..\URLSearchHook: {8ba2cfef-a1bc-4964-aadc-33be1ae5a33c} - C:\Program Files\WeatherBlink\bar\1.bin\gcSrcAs.dll (WeatherBlink)
IE - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - No CLSID value found
IE - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.defaultthis.engineName: "flvto.com Freecorder Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3065462&SearchSource;=3&q;={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://my.yahoo.com/p/1.html"
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.5
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.14
FF - prefs.js..keyword.URL: "http://my.yahoo.com/p/1.html"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@WeatherBlink.com/Plugin: C:\Program Files\WeatherBlink\bar\1.bin\NPgcStub.dll (WeatherBlink)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1650a312-02bc-40ee-977e-83f158701739}: C:\Program Files\SiteAdvisor\FF1 [2009/02/14 20:33:15 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Documents and Settings\All Users.WINDOWS\Application DataMozilla\Extensions\[removed] [2011/05/01 09:52:46 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\WeatherBlink\bar\1.bin [2011/10/16 08:22:23 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/11/28 16:24:09 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/12/01 19:51:28 | 000,000,000 | —D | M]

[2011/12/01 19:56:25 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Extensions
[2012/01/05 17:30:00 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions
[2011/12/05 03:00:16 | 000,000,000 | —D | M] (flvto.com Freecorder Community Toolbar) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{1283e7d0-b598-4b2d-a20f-59a9dde270a8}
[2011/02/06 11:17:37 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/10/16 14:21:11 | 000,000,000 | —D | M] (Complitly - Speed up your search with your personal search suggestions tool) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}
[2011/12/01 19:56:19 | 000,000,000 | —D | M] (Searchqu Toolbar) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2011/12/15 18:13:36 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2011/11/14 20:27:57 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/12/22 02:26:55 | 000,000,000 | —D | M] (AppGraffiti) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\[removed]
[2011/10/16 08:22:24 | 000,000,000 | —D | M] (WeatherBlink) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\[removed]
[2011/05/01 09:52:18 | 000,001,919 | —- | M] () – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\searchplugins\bing-zugo.xml
[2011/10/09 10:02:02 | 000,000,943 | —- | M] () – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\searchplugins\conduit.xml
[2011/06/02 19:36:27 | 000,002,292 | —- | M] () – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\searchplugins\inbox-search.xml
[2011/12/01 19:56:06 | 000,002,497 | —- | M] () – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\searchplugins\SearchResults.xml
[2011/12/01 20:22:47 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/12/01 19:51:31 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
[2011/12/01 20:22:48 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
() (No name found) – C:\DOCUMENTS AND SETTINGS\ROBERTWIEDEMANN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\JCGQCCUK.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\ROBERTWIEDEMANN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\JCGQCCUK.DEFAULT\EXTENSIONS\[removed]
[2011/11/28 16:24:08 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/10/03 05:06:04 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/11/28 16:24:09 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&output;=chrome&hl;={language}&q;={searchTerms}

O1 HOSTS File: ([2010/04/04 12:11:02 | 000,291,839 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 10050 more lines…
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Complitly) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Documents and Settings\RobertWiedemann\Application Data\Complitly\Complitly.dll (SimplyGen)
O2 - BHO: (AppGraffiti) - {6F6A5334-78E9-4D9B-8182-8B41EA8C39EF} - C:\Program Files\AppGraffiti\AppGraffiti.dll (Omega Partners Ltd)
O2 - BHO: (Window Shopper) - {74F475FA-6C75-43BD-AAB9-ECDA6184F600} - C:\Program Files\Superfish\Window Shopper\SuperfishIEAddon.dll (Superfish)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows Savevid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (Search Assistant BHO) - {9b9dcae3-be34-424c-8d73-75e305a9e091} - C:\Program Files\WeatherBlink\bar\1.bin\gcSrcAs.dll (WeatherBlink)
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O2 - BHO: (UrlHelper Class) - {A40DC6C5-79D0-4ca8-A185-8FF989AF1115} - C:\Program Files\Windows Savevid Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O2 - BHO: (Toolbar BHO) - {dc9051c2-8f55-479a-97a4-747980d9047f} - C:\Program Files\WeatherBlink\bar\1.bin\gcbar.dll (WeatherBlink)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows Savevid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (WeatherBlink) - {f20de5e0-2a6e-4c54-985f-1cf59551ce39} - C:\Program Files\WeatherBlink\bar\1.bin\gcbar.dll (WeatherBlink)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\..\Toolbar\WebBrowser: (no name) - {2C688203-7EB3-4327-9995-1CB417BA23F9} - No CLSID value found.
O3 - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\..\Toolbar\WebBrowser: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\..\Toolbar\WebBrowser: (WeatherBlink) - {F20DE5E0-2A6E-4C54-985F-1CF59551CE39} - C:\Program Files\WeatherBlink\bar\1.bin\gcbar.dll (WeatherBlink)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Windows Savevid Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
O4 - HKLM..\Run: [Freecorder FLV Service] C:\Program Files\Freecorder\FLVSrvc.exe (Applian Technologies, Inc.)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel® Corporation)
O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SmartDefrag] C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe (IObit)
O4 - HKLM..\Run: [WeatherBlink Browser Plugin Loader] C:\Program Files\WeatherBlink\bar\1.bin\gcbrmon.exe (WeatherBlink)
O4 - HKU\S-1-5-21-725345543-2146757141-1644342650-1003..\Run: [Pareto_Update] C:\Program Files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\CoreLogin.lnk = C:\OC_Core\CoreLogin.hta ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Search; - http://tbedits.weatherblink.com/one-toolba…mp;n=2011053121 File not found
O8 - Extra context menu item: Save video on Savevid.com - C:\Program Files\Savevid\redirect.htm ()
O9 - Extra Button: Window Shopper - {A69A551A-1AAE-4B67-8C2E-52F8B8A19504} - C:\Program Files\Superfish\Window Shopper\SuperfishIEAddon.dll (Superfish)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase6087.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1234844308359 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1238554392781 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.76.76 75.75.75.75
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E5D204C5-18E3-4ACF-94F6-DB7C2CAD7AE4}: DhcpNameServer = 75.75.76.76 75.75.75.75
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI0498~1\Datamngr\datamngr.dll) -C:\Program Files\Windows Savevid Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI0498~1\Datamngr\IEBHO.dll) -C:\Program Files\Windows Savevid Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/11/12 09:29:43 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\…exe [@ = exefile] – Reg Error: Key error. File not found

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/01/03 22:55:40 | 000,000,000 | RH-D | C] – C:\Documents and Settings\RobertWiedemann\Recent
[2012/01/03 18:26:49 | 000,012,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mouhid.sys
[2012/01/03 18:26:45 | 000,010,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hidusb.sys
[2011/12/31 03:18:41 | 000,000,000 | —D | C] – C:\Documents and Settings\RobertWiedemann\Application Data\searchquband
[2011/12/31 03:18:41 | 000,000,000 | —D | C] – C:\Documents and Settings\RobertWiedemann\AppData
[2011/12/15 20:02:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\DVDVideoSoft
[2011/12/15 20:02:13 | 000,000,000 | —D | C] – C:\Documents and Settings\RobertWiedemann\Application Data\DVDVideoSoft
[2011/12/15 20:02:07 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DVDVideoSoft
[2011/12/15 20:02:06 | 000,000,000 | —D | C] – C:\Program Files\DVDVideoSoft
[2011/12/15 20:02:06 | 000,000,000 | —D | C] – C:\Documents and Settings\RobertWiedemann\My Documents\DVDVideoSoft
[2011/12/15 18:13:22 | 000,000,000 | —D | C] – C:\Program Files\uTorrent
[12 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/01/06 00:33:00 | 000,000,436 | —- | M] () – C:\WINDOWS\tasks\ParetoLogic Update Version2.job
[2012/01/06 00:18:29 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\iTunes.lnk
[2012/01/05 21:08:28 | 000,000,408 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2012/01/05 21:06:49 | 000,456,898 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/01/05 21:06:49 | 000,076,732 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/01/05 21:03:24 | 000,000,236 | —- | M] () – C:\WINDOWS\tasks\OGALogon.job
[2012/01/05 21:02:47 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/01/05 21:02:39 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/01/05 20:43:50 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/01/05 19:10:08 | 000,000,668 | —- | M] () – C:\Documents and Settings\RobertWiedemann\Desktop\Shortcut to OTL.exe.lnk
[2012/01/05 18:35:28 | 000,018,503 | —- | M] () – C:\Documents and Settings\RobertWiedemann\My Documents\extras.text
[2012/01/05 18:00:00 | 000,000,462 | —- | M] () – C:\WINDOWS\tasks\ParetoLogic Registration.job
[2011/12/31 21:19:45 | 000,002,483 | —- | M] () – C:\Documents and Settings\RobertWiedemann\Desktop\Microsoft Word.lnk
[2011/12/27 12:00:00 | 000,000,442 | —- | M] () – C:\WINDOWS\tasks\ErrorFix Scan.job
[2011/12/15 20:02:21 | 000,001,878 | —- | M] () – C:\Documents and Settings\RobertWiedemann\Desktop\Free Audio Converter.lnk
[2011/12/15 18:27:01 | 000,136,464 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/15 18:13:25 | 000,000,639 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\µTorrent.lnk
[2011/12/15 18:01:04 | 000,003,280 | —- | M] () – C:\Documents and Settings\RobertWiedemann\My Documents\cc_20111215_180059.reg
[2011/12/09 02:59:19 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[12 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/01/05 19:10:08 | 000,000,668 | —- | C] () – C:\Documents and Settings\RobertWiedemann\Desktop\Shortcut to OTL.exe.lnk
[2012/01/05 18:35:28 | 000,018,503 | —- | C] () – C:\Documents and Settings\RobertWiedemann\My Documents\extras.text
[2011/12/15 20:02:20 | 000,001,878 | —- | C] () – C:\Documents and Settings\RobertWiedemann\Desktop\Free Audio Converter.lnk
[2011/12/15 18:13:25 | 000,000,639 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\µTorrent.lnk
[2011/12/15 18:01:02 | 000,003,280 | —- | C] () – C:\Documents and Settings\RobertWiedemann\My Documents\cc_20111215_180059.reg
[2011/02/01 23:44:33 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/04/04 11:59:45 | 000,000,138 | —- | C] () – C:\Documents and Settings\RobertWiedemann\Local Settings\Application Data\fusioncache.dat
[2010/01/24 11:35:44 | 000,023,168 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\WINDOWS\System32\OGAEXEC.exe
[2009/03/31 19:40:05 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4814.dll
[2009/03/06 16:41:18 | 000,003,584 | —- | C] () – C:\Documents and Settings\RobertWiedemann\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/03/01 15:41:29 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2009/02/21 22:51:28 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2009/02/19 02:12:33 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/02/18 19:39:37 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/02/14 20:19:52 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/02/14 20:11:57 | 000,022,720 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/02/14 11:52:53 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2009/02/14 11:51:26 | 000,136,464 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/11/06 11:37:32 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/11/06 11:33:02 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/05/26 21:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 21:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2005/03/21 18:48:05 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/21 18:48:05 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 05:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 05:00:00 | 000,456,898 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 05:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 05:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 05:00:00 | 000,076,732 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 05:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 05:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 05:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 05:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 05:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2003/11/13 19:09:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\IXOS
[2007/11/05 21:39:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\LimeWire
[2009/01/24 19:39:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Smith Micro
[2003/11/13 19:02:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IXOS
[2011/12/01 20:06:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\boost_interprocess
[2010/04/04 11:30:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\DriverCure
[2009/02/21 23:21:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\NCH Swift Sound
[2009/02/17 01:46:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\ParetoLogic
[2009/02/21 22:31:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Drivers HeadQuarters
[2010/04/04 12:09:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\SITEguard
[2010/04/09 00:52:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\STOPzilla!
[2011/08/07 21:20:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\WEngineLite
[2010/04/04 19:57:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/01/23 20:56:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2011/12/01 19:56:02 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\{ACFC9F59-F1AE-43D2-8CFE-E2F1E0F82ABA}
[2003/11/13 19:09:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Default User\Application Data\IXOS
[2010/03/23 02:02:44 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\SACore
[2011/10/16 16:18:41 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\AppGraffiti
[2010/05/03 19:42:37 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\Audacity
[2009/02/22 10:42:18 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\BSplayer Pro
[2011/12/01 22:22:28 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\Complitly
[2009/02/17 01:47:26 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\DriverCure
[2011/12/15 20:02:40 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\DVDVideoSoft
[2009/02/15 17:57:37 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\ErrorFix
[2009/03/31 20:48:50 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\IObit
[2011/10/16 16:18:49 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\PriceGong
[2011/12/31 03:18:41 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\searchquband
[2011/12/31 21:09:50 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\searchqutoolbar
[2010/01/11 22:21:29 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\Smith Micro
[2011/05/01 09:52:12 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\Superfish
[2012/01/03 22:55:51 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\uTorrent
[2009/02/16 21:51:47 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\Windows Desktop Search
[2009/02/16 22:59:23 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\Windows Search
[2011/12/27 12:00:00 | 000,000,442 | —- | M] () – C:\WINDOWS\Tasks\ErrorFix Scan.job
[2012/01/05 21:08:28 | 000,000,408 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2012/01/05 21:03:24 | 000,000,236 | —- | M] () – C:\WINDOWS\Tasks\OGALogon.job
[2012/01/05 18:00:00 | 000,000,462 | —- | M] () – C:\WINDOWS\Tasks\ParetoLogic Registration.job
[2012/01/06 00:33:00 | 000,000,436 | —- | M] () – C:\WINDOWS\Tasks\ParetoLogic Update Version2.job
[2010/04/04 11:22:30 | 000,000,286 | —- | M] () – C:\WINDOWS\Tasks\Regwork.job
[2011/11/27 22:00:00 | 000,000,404 | —- | M] () – C:\WINDOWS\Tasks\SmartDefrag.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2003/11/12 09:29:43 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/02/16 22:44:38 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2003/11/12 09:29:43 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2009/02/08 13:11:36 | 000,034,703 | —- | M] () – C:\CybDefInstallInfo.log
[2007/08/06 11:34:58 | 000,000,081 | —- | M] () – C:\DVDPATH.TXT
[2003/11/12 09:29:43 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2003/11/12 09:29:43 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2009/02/17 00:02:56 | 000,250,048 | RHS- | M] () – C:\ntldr
[2012/01/05 21:02:36 | 1598,029,824 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/04/18 14:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 13:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/02/16 22:48:21 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2009/02/16 17:37:00 | 000,262,144 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2009/02/16 22:26:34 | 000,045,056 | —- | M] () – C:\WINDOWS\System32\config\security.sav
[2009/02/16 17:37:00 | 012,058,624 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2009/02/16 17:37:00 | 003,670,016 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >
[2009/02/17 00:10:13 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\desktop.ini
[2009/03/31 21:53:41 | 000,001,575 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Microsoft Update.lnk
[2009/02/18 19:38:43 | 000,001,992 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\New Office Document.lnk
[2009/02/18 19:38:43 | 000,002,002 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Open Office Document.lnk
[2009/02/17 00:10:13 | 000,001,572 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Set Program Access and Defaults.lnk
[2009/02/16 22:49:01 | 000,000,398 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Windows Catalog.lnk
[2009/02/16 22:49:01 | 000,001,516 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Windows Update.lnk

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Deskuop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-01-04 04:06:39

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >


< MD5 for: EXPLORER.EXE >
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe

< MD5 for: EXPLORER.EXE-082F38A9.PF >
[2012/01/05 21:33:26 | 000,020,268 | —- | M] () MD5=41A4832439E07C38C9ABD7F73954F2AD – C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf

< MD5 for: EXPLORER.SCF >
[2004/08/04 05:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: IEXPLORE.CHM >
[2001/09/20 07:00:00 | 000,159,213 | —- | M] () MD5=1378BA68B40F3AAED5CE59E43637AABE – C:\Program Files\Internet Explorer\MUI\0404\IEXPLORE.CHM
[2009/02/21 00:21:24 | 000,529,818 | —- | M] () MD5=1435F4731719DF5F57D17DC38196245D – C:\WINDOWS\Help\iexplore.chm
[2001/09/20 07:00:00 | 000,167,407 | —- | M] () MD5=18E9C3A86468806B7655EF0E32797C1D – C:\Program Files\Internet Explorer\MUI\0804\IEXPLORE.CHM
[2001/09/20 07:00:00 | 000,194,548 | —- | M] () MD5=28A355619742A6C64B704D259DF92573 – C:\Program Files\Internet Explorer\MUI\040C\IEXPLORE.CHM
[2001/09/26 07:00:00 | 000,182,848 | —- | M] () MD5=3F045F70CFE0C272B1B3C8167D94437B – C:\Program Files\Internet Explorer\MUI\0C0A\IEXPLORE.CHM
[2004/08/04 05:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ie7\iexplore.chm
[2006/09/01 08:43:50 | 000,503,758 | —- | M] () MD5=652E46500C149D1DC948BF9CEA8C4933 – C:\WINDOWS\ie8\iexplore.chm
[2001/09/20 07:00:00 | 000,183,116 | —- | M] () MD5=9440BD11048C14C408E495DCD7B9FAE1 – C:\Program Files\Internet Explorer\MUI\0411\IEXPLORE.CHM
[2001/09/20 07:00:00 | 000,168,047 | —- | M] () MD5=FC0F00B3BFD90BB839AFC1BD028C31B0 – C:\Program Files\Internet Explorer\MUI\0412\IEXPLORE.CHM

< MD5 for: IEXPLORE.EXE >
[2008/12/19 00:25:25 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=030D78FE84A086ED376EFCBD2D72C522 – C:\WINDOWS\ie7updates\KB963027-IE7\iexplore.exe
[2009/04/25 00:27:50 | 000,636,088 | —- | M] (Microsoft Corporation) MD5=092A7F2B49A19ECCE5369D3CB2276148 – C:\WINDOWS\ie8\iexplore.exe
[2008/08/23 00:56:15 | 000,635,848 | —- | M] (Microsoft Corporation) MD5=1F03216084447F990AE797317D0A6E70 – C:\WINDOWS\ie7updates\KB961260-IE7\iexplore.exe
[2008/04/13 19:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ie7\iexplore.exe
[2008/04/13 19:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ServicePackFiles\i386\iexplore.exe
[2009/02/27 23:54:41 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=A251068640DDB69FD7805B57D89D7FF7 – C:\WINDOWS\ie7updates\KB969897-IE7\iexplore.exe
[2009/03/08 13:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Program Files\Internet Explorer\iexplore.exe
[2009/03/08 13:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\WINDOWS\system32\dllcache\iexplore.exe
[2009/02/27 23:54:44 | 000,636,088 | —- | M] (Microsoft Corporation) MD5=BCD8E48709BE4A79606F0B6E8E9A6162 – C:\WINDOWS\$hf_mig$\KB963027-IE7\SP3QFE\iexplore.exe
[2009/04/25 00:27:39 | 000,636,088 | —- | M] (Microsoft Corporation) MD5=C0503FD8D163652735C1EE900672A75C – C:\WINDOWS\$hf_mig$\KB969897-IE7\SP3QFE\iexplore.exe
[2007/08/13 18:43:56 | 000,622,080 | —- | M] (Microsoft Corporation) MD5=DE49B348A18369B4626FBA1D49B07FB4 – C:\WINDOWS\ie7updates\KB956390-IE7\iexplore.exe

< MD5 for: IEXPLORE.EXE.000 >
[2008/08/23 00:56:15 | 000,635,848 | —- | M] (Microsoft Corporation) MD5=1F03216084447F990AE797317D0A6E70 – C:\WINDOWS\ie7updates\KB961260-IE7\iexplore.exe.000
[2007/08/13 18:43:56 | 000,622,080 | —- | M] (Microsoft Corporation) MD5=DE49B348A18369B4626FBA1D49B07FB4 – C:\WINDOWS\ie7updates\KB956390-IE7\iexplore.exe.000

< MD5 for: IEXPLORE.EXE.MUI >
[2009/03/08 13:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 13:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\iexplore.exe.mui
[2007/08/13 18:43:36 | 000,573,440 | —- | M] (Microsoft Corporation) MD5=B58D8A1C7EE0E922EC7D2616DA136FC3 – C:\WINDOWS\ie8\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-27122324.PF >
[2012/01/03 22:51:41 | 000,083,682 | —- | M] () MD5=4A729480DD8209604B25A35D7021112D – C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf

< MD5 for: IEXPLORE.HLP >
[2004/08/04 05:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp
[2001/09/20 07:00:00 | 000,099,568 | —- | M] () MD5=5883F03DF66B588D977F83B409D46EBC – C:\Program Files\Internet Explorer\MUI\040C\IEXPLORE.HLP
[2001/09/20 07:00:00 | 000,206,505 | —- | M] () MD5=6F23715A7309B7F73773EE639EA2DCD3 – C:\Program Files\Internet Explorer\MUI\0404\IEXPLORE.HLP
[2001/09/20 07:00:00 | 000,094,790 | —- | M] () MD5=718271BC63FC8FB74C282E5170FC012E – C:\Program Files\Internet Explorer\MUI\0804\IEXPLORE.HLP
[2001/09/20 07:00:00 | 000,106,832 | —- | M] () MD5=8E573941A7B813888E889546EE4F177C – C:\Program Files\Internet Explorer\MUI\0411\IEXPLORE.HLP
[2001/09/20 07:00:00 | 000,141,783 | —- | M] () MD5=CB54A9005460A5D20598C583C4BA655E – C:\Program Files\Internet Explorer\MUI\0412\IEXPLORE.HLP
[2001/09/26 07:00:00 | 000,096,973 | —- | M] () MD5=F9111B7FB74FA32922370CC51E6D485E – C:\Program Files\Internet Explorer\MUI\0C0A\IEXPLORE.HLP

< MD5 for: WINLOGON.EXE >
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< End of report >
Post #5
aswMBR version 0.9.9.1156 Copyright© 2011 AVAST Software Run date: 2012-01-06 01:49:13 —————————– 01:49:13.812 OS Version: Windows 5.1.2600 Service Pack 3 01:49:13.812 Number of processors: 2 586 0xE08 01:49:13.812 ComputerName: EASTWOOD-8D7477 UserName: RobertWiedemann 01:49:15.468 Initialize success 01:54:14.281 AVAST engine defs: 12010501 01:54:14.796 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 01:54:14.812 Disk 0 Vendor: Hitachi_HTS721060G9SA00 MC3OC10H Size: 57231MB BusType: 3 01:54:14.828 Disk 0 MBR read successfully 01:54:14.828 Disk 0 MBR scan 01:54:14.937 Disk 0 Windows XP default MBR code 01:54:14.937 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 57223 MB offset 63 01:54:15.000 Disk 0 scanning sectors +117194175 01:54:15.093 Disk 0 scanning C:\WINDOWS\system32\drivers 01:54:38.515 Service scanning 01:54:38.921 Service MpKsle02e653c C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{467607AE-DCB0-4418-B08E-9D830CBF3D4E}\MpKsle02e653c.sys **LOCKED** 32 01:54:39.546 Modules scanning 01:54:51.875 Disk 0 trace - called modules: 01:54:51.906 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 01:54:51.921 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8654aab8] 01:54:51.921 3 CLASSPNP.SYS[f75fefd7] -> nt!IofCallDriver -> \Device\00000076[0x8658e828] 01:54:51.921 5 ACPI.sys[f7495620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86586d98] 01:54:54.093 AVAST engine scan C:\WINDOWS 01:55:00.453 AVAST engine scan C:\WINDOWS\system32 01:58:26.015 AVAST engine scan C:\WINDOWS\system32\drivers 01:58:50.796 AVAST engine scan C:\Documents and Settings\RobertWiedemann 02:06:54.390 AVAST engine scan C:\Documents and Settings\All Users.WINDOWS 02:08:31.171 Scan finished successfully 02:09:27.359 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\RobertWiedemann\Desktop\MBR.dat" 02:09:27.359 The log file has been saved successfully to "C:\Documents and Settings\RobertWiedemann\Desktop\aswMBR.txt" MBR.dat file was also saved on the desktop. I don't know what it is and don't know how to open it. Sorry this is all way over my head - it's like magic and you guys are magicians. HELP
Post #6
Hello apti2de, :wavey:


I'm going over your logs now, I'll be back with instructions.

When the OTL scan completes, it opens two notepad windows. OTL.Txt and Extras.Txt. You posted the OTL log I need the Extras.Txt log too.
Note: These logs can be located in the OTL. folder on your C:\ drive if they fail to open automatically.

MBR.dat is a back up of your master boot record in case we need to reinstall it, dont fool with it, just leave it be.
Post #7
Hello there! I think I've got it

OTL Extras logfile created on: 1/5/2012 6:09:39 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\RobertWiedemann\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.05 Mb Total Physical Memory | 411.12 Mb Available Physical Memory | 40.54% Memory free
2.38 Gb Paging File | 1.84 Gb Available in Paging File | 77.37% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.88 Gb Total Space | 3.04 Gb Free Space | 5.43% Space Free | Partition Type: NTFS

Computer Name: EASTWOOD-8D7477 | User Name: RobertWiedemann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_USERS\S-1-5-21-725345543-2146757141-1644342650-1003\SOFTWARE\Classes\]
.exe [@ = exefile] – Reg Error: Key error. File not found
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Documents and Settings\RobertWiedemann\Desktop\utorrent.exe" = C:\Documents and Settings\RobertWiedemann\Desktop\utorrent.exe:*:Enabled:µTorrent
"C:\Apps\utorrent\utorrent.exe" = C:\Apps\utorrent\utorrent.exe:*:Enabled:µTorrent
"C:\Program Files\Windows Savevid Toolbar\Datamngr\ToolBar\dtUser.exe" = C:\Program Files\Windows Savevid Toolbar\Datamngr\ToolBar\dtUser.exe:*:Enabled:DTX broker – (Visicom Media Inc.)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{16790C4C-246C-4709-9D30-86F135E15A6F}" = VZAccess Manager
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{20ACB2F8-3BCA-45A8-80A2-9D3CB5C25F43}" = Safari
"{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java™ 6 Update 29
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4FFBB818-B13C-11E0-931D-B2664824019B}_is1" = Complitly
"{52A7C6A6-6B88-47D1-922E-9F8A7E089E6A}" = Intel® PROSet/Wireless WiFi Software
"{52DFD22B-269E-4CB7-96FD-93FF546118FC}" = Verizon Wireless UML290 Firmware Updates
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.7
"{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}_is1" = AppGraffiti
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7F815C5F-D2A4-4173-B7C0-55A9D6F87E38}" = MobileMe Control Panel
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D15E1B2-D2B7-4A17-B44B-D2DDE5981405}" = SaveVid Plug-in
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A1570454-ED12-4050-A7AC-9282C7AFB23C}" = Window Shopper
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.5
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware
"{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials
"{F95AC24D-E515-4057-BEB0-FDDFA55F74BB}" = PANTECH UML290
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.10
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.6 (Unicode)
"CCleaner" = CCleaner
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3" = Conexant HDA D110 MDC V.92 Modem
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Free Audio Converter_is1" = Free Audio Converter version 5.0.3.1206
"Freecorder5.05" = Freecorder 5
"GuitarScalesMethod - TRIAL_is1" = GSM TRIAL
"HDMI" = Intel® Graphics Media Accelerator Driver
"ie8" = Windows Internet Explorer 8
"J-Edit" = Johnson Amplification J-Edit
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Essentials" = Microsoft Security Essentials
"Mozilla Firefox 8.0.1 (x86 en-US)" = Mozilla Firefox 8.0.1 (x86 en-US)
"ProInst" = Intel PROSet Wireless
"SaveVid Plug-in" = SaveVid Plug-in
"Searchqu 405 MediaBar" = Windows Savevid Toolbar
"Smart Defrag_is1" = Smart Defrag
"uTorrent" = µTorrent
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WeatherBlinkbar Uninstall" = WeatherBlink
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Yahoo! Companion" = Yahoo! Toolbar

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/4/2012 2:00:25 AM | Computer Name = EASTWOOD-8D7477 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1272063

Error - 1/4/2012 2:00:27 AM | Computer Name = EASTWOOD-8D7477 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 1/4/2012 2:00:27 AM | Computer Name = EASTWOOD-8D7477 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1274016

Error - 1/4/2012 2:00:27 AM | Computer Name = EASTWOOD-8D7477 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1274016

Error - 1/4/2012 2:00:29 AM | Computer Name = EASTWOOD-8D7477 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 1/4/2012 2:00:29 AM | Computer Name = EASTWOOD-8D7477 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1275969

Error - 1/4/2012 2:00:29 AM | Computer Name = EASTWOOD-8D7477 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1275969

Error - 1/4/2012 2:00:31 AM | Computer Name = EASTWOOD-8D7477 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 1/4/2012 2:00:31 AM | Computer Name = EASTWOOD-8D7477 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1277922

Error - 1/5/2012 4:45:15 PM | Computer Name = EASTWOOD-8D7477 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 2.1.6805.0,
P5 mpsigdwn.dll, P6 2.1.6805.0, P7 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P8 NIL, P9 NIL, P10 NIL.

[ System Events ]
Error - 1/5/2012 4:45:15 PM | Computer Name = EASTWOOD-8D7477 | Source = Microsoft Antimalware | ID = 2001
Description = %%861 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.117.1361.0 Update Source: %%851 Update Stage:
%%852 Source Path: http://go.microsoft.com/fwlink/?LinkID=121…DE-D861FCBCFCDE

Signature
Type: %%800 Update Type: %%803 User: NT AUTHORITY\NETWORK SERVICE Current Engine Version:
Previous Engine Version: 1.1.7903.0 Error code: 0x80072ee7 Error description: The
server name or address could not be resolved

Error - 1/5/2012 4:45:15 PM | Computer Name = EASTWOOD-8D7477 | Source = Microsoft Antimalware | ID = 2001
Description = %%861 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.117.1361.0 Update Source: %%851 Update Stage:
%%852 Source Path: http://go.microsoft.com/fwlink/?LinkID=121…DE-D861FCBCFCDE

Signature
Type: %%801 Update Type: %%803 User: NT AUTHORITY\NETWORK SERVICE Current Engine Version:
Previous Engine Version: 1.1.7903.0 Error code: 0x80072ee7 Error description: The
server name or address could not be resolved

Error - 1/5/2012 4:45:15 PM | Computer Name = EASTWOOD-8D7477 | Source = Microsoft Antimalware | ID = 2001
Description = %%861 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.117.1361.0 Update Source: %%851 Update Stage:
%%852 Source Path: http://go.microsoft.com/fwlink/?LinkID=121…DE-D861FCBCFCDE

Signature
Type: %%800 Update Type: %%803 User: NT AUTHORITY\NETWORK SERVICE Current Engine Version:
Previous Engine Version: 1.1.7903.0 Error code: 0x80072ee7 Error description: The
server name or address could not be resolved

Error - 1/5/2012 4:45:15 PM | Computer Name = EASTWOOD-8D7477 | Source = Microsoft Antimalware | ID = 2001
Description = %%861 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.117.1361.0 Update Source: %%851 Update Stage:
%%852 Source Path: http://go.microsoft.com/fwlink/?LinkID=121…DE-D861FCBCFCDE

Signature
Type: %%801 Update Type: %%803 User: NT AUTHORITY\NETWORK SERVICE Current Engine Version:
Previous Engine Version: 1.1.7903.0 Error code: 0x80072ee7 Error description: The
server name or address could not be resolved

Error - 1/5/2012 6:40:19 PM | Computer Name = EASTWOOD-8D7477 | Source = DCOM | ID = 10016
Description = The machine-default permission settings do not grant Local Activation
permission for the COM Server application with CLSID {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}

to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission
can be modified using the Component Services administrative tool.

Error - 1/5/2012 6:40:21 PM | Computer Name = EASTWOOD-8D7477 | Source = DCOM | ID = 10016
Description = The machine-default permission settings do not grant Local Activation
permission for the COM Server application with CLSID {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}

to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission
can be modified using the Component Services administrative tool.

Error - 1/5/2012 6:40:21 PM | Computer Name = EASTWOOD-8D7477 | Source = DCOM | ID = 10016
Description = The machine-default permission settings do not grant Local Activation
permission for the COM Server application with CLSID {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}

to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission
can be modified using the Component Services administrative tool.

Error - 1/5/2012 6:40:49 PM | Computer Name = EASTWOOD-8D7477 | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC80.MFC could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 1/5/2012 6:40:49 PM | Computer Name = EASTWOOD-8D7477 | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC80.MFC. Reference error
message: The referenced assembly is not installed on your system. .

Error - 1/5/2012 6:40:49 PM | Computer Name = EASTWOOD-8D7477 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\Verizon Wireless\VZAccess
Manager\ATTExtension.dll. Reference error message: The operation completed successfully.
.


< End of report >
Post #8 last edited
Hello apti2de,

I know this might seem like a lot to do but just take your time. :)

IOBIT Products

  • We note you are using one or more products from IOBit
  • IOBit has been accused by Malwarebytes of illegally using their intellectual property without permission.
  • Please see this for additional information on these allegations: http://www.malwarebytes.org/forums/index.php?showtopic=29681.
  • A thread in the IOBit’s forum responded to the accusations from MalwareBytes. It is noteworthy that several responses from users raising specific questions about IOBit’s response and finding it unsatisfactory were deleted and the thread was closed. The bottom line from IOBit was: “No hard proof shows that IObit stole the database of Malwarebytes.”
  • From what is said above, at least until the issues of possible database theft and spyware packaging is resolved, we do not recommend the use of IOBit products.
=================
  • P2P Programs:
  • P2P programs are a major source of Malware infections.
  • From your log I see you have µTorrent
     We do not pass judgment on file-sharing, however we must inform you that engaging in this activity and having this kind of software installed on your system will always make you more susceptible to Malware infections.
  • The use of P2P programs may be contributing to your current situation, and you would certainly be doing yourself a favour by removing them.
  • If you wish to keep the program(s), please do not use them until your computer is cleaned.
  • Information regarding the risk of using these programs can be found from here and here.
  • It is strongly recommend that you uninstall any P2P programs you have on your system.
  • To do this, Click on "Start" then on "Control Panel" and then on "Add or remove programs".
  • A list of currently installed programs will be displayed.
  • Find each program, click on it once and then click on the "Remove" button.
  • If you are prompted to re-boot your computer to complete the uninstall please do so.
    =================
    Please do the following:

    Hold down the Windows key and press R to open a run box
    type the following text into the run box

    appwiz.cpl

    This will open your Programs And Features
    A list of installed programs will populate
    Remove the following programs:

    Complitly
    WeatherBlink
    Windows Savevid Toolbar


    These two below are Optional, if you decide to keep them let me know and I will remove them from the OTL fix.
    AppGraffiti
    http://www.systemlookup.com/CLSID/72887-Ap…PGRA_1_DLL.html
    Freecorder 5
    http://www.systemlookup.com/Startup/20269-FLVSrvc_exe.html
    ======================
    Next

    ERUNT - Emergency Recovery Utility NT
    Modifying the Registry can create unforeseen problems, so it's always wise to create a backup before doing so.
    This is a free program that allows you to keep a complete backup of your registry and restore it when needed.
    ERUNT utility program
    Download:
  • Please download ERUNT…by Lars Hederer. Save it to your desktop.
  • Double-click erunt-setup-exe to start the install process. Follow the install prompts.
  • Use the default install settings…
    say "NO" to the section that asks you to add ERUNT to the Start-Up folder. Enable this option later if desired.
  • Start ERUNT by opting to start the program at the end of setup -or- double click the desktop icon.
  • Choose a location for the backup. Note: the default location is C:\WINDOWS\ERDNT which is acceptable.
  • Make sure that at least the first two check boxes are selected.
  • Click on OK … Then click on "YES" to create the folder.

< STOP > If you did not successfully complete this step. < STOP > Do not continue with any other steps, post back and let me know!
======================
Next

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
PRC - C:\Program Files\Windows Savevid Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
PRC - C:\Program Files\WeatherBlink\bar\1.bin\gcmedint.exe (WeatherBlink)
PRC - C:\Program Files\WeatherBlink\bar\1.bin\gcbrmon.exe (WeatherBlink)
PRC - C:\Program Files\Freecorder\FLVSrvc.exe (Applian Technologies, Inc.)
PRC - C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe (IObit)
MOD - C:\Program Files\IObit\IObit SmartDefrag\taskdll.dll ()
MOD - C:\Program Files\IObit\IObit SmartDefrag\NtfsData.dll ()
SRV - (WeatherBlinkService) – C:\Program Files\WeatherBlink\bar\1.bin\gcbarsvc.exe (WeatherBlink)
IE - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = 
IE - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\..\URLSearchHook: {8ba2cfef-a1bc-4964-aadc-33be1ae5a33c} - C:\Program Files\WeatherBlink\bar\1.bin\gcSrcAs.dll (WeatherBlink)
IE - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - No CLSID value found
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.defaultthis.engineName: "flvto.com Freecorder Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3065462&SearchSource;=3&q;={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.14
FF - HKLM\Software\MozillaPlugins\@WeatherBlink.com/Plugin: C:\Program Files\WeatherBlink\bar\1.bin\NPgcStub.dll (WeatherBlink)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\WeatherBlink\bar\1.bin [2011/10/16 08:22:23 [2011/10/16 14:21:11 | 000,000,000 | —D | M] (Complitly - Speed up your search with your personal search suggestions tool) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}
[2011/12/01 19:56:19 | 000,000,000 | —D | M] (Searchqu Toolbar) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2011/12/15 18:13:36 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2011/12/22 02:26:55 | 000,000,000 | —D | M] (AppGraffiti) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\[removed]
[2011/10/16 08:22:24 | 000,000,000 | —D | M] (WeatherBlink) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\[removed]
[2011/10/09 10:02:02 | 000,000,943 | —- | M] () – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\searchplugins\conduit.xml
[2011/12/01 19:56:06 | 000,002,497 | —- | M] () – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\searchplugins\SearchResults.xml
O2 - BHO: (Complitly) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Documents and Settings\RobertWiedemann\Application Data\Complitly\Complitly.dll (SimplyGen)
O2 - BHO: (AppGraffiti) - {6F6A5334-78E9-4D9B-8182-8B41EA8C39EF} - C:\Program Files\AppGraffiti\AppGraffiti.dll (Omega Partners Ltd)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows Savevid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (Search Assistant BHO) - {9b9dcae3-be34-424c-8d73-75e305a9e091} - C:\Program Files\WeatherBlink\bar\1.bin\gcSrcAs.dll (WeatherBlink)
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O2 - BHO: (UrlHelper Class) - {A40DC6C5-79D0-4ca8-A185-8FF989AF1115} - C:\Program Files\Windows Savevid Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O2 - BHO: (Toolbar BHO) - {dc9051c2-8f55-479a-97a4-747980d9047f} - C:\Program Files\WeatherBlink\bar\1.bin\gcbar.dll (WeatherBlink)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows Savevid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKLM\..\Toolbar: (WeatherBlink) - {f20de5e0-2a6e-4c54-985f-1cf59551ce39} - C:\Program Files\WeatherBlink\bar\1.bin\gcbar.dll (WeatherBlink)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Windows Savevid Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
O4 - HKLM..\Run: [Freecorder FLV Service] C:\Program Files\Freecorder\FLVSrvc.exe (Applian Technologies, Inc.)
O4 - HKLM..\Run: [SmartDefrag] C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe (IObit)
O4 - HKLM..\Run: [WeatherBlink Browser Plugin Loader] C:\Program Files\WeatherBlink\bar\1.bin\gcbrmon.exe (WeatherBlink)
O8 - Extra context menu item: &Search; - http://tbedits.weatherblink.com/one-toolba…mp;n=2011053121  File not found
O8 - Extra context menu item: Save video on Savevid.com - C:\Program Files\Savevid\redirect.htm ()
O15 - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-725345543-2146757141-1644342650-1003\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI0498~1\Datamngr\datamngr.dll) -C:\Program Files\Windows Savevid Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI0498~1\Datamngr\IEBHO.dll) -C:\Program Files\Windows Savevid Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
[2011/12/31 03:18:41 | 000,000,000 | —D | C] – C:\Documents and Settings\RobertWiedemann\Application Data\searchquband
[2011/12/15 18:13:22 | 000,000,000 | —D | C] – C:\Program Files\uTorrent
[12 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2011/12/15 18:13:25 | 000,000,639 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\µTorrent.lnk
[2007/11/05 21:39:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\LimeWire
[2011/10/16 16:18:41 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\AppGraffiti
[2011/12/01 22:22:28 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\Complitly
[2009/03/31 20:48:50 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\IObit
[2011/10/16 16:18:49 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\PriceGong
[2011/12/31 03:18:41 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\searchquband
[2011/12/31 21:09:50 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\searchqutoolbar
[2012/01/03 22:55:51 | 000,000,000 | —D | M] – C:\Documents and Settings\RobertWiedemann\Application Data\uTorrent

:Services

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Documents and Settings\RobertWiedemann\Desktop\utorrent.exe" =-
"C:\Apps\utorrent\utorrent.exe" =-
"C:\Program Files\Windows Savevid Toolbar\Datamngr\ToolBar\dtUser.exe" =-
"C:\Program Files\uTorrent\uTorrent.exe" =-
:Files

:Commands
[createrestorepoint]
[purity]
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Summary of the logs I need from you in your next post:
OTL log
How is the computer running?
Post #10
Here is the log: All processes killed ========== OTL ========== No active process named datamngrUI.exe was found! No active process named gcmedint.exe was found! No active process named gcbrmon.exe was found! No active process named FLVSrvc.exe was found! No active process named IObit SmartDefrag.exe was found! Error: No service named WeatherBlinkService was found to stop! Service\Driver key WeatherBlinkService not found. File C:\Program Files\WeatherBlink\bar\1.bin\gcbarsvc.exe not found. HKU\S-1-5-21-725345543-2146757141-1644342650-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Restore| /E : value set successfully! Registry value HKEY_USERS\S-1-5-21-725345543-2146757141-1644342650-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\{8ba2cfef-a1bc-4964-aadc-33be1ae5a33c} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8ba2cfef-a1bc-4964-aadc-33be1ae5a33c}\ not found. File C:\Program Files\WeatherBlink\bar\1.bin\gcSrcAs.dll not found. Registry value HKEY_USERS\S-1-5-21-725345543-2146757141-1644342650-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\{D3D233D5-9F6D-436C-B6C7-E63F77503B30} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\ not found. Prefs.js: "Search Results" removed from browser.search.defaultenginename Prefs.js: "flvto.com Freecorder Customized Web Search" removed from browser.search.defaultthis.engineName Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3065462&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl Prefs.js: "Search Results" removed from browser.search.order.1 Prefs.js: [removed]:1.2 removed from extensions.enabledItems Prefs.js: [removed]:1.2 removed from extensions.enabledItems Prefs.js: [removed]:1.0.0.14 removed from extensions.enabledItems Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@WeatherBlink.com/Plugin\ not found. File C:\Program Files\WeatherBlink\bar\1.bin\NPgcStub.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\Adobe Reader\ deleted successfully. C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll moved successfully. File HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\WeatherBlink\bar\1.bin [2011/10/16 08:22:23 [2011/10/16 14:21:11 | 000,000,000 | —D | M] (Complitly - Speed up your search with your personal search suggestions tool) – C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516} not found. Folder C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found. C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\searchplugin folder moved successfully. C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\modules folder moved successfully. C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\META-INF folder moved successfully. C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\defaults folder moved successfully. C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components folder moved successfully. C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\chrome folder moved successfully. C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} folder moved successfully. Folder C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\[removed]\ not found. Folder C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\extensions\[removed]\ not found. C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\searchplugins\conduit.xml moved successfully. C:\Documents and Settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\searchplugins\SearchResults.xml moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0FB6A909-6086-458F-BD92-1F8EE10042A0}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0FB6A909-6086-458F-BD92-1F8EE10042A0}\ not found. File C:\Documents and Settings\RobertWiedemann\Application Data\Complitly\Complitly.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}\ not found. File C:\Program Files\AppGraffiti\AppGraffiti.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully. File C:\Program Files\Windows Savevid Toolbar\Datamngr\ToolBar\searchqudtx.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9b9dcae3-be34-424c-8d73-75e305a9e091}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9b9dcae3-be34-424c-8d73-75e305a9e091}\ not found. File C:\Program Files\WeatherBlink\bar\1.bin\gcSrcAs.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D425283-D487-4337-BAB6-AB8354A81457}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}\ not found. File C:\Program Files\Windows Savevid Toolbar\Datamngr\IEBHO.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dc9051c2-8f55-479a-97a4-747980d9047f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dc9051c2-8f55-479a-97a4-747980d9047f}\ not found. File C:\Program Files\WeatherBlink\bar\1.bin\gcbar.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{99079a25-328f-4bd4-be04-00955acaa0a7} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found. File C:\Program Files\Windows Savevid Toolbar\Datamngr\ToolBar\searchqudtx.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{9D425283-D487-4337-BAB6-AB8354A81457} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{f20de5e0-2a6e-4c54-985f-1cf59551ce39} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f20de5e0-2a6e-4c54-985f-1cf59551ce39}\ not found. File C:\Program Files\WeatherBlink\bar\1.bin\gcbar.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DATAMNGR not found. File C:\Program Files\Windows Savevid Toolbar\Datamngr\datamngrUI.exe not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Freecorder FLV Service not found. File C:\Program Files\Freecorder\FLVSrvc.exe not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SmartDefrag deleted successfully. C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WeatherBlink Browser Plugin Loader not found. File C:\Program Files\WeatherBlink\bar\1.bin\gcbrmon.exe not found. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Search\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Save video on Savevid.com\ deleted successfully. C:\Program Files\Savevid\redirect.htm moved successfully. Registry key HKEY_USERS\S-1-5-21-725345543-2146757141-1644342650-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\internet\ deleted successfully. Registry key HKEY_USERS\S-1-5-21-725345543-2146757141-1644342650-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mcafee.com\ deleted successfully. Registry key HKEY_USERS\S-1-5-21-725345543-2146757141-1644342650-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mcafee.com\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~1\WI0498~1\Datamngr\datamngr.dll deleted successfully. File pInit_DLLs: (C:\PROGRA~1\WI0498~1\Datamngr\datamngr.dll) -C:\Program Files\Windows Savevid Toolbar\Datamngr\datamngr.dll not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~1\WI0498~1\Datamngr\IEBHO.dll deleted successfully. File pInit_DLLs: (C:\PROGRA~1\WI0498~1\Datamngr\IEBHO.dll) -C:\Program Files\Windows Savevid Toolbar\Datamngr\IEBHO.dll not found. C:\Documents and Settings\RobertWiedemann\Application Data\searchquband folder moved successfully. C:\Program Files\uTorrent folder moved successfully. C:\WINDOWS\002996_.tmp deleted successfully. C:\WINDOWS\msdownld.tmp folder deleted successfully. C:\WINDOWS\SET29.tmp deleted successfully. C:\WINDOWS\SET2A.tmp deleted successfully. C:\WINDOWS\SET3.tmp deleted successfully. C:\WINDOWS\SET4.tmp deleted successfully. C:\WINDOWS\SET40.tmp deleted successfully. C:\WINDOWS\SET43.tmp deleted successfully. C:\WINDOWS\SET4F.tmp deleted successfully. C:\WINDOWS\SET8.tmp deleted successfully. C:\WINDOWS\SET8A.tmp deleted successfully. C:\WINDOWS\SET8B.tmp deleted successfully. C:\WINDOWS\System32\CONFIG.TMP deleted successfully. C:\Documents and Settings\All Users.WINDOWS\Desktop\µTorrent.lnk moved successfully. C:\Documents and Settings\Administrator\Application Data\LimeWire\xml\schemas folder moved successfully. C:\Documents and Settings\Administrator\Application Data\LimeWire\xml\misc folder moved successfully. C:\Documents and Settings\Administrator\Application Data\LimeWire\xml\data folder moved successfully. C:\Documents and Settings\Administrator\Application Data\LimeWire\xml folder moved successfully. C:\Documents and Settings\Administrator\Application Data\LimeWire\themes\windows_theme folder moved successfully. C:\Documents and Settings\Administrator\Application Data\LimeWire\themes folder moved successfully. C:\Documents and Settings\Administrator\Application Data\LimeWire\.NetworkShare folder moved successfully. C:\Documents and Settings\Administrator\Application Data\LimeWire\.AppSpecialShare folder moved successfully. C:\Documents and Settings\Administrator\Application Data\LimeWire folder moved successfully. Folder C:\Documents and Settings\RobertWiedemann\Application Data\AppGraffiti\ not found. Folder C:\Documents and Settings\RobertWiedemann\Application Data\Complitly\ not found. C:\Documents and Settings\RobertWiedemann\Application Data\IObit\IObit SmartDefrag folder moved successfully. C:\Documents and Settings\RobertWiedemann\Application Data\IObit folder moved successfully. C:\Documents and Settings\RobertWiedemann\Application Data\PriceGong\Data folder moved successfully. C:\Documents and Settings\RobertWiedemann\Application Data\PriceGong folder moved successfully. Folder C:\Documents and Settings\RobertWiedemann\Application Data\searchquband\ not found. Folder C:\Documents and Settings\RobertWiedemann\Application Data\searchqutoolbar\ not found. C:\Documents and Settings\RobertWiedemann\Application Data\uTorrent\dlimagecache folder moved successfully. C:\Documents and Settings\RobertWiedemann\Application Data\uTorrent\Cache folder moved successfully. C:\Documents and Settings\RobertWiedemann\Application Data\uTorrent\apps folder moved successfully. C:\Documents and Settings\RobertWiedemann\Application Data\uTorrent folder moved successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Documents and Settings\RobertWiedemann\Desktop\utorrent.exe deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Apps\utorrent\utorrent.exe deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Windows Savevid Toolbar\Datamngr\ToolBar\dtUser.exe not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\uTorrent\uTorrent.exe deleted successfully. ========== FILES ========== ========== COMMANDS ========== Restore point Set: OTL Restore Point (0) [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 8094227 bytes ->Java cache emptied: 416226 bytes ->Flash cache emptied: 0 bytes User: All Users User: All Users.WINDOWS User: Default User ->Temporary Internet Files folder emptied: 33170 bytes User: Default User.WINDOWS ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: LocalService.NT AUTHORITY ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 2551532 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 216905 bytes User: NetworkService.NT AUTHORITY ->Temp folder emptied: 2025602 bytes ->Temporary Internet Files folder emptied: 49554 bytes User: ocuser User: RobertWiedemann ->Temp folder emptied: 57517957 bytes ->Temporary Internet Files folder emptied: 5308929 bytes ->Java cache emptied: 69341 bytes ->FireFox cache emptied: 47330378 bytes ->Google Chrome cache emptied: 10646659 bytes ->Apple Safari cache emptied: 0 bytes ->Flash cache emptied: 835 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 4009767 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 158772912 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 283.00 mb OTL by OldTimer - Version 3.2.31.0 log created on 01092012_174126 Files\Folders moved on Reboot… Registry entries deleted on Reboot…
Post #12
Hi apti2de, :)

It is good to hear that your PC is working better, :thumbup: but please do not leave yet, there is still a bit more to do yet.

Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
=============
NEXT

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Summary of the logs I need from you in your next post:
Security Checklog
Combofix log
How is your computer running now?
Post #13
Results of screen317's Security Check version 0.99.30
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
CCleaner
Java™ 6 Update 29
Java version out of date!
Adobe Flash Player 11.1.102.55
Adobe Reader 9 Adobe Reader out of date!
Mozilla Firefox 8.0.1 Firefox out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
``````````End of Log````````````
Post #14
Things did not go exactly as planned. I had to remove Microsoft security essential in order to let combofix do its thing. Combofix reinstalled it but without the antivirus. I have some questions but for now here is the other log:

ComboFix 12-01-10.02 - RobertWiedemann 01/10/2012 18:08:21.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.305 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\Logs\2009-02-15 17-55-380.log
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\Logs\2009-02-15 17-58-550.log
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\Logs\2009-02-15 18-15-460.log
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\Logs\2009-02-15 18-21-090.log
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\Logs\2009-02-16 03-13-440.log
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\Logs\2009-02-16 17-33-490.log
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\filelist.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-0.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-1.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-10.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-11.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-12.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-13.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-14.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-15.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-16.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-17.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-18.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-19.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-2.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-20.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-21.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-22.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-23.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-3.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-4.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-5.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-6.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-7.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-8.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\QuarantineW\2009-02-15 17-57-370\regb-9.db
c:\documents and settings\RobertWiedemann\Application Data\ErrorFix\resultsw.db
c:\documents and settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\searchplugins\bing-zugo.xml
c:\documents and settings\RobertWiedemann\WINDOWS
c:\program files\Common Files\System\Uninstall
c:\program files\WeatherBlinkEI
c:\windows\D
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\twain32
.
.
((((((((((((((((((((((((( Files Created from 2011-12-10 to 2012-01-10 )))))))))))))))))))))))))))))))
.
.
2012-01-03 23:26 . 2001-08-17 18:48 12160 -c–a-w- c:\windows\system32\dllcache\mouhid.sys
2012-01-03 23:26 . 2001-08-17 18:48 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys
2012-01-03 23:26 . 2008-04-13 18:45 10368 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2012-01-03 23:26 . 2008-04-13 18:45 10368 —-a-w- c:\windows\system32\drivers\hidusb.sys
2011-12-31 08:18 . 2011-12-31 08:18 ——– d—–w- c:\documents and settings\RobertWiedemann\AppData
2011-12-16 01:02 . 2011-12-16 01:02 ——– d—–w- c:\documents and settings\RobertWiedemann\Application Data\DVDVideoSoft
2011-12-16 01:02 . 2011-12-16 01:02 ——– d—–w- c:\program files\Common Files\DVDVideoSoft
2011-12-16 01:02 . 2011-12-16 01:02 ——– d—–w- c:\program files\DVDVideoSoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-04 09:26 . 2010-04-09 05:32 236576 ——w- c:\windows\system32\MpSigStub.exe
2011-12-09 07:59 . 2011-06-05 05:42 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-23 13:25 . 2004-08-04 10:00 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20 . 2006-03-04 03:33 916992 —-a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2004-08-04 10:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2004-08-04 10:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2004-08-04 10:00 385024 —-a-w- c:\windows\system32\html.iec
2011-11-01 16:07 . 2004-08-04 10:00 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2004-08-04 10:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37 . 2005-03-30 01:21 2148864 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2005-03-30 01:01 2027008 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13 . 2004-08-04 10:00 186880 —-a-w- c:\windows\system32\encdec.dll
2011-11-28 21:24 . 2011-11-10 23:09 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pareto_Update"="c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe" [2009-01-13 189808]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-10 49152]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-03-31 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-03-31 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-03-30 138008]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2008-08-20 1368064]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-06-15 47408]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R2 ptumlcmsvc;PTUML290 Connection Manager Service;c:\windows\system32\ptumlcmsvc.exe [2/15/2011 10:35 PM 106496]
R3 PTUMLBUS;PTUML USB Composite Device Driver;c:\windows\system32\drivers\PTUMLBUS.sys [8/7/2011 8:41 PM 59792]
R3 PTUMLCVsp;PANTECH UML290 Connection Manager Port;c:\windows\system32\drivers\PTUMLCVsp.sys [8/7/2011 8:41 PM 168208]
R3 PTUMLMdm;PANTECH UML290;c:\windows\system32\drivers\PTUMLMdm.sys [8/7/2011 8:41 PM 168208]
R3 PTUMLNET;PANTECH UML290 WWAN;c:\windows\system32\drivers\PTUMLNET.sys [8/7/2011 8:41 PM 80912]
R3 PTUMLNVsp;PANTECH UML290 NMEA Port;c:\windows\system32\drivers\PTUMLNVsp.sys [8/7/2011 8:41 PM 168848]
R3 PTUMLRMNET;PANTECH UML290 RMNET Service;c:\windows\system32\drivers\PTUMLRMNET.sys [8/7/2011 8:42 PM 60432]
R3 PTUMLVsp;PANTECH UML290 Diagnostic Port;c:\windows\system32\drivers\PTUMLVsp.sys [8/7/2011 8:41 PM 168208]
R3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [4/14/2010 7:29 PM 32408]
S3 PTDUBus;PANTECH UM175 Composite Device Driver ;c:\windows\system32\DRIVERS\PTDUBus.sys –> c:\windows\system32\DRIVERS\PTDUBus.sys [?]
S3 PTDUMdm;PANTECH UM175 Drivers;c:\windows\system32\DRIVERS\PTDUMdm.sys –> c:\windows\system32\DRIVERS\PTDUMdm.sys [?]
S3 PTDUVsp;PANTECH UM175 Diagnostic Port;c:\windows\system32\DRIVERS\PTDUVsp.sys –> c:\windows\system32\DRIVERS\PTDUVsp.sys [?]
S3 PTDUWFLT;PTDUWWAN Filter Driver;c:\windows\system32\DRIVERS\PTDUWFLT.sys –> c:\windows\system32\DRIVERS\PTDUWFLT.sys [?]
S3 PTDUWWAN;PANTECH UM175 WWAN Driver;c:\windows\system32\DRIVERS\PTDUWWAN.sys –> c:\windows\system32\DRIVERS\PTDUWWAN.sys [?]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - MPKSL52B0B16D
*Deregistered* - MpKsl52b0b16d
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 22:57]
.
2012-01-10 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]
.
2012-01-10 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]
.
2012-01-08 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-13 14:59]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{A69A551A-1AAE-4B67-8C2E-52F8B8A19504} - {A69A551A-1AAE-4B67-8C2E-52F8B8A19504} - c:\program files\Superfish\Window Shopper\SuperfishIEAddon.dll
TCP: DhcpNameServer = [removed] [removed]
FF - ProfilePath - c:\documents and settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/p/1.html?_bc=1
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-mcmscsvc
SafeBoot-MCODS
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-10 18:14
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(468)
c:\windows\system32\netprovcredman.dll
.
Completion time: 2012-01-10 18:18:52
ComboFix-quarantined-files.txt 2012-01-10 23:18
.
Pre-Run: 3,792,871,424 bytes free
Post-Run: 3,740,045,312 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /noexecute=optin
.
- - End Of File - - 3926E8F1DE8F8C29728E2C5B6F6DBF43
Post #15
OOPS! Since I had no more antivirus from Microsoft security essentials, I downloaded it forgetting that you suggested not to download anything until we were done. I hope this is not a problem. If it is please shoot me. All this aside, computer was working great last night. By the way now that I have all of these programs (the ones you had me download) can I use them for anyhing? Thank you

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI