What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Can not load g-mail or goole on any pc in house [Solved]

85 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
The OTL scan worked this time. But, during the aswMBR I got a flash of a blue screen with writing all over it then a restart. Happened once before when I did that scan. Here is the OTL



OTL logfile created on: 2/20/2012 7:44:07 PM - Run 2
OTL by OldTimer - Version 3.2.33.1 Folder = C:\Documents and Settings\Heidi Seitz\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

958.60 Mb Total Physical Memory | 435.30 Mb Available Physical Memory | 45.41% Memory free
2.26 Gb Paging File | 1.82 Gb Available in Paging File | 80.38% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 99.00 Gb Total Space | 15.45 Gb Free Space | 15.61% Space Free | Partition Type: NTFS
Drive D: | 11.75 Gb Total Space | 1.15 Gb Free Space | 9.81% Space Free | Partition Type: FAT32

Computer Name: HEIDI | User Name: Heidi Seitz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Heidi Seitz\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Norton 360\Engine\6.0.1.2\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
PRC - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE (Software 2000 Limited)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe (Hewlett-Packard Development Company, L.P.)


========== Modules (No Company Name) ==========

MOD - c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_53c74b9b\mscorlib.dll ()
MOD - c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_d8965a4d\system.drawing.dll ()
MOD - c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_0f992ce8\system.xml.dll ()
MOD - c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_660bf5ff\system.windows.forms.dll ()
MOD - c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_3935d085\system.dll ()
MOD - c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll ()
MOD - c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\WINDOWS\system32\sbe.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\WINDOWS\system32\devenum.dll ()
MOD - C:\Program Files\HP\QuickPlay\Kernel\common\CLDataSync.dll ()
MOD - c:\windows\assembly\gac\hpqbakup\3.0.0.0__a53cf5803f4c3827\hpqbakup.dll ()
MOD - c:\windows\assembly\gac\hpqisrtb\4.0.0.0__a53cf5803f4c3827\hpqisrtb.dll ()
MOD - c:\windows\assembly\gac\hpqedit\3.0.0.0__a53cf5803f4c3827\hpqedit.dll ()
MOD - c:\windows\assembly\gac\hpqvideo\3.0.0.0__a53cf5803f4c3827\hpqvideo.dll ()
MOD - c:\windows\assembly\gac\hpqmdmr\4.0.0.0__a53cf5803f4c3827\hpqmdmr.dll ()
MOD - c:\windows\assembly\gac\hpqprrsc\4.0.0.0__a53cf5803f4c3827\hpqprrsc.dll ()
MOD - c:\windows\assembly\gac\hpqovskn\3.0.0.0__a53cf5803f4c3827\hpqovskn.dll ()
MOD - c:\windows\assembly\gac\hpqimvlt\3.0.0.0__a53cf5803f4c3827\hpqimvlt.dll ()
MOD - c:\windows\assembly\gac\lead.wrapper\13.0.0.113__9cf889f53ea9b907\lead.wrapper.dll ()
MOD - c:\windows\assembly\gac\hpqimgrc\4.0.0.0__a53cf5803f4c3827\hpqimgrc.dll ()
MOD - c:\windows\assembly\gac\lead.drawing.imaging.imageprocessing\13.0.0.113__9cf889f53ea9b907\lead.drawing.imaging.imageprocessing.dll ()
MOD - c:\windows\assembly\gac\lead.drawing\13.0.0.113__9cf889f53ea9b907\lead.drawing.dll ()
MOD - c:\windows\assembly\gac\lead.drawing.imaging.codecs\13.0.0.113__9cf889f53ea9b907\lead.drawing.imaging.codecs.dll ()
MOD - c:\windows\assembly\gac\lead\13.0.0.113__9cf889f53ea9b907\lead.dll ()
MOD - c:\windows\assembly\gac\lead.windows.forms.drawingcontainer\13.0.0.113__9cf889f53ea9b907\lead.windows.forms.drawingcontainer.dll ()
MOD - c:\windows\assembly\gac\hpqntrop\4.0.0.0__a53cf5803f4c3827\hpqntrop.dll ()
MOD - c:\windows\assembly\gac\lead.windows.forms\13.0.0.113__9cf889f53ea9b907\lead.windows.forms.dll ()
MOD - c:\windows\assembly\gac\interop.hpqcxm08\3.0.0.0__a53cf5803f4c3827\interop.hpqcxm08.dll ()
MOD - c:\windows\assembly\gac\interop.hpqvideo\4.0.0.0__a53cf5803f4c3827\interop.hpqvideo.dll ()
MOD - c:\windows\assembly\gac\interop.hpqimgr\4.0.0.0__a53cf5803f4c3827\interop.hpqimgr.dll ()
MOD - c:\windows\assembly\gac\interop.hprblog\3.0.0.0__a53cf5803f4c3827\interop.hprblog.dll ()
MOD - c:\windows\assembly\gac\hpqcc2\3.0.0.0__a53cf5803f4c3827\hpqcc2.dll ()
MOD - c:\windows\assembly\gac\hpqcprsc\3.0.0.0__a53cf5803f4c3827\hpqcprsc.dll ()
MOD - c:\windows\assembly\gac\hpqtray\4.0.0.0__a53cf5803f4c3827\hpqtray.dll ()
MOD - c:\windows\assembly\gac\hpqutils\4.0.0.0__a53cf5803f4c3827\hpqutils.dll ()
MOD - c:\windows\assembly\gac\hpqthumb\3.0.0.0__a53cf5803f4c3827\hpqthumb.dll ()
MOD - c:\windows\assembly\gac\hpqglutl\4.0.0.0__a53cf5803f4c3827\hpqglutl.dll ()
MOD - c:\windows\assembly\gac\hpqimlib\3.0.0.0__a53cf5803f4c3827\hpqimlib.dll ()
MOD - c:\windows\assembly\gac\hpqfmrsc\4.0.0.0__a53cf5803f4c3827\hpqfmrsc.dll ()
MOD - c:\windows\assembly\gac\hpqasset\4.0.0.0__a53cf5803f4c3827\hpqasset.dll ()
MOD - c:\windows\assembly\gac\hpqiface\4.0.0.0__a53cf5803f4c3827\hpqiface.dll ()
MOD - c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll ()
MOD - c:\windows\assembly\gac\system.drawing\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll ()
MOD - c:\windows\assembly\gac\accessibility\1.0.5000.0__b03f5f7f11d50a3a\accessibility.dll ()


========== Win32 Services (SafeList) ==========

SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (N360) – C:\Program Files\Norton 360\Engine\6.0.1.2\ccSvcHst.exe (Symantec Corporation)
SRV - (TomTomHOMEService) – C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (AddFiltr) – C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe (Hewlett-Packard Development Company, L.P.)


========== Driver Services (SafeList) ==========

DRV - (SymEvent) – C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (IDSxpx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\Definitions\IPSDefs\20120217.003\IDSXpx86.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\Definitions\VirusDefs\20120220.001\NAVEX15.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVENG) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\Definitions\VirusDefs\20120220.001\NAVENG.SYS (Symantec Corporation)
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (BHDrvx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\Definitions\BASHDefs\20120215.001\BHDrvx86.sys (Symantec Corporation)
DRV - (SymEFA) – C:\WINDOWS\system32\drivers\N360\0600010.002\SYMEFA.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\WINDOWS\system32\drivers\N360\0600010.002\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\WINDOWS\system32\drivers\N360\0600010.002\SRTSPX.SYS (Symantec Corporation)
DRV - (SYMTDI) – C:\WINDOWS\system32\drivers\N360\0600010.002\SYMTDI.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\WINDOWS\system32\drivers\N360\0600010.002\Ironx86.SYS (Symantec Corporation)
DRV - (ccSet_N360) – C:\WINDOWS\system32\drivers\N360\0600010.002\ccSetx86.sys (Symantec Corporation)
DRV - (SymDS) – C:\WINDOWS\system32\drivers\N360\0600010.002\SYMDS.SYS (Symantec Corporation)
DRV - (MQAC) – C:\WINDOWS\system32\drivers\mqac.sys (Microsoft Corporation)
DRV - (RMCAST) – C:\WINDOWS\system32\drivers\rmcast.sys (Microsoft Corporation)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) – C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HdAudAddService) – C:\WINDOWS\system32\drivers\CHDAud.sys (Conexant Systems Inc.)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (nvsmu) – C:\WINDOWS\system32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (nvata) – C:\WINDOWS\system32\DRIVERS\nvata.sys (NVIDIA Corporation)
DRV - (rimsptsk) – C:\WINDOWS\system32\drivers\rimsptsk.sys (REDC)
DRV - (rimmptsk) – C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (rismxdp) – C:\WINDOWS\system32\drivers\rixdptsk.sys (REDC)
DRV - (eabusb) – C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Development Company, L.P.)
DRV - (HBtnKey) – C:\WINDOWS\system32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabfiltr) – C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "iMesh Web Search"
FF - prefs.js..browser.search.order.1: "iMesh Web Search"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://en-US.start3.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: [removed]:1.0.7
FF - prefs.js..extensions.enabledItems: {e968fc70-8f95-4ab9-9e79-304de2a71ee1}:0.7.3

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\IPSFFPlgn\ [2012/02/16 00:07:36 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\coFFPlgn\ [2012/02/20 19:46:45 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/12 15:35:06 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/28 18:44:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Browser 8.0.4.0\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2011/03/23 22:02:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Browser 8.0.4.0\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2011/03/23 22:02:22 | 000,000,000 | —D | M]

[2011/06/19 07:17:34 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Heidi Seitz\Application Data\Mozilla\Extensions
[2011/06/19 07:17:34 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Heidi Seitz\Application Data\Mozilla\Extensions\[removed]
[2012/01/11 20:41:07 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Heidi Seitz\Application Data\Mozilla\Firefox\Profiles\mfe6wn8q.default\extensions
[2011/03/28 18:38:06 | 000,000,000 | —D | M] (User Agent Switcher) – C:\Documents and Settings\Heidi Seitz\Application Data\Mozilla\Firefox\Profiles\mfe6wn8q.default\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}
[2012/02/12 15:35:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
() (No name found) – C:\DOCUMENTS AND SETTINGS\HEIDI SEITZ\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\MFE6WN8Q.DEFAULT\EXTENSIONS\[removed]
[2010/02/03 01:51:37 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2012/02/08 15:13:49 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/05/04 03:52:23 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2008/05/19 13:57:00 | 002,641,920 | —- | M] () – C:\Program Files\mozilla firefox\plugins\npRACtrl.dll
[2008/02/28 13:30:00 | 000,008,784 | —- | M] () – C:\Program Files\mozilla firefox\plugins\ractrlkeyhook.dll
[2008/02/28 13:33:00 | 000,245,408 | —- | M] (Microsoft Corporation) – C:\Program Files\mozilla firefox\plugins\unicows.dll
[2012/02/08 12:12:58 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010/09/02 03:09:28 | 000,002,486 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\iMeshWebSearch.xml
[2012/02/08 12:12:58 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Web Search (Enabled)
CHR - default_search_provider: search_url = http://search.imesh.com/web?src=crb&sy;…q={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\Google\Chrome\Application\17.0.963.46\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\Google\Chrome\Application\17.0.963.46\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\Google\Chrome\Application\17.0.963.46\pdf.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\Google\Chrome\Application\plugins\npMozCouponPrinter.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: LogMeIn, Inc. Remote Access Components 1.0.0.381 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npRACtrl.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\Google\Update\1.3.21.71\npGoogleUpdate3.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.3_0\
CHR - Extension: Google Search = C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\
CHR - Extension: Norton Identity Protection = C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.1.5_0\
CHR - Extension: Gmail = C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/02/18 17:13:30 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\6.0.1.2\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\6.0.1.2\IPS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (CNavExtBho Class) - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll File not found
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\6.0.1.2\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\6.0.1.2\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\CHDAudPropShortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MsmqIntCert] C:\WINDOWS\System32\mqrt.dll (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RecGuard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKCU..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\StartUp\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\StartUp\HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Development Company, L.P.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\npjpi160_04.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F55E7425-751D-4426-A34D-AE48B2FE8344}: DhcpNameServer = [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Wave.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Wave.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/27 23:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/02/20 18:23:18 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2012/02/20 16:39:13 | 000,000,000 | —D | C] – C:\_OTL
[2012/02/19 09:33:40 | 000,583,168 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Heidi Seitz\Desktop\OTL.exe
[2012/02/19 09:20:34 | 000,000,000 | —D | C] – C:\Documents and Settings\Heidi Seitz\Application Data\Malwarebytes
[2012/02/19 09:20:23 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/02/19 09:20:23 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2012/02/19 09:20:22 | 000,020,464 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/02/19 09:20:22 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/02/19 09:17:40 | 009,502,424 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Heidi Seitz\Desktop\mbam-setup-1.60.1.1000.exe
[2012/02/18 16:55:11 | 000,000,000 | RHSD | C] – C:\cmdcons
[2012/02/18 16:51:52 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/02/18 16:51:52 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/02/18 16:51:52 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/02/18 16:51:52 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/02/18 16:51:42 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2012/02/18 16:51:35 | 000,000,000 | —D | C] – C:\Qoobox
[2012/02/18 11:06:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Heidi Seitz\Desktop\RK_Quarantine
[2012/02/17 06:12:17 | 009,502,424 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Heidi Seitz\Desktop\mbam–setup-1.60.1.1000.exe
[2012/02/17 06:09:59 | 000,201,728 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Heidi Seitz\Desktop\OTC.exe
[2012/02/17 06:08:08 | 000,446,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Heidi Seitz\Desktop\TFC.exe
[2012/02/16 18:06:49 | 004,733,440 | —- | C] (AVAST Software) – C:\Documents and Settings\Heidi Seitz\Desktop\aswMBR.exe
[2012/02/16 18:01:55 | 000,000,000 | R–D | C] – C:\Documents and Settings\Heidi Seitz\Start Menu\Programs\Administrative Tools
[2012/02/16 06:09:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Heidi Seitz\Desktop\backups
[2012/02/16 05:59:54 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Heidi Seitz\Desktop\HijackThis.exe
[2012/02/16 02:29:16 | 000,000,000 | —D | C] – C:\N360_BACKUP
[2012/02/16 00:05:07 | 000,060,872 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2012/02/16 00:05:06 | 000,141,944 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2012/02/16 00:05:06 | 000,000,000 | —D | C] – C:\Program Files\Symantec
[2012/02/16 00:04:28 | 000,388,216 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0600010.002\symtdi.sys
[2012/02/16 00:04:28 | 000,345,208 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0600010.002\symtdiv.sys
[2012/02/16 00:04:27 | 000,318,584 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0600010.002\symnets.sys
[2012/02/16 00:04:14 | 000,905,336 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0600010.002\SymEFA.sys
[2012/02/16 00:04:14 | 000,340,088 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0600010.002\SymDS.sys
[2012/02/16 00:04:14 | 000,032,888 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0600010.002\srtspx.sys
[2012/02/16 00:04:13 | 000,574,584 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0600010.002\srtsp.sys
[2012/02/16 00:04:13 | 000,149,624 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0600010.002\Ironx86.sys
[2012/02/16 00:04:12 | 000,132,744 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0600010.002\ccSetx86.sys
[2012/02/16 00:03:01 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\N360
[2012/02/16 00:03:01 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\N360\0600010.002
[2012/02/16 00:02:58 | 000,000,000 | —D | C] – C:\Program Files\Norton 360
[2012/02/16 00:02:57 | 000,000,000 | —D | C] – C:\Program Files\Windows Sidebar
[2012/02/16 00:02:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Norton 360
[2012/02/15 23:27:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Heidi Seitz\Start Menu\Programs\Norton
[2012/02/15 23:27:48 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\Norton
[2012/02/15 23:27:34 | 000,829,088 | —- | C] (Symantec Corporation) – C:\Documents and Settings\Heidi Seitz\Desktop\N360Downloader.exe
[2012/02/15 22:54:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Heidi Seitz\Application Data\Elluminate
[2012/02/15 19:34:16 | 002,060,336 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Heidi Seitz\Desktop\tdsskiller.exe
[2012/01/31 22:31:12 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Apple Computer
[2010/02/03 00:49:08 | 000,051,192 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/02/03 00:49:08 | 000,000,134 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\fusioncache.dat
[2010/02/03 00:49:06 | 004,845,622 | -H– | C] () – C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\IconCache.db
[2007/10/12 23:05:30 | 000,002,528 | —- | C] () – C:\Documents and Settings\NetworkService\Application Data\$_hpcst$.hpc
[2007/02/05 13:55:23 | 000,001,778 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/02/20 19:43:52 | 000,001,329 | —- | M] () – C:\hpqp.ini
[2012/02/20 19:43:34 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/02/20 19:43:27 | 000,050,868 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2012/02/20 19:43:27 | 000,000,039 | —- | M] () – C:\XP_TV.ini
[2012/02/20 19:43:20 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/02/20 19:43:13 | 1005,236,224 | -HS- | M] () – C:\hiberfil.sys
[2012/02/20 18:54:07 | 000,583,168 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Heidi Seitz\Desktop\OTL.exe
[2012/02/20 18:38:29 | 000,001,002 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2540146634-2539278503-1871707970-1005UA.job
[2012/02/19 18:57:00 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/02/19 09:20:23 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/19 09:19:03 | 009,502,424 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Heidi Seitz\Desktop\mbam-setup-1.60.1.1000.exe
[2012/02/19 08:37:01 | 000,000,950 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2540146634-2539278503-1871707970-1005Core.job
[2012/02/19 07:44:02 | 002,060,336 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Heidi Seitz\Desktop\tdsskiller.exe
[2012/02/19 07:41:22 | 002,041,519 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\tdsskiller.zip
[2012/02/19 07:40:17 | 000,080,384 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\MBRCheck.exe
[2012/02/19 02:00:00 | 000,000,316 | —- | M] () – C:\WINDOWS\tasks\HP WEP.job
[2012/02/18 21:23:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/02/18 17:13:30 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/02/18 16:55:18 | 000,000,337 | RHS- | M] () – C:\boot.ini
[2012/02/18 11:04:50 | 000,337,039 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\FSS.exe
[2012/02/18 11:03:47 | 001,251,328 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\RogueKiller.exe
[2012/02/17 11:39:34 | 000,002,308 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/02/17 11:39:33 | 000,002,330 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\Google Chrome.lnk
[2012/02/17 06:17:01 | 009,502,424 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Heidi Seitz\Desktop\mbam–setup-1.60.1.1000.exe
[2012/02/17 06:10:00 | 000,201,728 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Heidi Seitz\Desktop\OTC.exe
[2012/02/17 06:08:10 | 000,446,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Heidi Seitz\Desktop\TFC.exe
[2012/02/17 06:03:19 | 004,733,440 | —- | M] (AVAST Software) – C:\Documents and Settings\Heidi Seitz\Desktop\aswMBR.exe
[2012/02/16 23:41:50 | 000,256,656 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/02/16 23:31:23 | 000,615,015 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0600010.002\Cat.DB
[2012/02/16 23:31:08 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/02/16 18:05:43 | 000,003,885 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\attach (dds).zip
[2012/02/16 05:59:55 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Heidi Seitz\Desktop\HijackThis.exe
[2012/02/16 00:10:56 | 000,004,782 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0600010.002\VT20111023.022
[2012/02/16 00:05:06 | 000,141,944 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2012/02/16 00:05:06 | 000,060,872 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2012/02/16 00:05:06 | 000,007,468 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2012/02/16 00:05:06 | 000,000,806 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2012/02/16 00:04:51 | 000,001,799 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton 360.LNK
[2012/02/16 00:02:14 | 000,000,756 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\Norton Installation Files.lnk
[2012/02/15 23:27:34 | 000,829,088 | —- | M] (Symantec Corporation) – C:\Documents and Settings\Heidi Seitz\Desktop\N360Downloader.exe
[2012/02/12 15:35:10 | 000,000,742 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/02/12 15:35:10 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/02/10 15:16:42 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/02/08 19:29:44 | 000,126,705 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\coronas in snow.jpg
[2012/02/07 02:37:07 | 000,000,172 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0600010.002\isolate.ini
[2012/02/05 22:03:41 | 000,066,072 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\jane usa gold.JPG
[2012/02/05 21:43:15 | 000,002,044 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\usa gold logo.jpg
[2012/02/05 21:42:38 | 000,008,163 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\usa blu box.jpg
[2012/02/05 21:36:06 | 003,092,662 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\mom bunny ears.JPG
[2012/02/05 21:35:20 | 000,028,672 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/02/05 21:12:44 | 000,067,188 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\new john usagold.JPG
[2012/02/05 21:09:52 | 000,461,306 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\statue of liberty.JPG
[2012/02/05 21:09:31 | 000,631,951 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\john usa gold 2.JPG
[2012/02/05 10:11:25 | 000,314,757 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\john usa gold.JPG
[2012/02/05 10:06:10 | 000,001,460 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Media Center.lnk
[2012/02/05 10:01:15 | 000,590,410 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\USA gold pic2.JPG
[2012/02/05 09:58:49 | 000,579,419 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\USAGOLD PIC.JPG
[2012/02/05 09:51:14 | 000,564,521 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\usa gold me.JPG
[2012/02/04 17:11:38 | 001,161,463 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\balance corona.JPG
[2012/02/04 17:11:10 | 000,613,751 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\tv corona.JPG
[2012/02/02 19:21:41 | 001,261,695 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\corona.JPG
[2012/02/02 14:15:27 | 000,000,358 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\Shortcut to 0202020908.lnk
[2012/02/02 07:27:28 | 000,000,358 | —- | M] () – C:\Documents and Settings\Heidi Seitz\Desktop\Shortcut to 0130022044.lnk
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/02/19 09:20:23 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/19 07:41:21 | 002,041,519 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\tdsskiller.zip
[2012/02/19 07:40:17 | 000,080,384 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\MBRCheck.exe
[2012/02/18 16:55:18 | 000,000,221 | —- | C] () – C:\Boot.bak
[2012/02/18 16:55:12 | 000,260,272 | RHS- | C] () – C:\cmldr
[2012/02/18 16:51:52 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/02/18 16:51:52 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/02/18 16:51:52 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/02/18 16:51:52 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/02/18 16:51:52 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/02/18 11:03:33 | 001,251,328 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\RogueKiller.exe
[2012/02/17 21:55:50 | 1005,236,224 | -HS- | C] () – C:\hiberfil.sys
[2012/02/17 20:46:07 | 000,337,039 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\FSS.exe
[2012/02/16 18:05:43 | 000,003,885 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\attach (dds).zip
[2012/02/16 15:37:22 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/02/16 15:37:22 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\dllcache\iacenc.dll
[2012/02/16 00:11:25 | 000,004,782 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\VT20111023.022
[2012/02/16 00:05:12 | 000,615,015 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\Cat.DB
[2012/02/16 00:05:06 | 000,007,468 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2012/02/16 00:05:06 | 000,000,806 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2012/02/16 00:04:51 | 000,001,799 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Norton 360.LNK
[2012/02/16 00:03:19 | 000,003,434 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\SymEFA.inf
[2012/02/16 00:03:19 | 000,002,852 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\SymDS.inf
[2012/02/16 00:03:19 | 000,001,469 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\SymNetV.inf
[2012/02/16 00:03:19 | 000,001,441 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\SymNet.inf
[2012/02/16 00:03:19 | 000,001,389 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\srtspx.inf
[2012/02/16 00:03:19 | 000,001,389 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\srtsp.inf
[2012/02/16 00:03:19 | 000,000,827 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\ccSetx86.inf
[2012/02/16 00:03:19 | 000,000,742 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\Iron.inf
[2012/02/16 00:03:15 | 000,004,782 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\SymVTcer.dat
[2012/02/16 00:03:02 | 000,007,877 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\symnetv.cat
[2012/02/16 00:03:02 | 000,007,458 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\SymNet.cat
[2012/02/16 00:03:01 | 000,007,492 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\SymDS.cat
[2012/02/16 00:03:01 | 000,007,468 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\ccSetx86.cat
[2012/02/16 00:03:01 | 000,007,456 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\SymEFA.cat
[2012/02/16 00:03:01 | 000,007,454 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\srtspx.cat
[2012/02/16 00:03:01 | 000,007,450 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\srtsp.cat
[2012/02/16 00:03:01 | 000,007,450 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\iron.cat
[2012/02/16 00:03:01 | 000,000,172 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0600010.002\isolate.ini
[2012/02/15 23:27:48 | 000,000,756 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\Norton Installation Files.lnk
[2012/02/08 19:30:02 | 000,126,705 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\coronas in snow.jpg
[2012/02/05 22:03:40 | 000,066,072 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\jane usa gold.JPG
[2012/02/05 21:43:32 | 000,002,044 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\usa gold logo.jpg
[2012/02/05 21:42:55 | 000,008,163 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\usa blu box.jpg
[2012/02/05 21:36:04 | 003,092,662 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\mom bunny ears.JPG
[2012/02/05 21:12:44 | 000,067,188 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\new john usagold.JPG
[2012/02/05 21:09:52 | 000,461,306 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\statue of liberty.JPG
[2012/02/05 21:09:31 | 000,631,951 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\john usa gold 2.JPG
[2012/02/05 10:11:25 | 000,314,757 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\john usa gold.JPG
[2012/02/05 10:01:15 | 000,590,410 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\USA gold pic2.JPG
[2012/02/05 09:58:48 | 000,579,419 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\USAGOLD PIC.JPG
[2012/02/05 09:51:13 | 000,564,521 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\usa gold me.JPG
[2012/02/04 17:11:38 | 001,161,463 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\balance corona.JPG
[2012/02/04 17:11:10 | 000,613,751 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\tv corona.JPG
[2012/02/02 19:21:40 | 001,261,695 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\corona.JPG
[2012/02/02 14:15:27 | 000,000,358 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\Shortcut to 0202020908.lnk
[2012/02/02 07:27:28 | 000,000,358 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Desktop\Shortcut to 0130022044.lnk
[2011/06/25 05:43:52 | 000,021,504 | —- | C] () – C:\WINDOWS\jestertb.dll
[2011/03/03 06:50:24 | 000,051,952 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2010/10/11 16:27:00 | 000,001,548 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Application Data\wklnhst.dat
[2010/08/07 07:18:48 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/07/30 17:04:10 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\HPPLVS.dll
[2010/06/11 00:54:16 | 000,028,672 | —- | C] () – C:\Documents and Settings\Heidi Seitz\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== LOP Check ==========

[2006/11/22 19:05:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DIGStream
[2008/04/23 08:19:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\muvee Technologies
[2009/06/23 06:16:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2011/06/19 07:18:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TomTom
[2010/02/03 01:31:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WildTangent
[2009/03/21 20:34:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2011/02/14 23:59:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/14 22:59:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
[2009/04/25 11:45:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2012/02/15 23:07:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Heidi Seitz\Application Data\Elluminate
[2010/09/13 18:32:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Heidi Seitz\Application Data\EPSON
[2012/01/14 06:18:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Heidi Seitz\Application Data\Garmin
[2011/02/21 17:08:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Heidi Seitz\Application Data\imeshbandmltbpi
[2010/07/31 20:53:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Heidi Seitz\Application Data\Leadertech
[2010/06/04 23:22:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Heidi Seitz\Application Data\Opera
[2010/10/11 16:27:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Heidi Seitz\Application Data\Template
[2011/06/19 07:17:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Heidi Seitz\Application Data\TomTom

========== Purity Check ==========



< End of report >
Post #47
Please try running another OTL fix.

Run OTL
  • double click on the icon to run it.
  • copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :processes
killallprocesses

:OTL
CHR - default_search_provider: search_url = http://search.imesh.com/web?src=crb&sy…q={searchTerms}
FF - prefs.js..browser.search.defaultenginename: "iMesh Web Search"
FF - prefs.js..browser.search.order.1: "iMesh Web Search"
[2011/02/21 17:08:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Heidi Seitz\Application Data\imeshbandmltbpi

:Files
ipconfig /release /c
ipconfig /renew /c
ipconfig /flushdns /c

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\iMesh Applications\iMesh\iMesh.exe" =-

:Commands
[purity]
[resethosts]
[emptytemp]
[start explorer]
[Reboot]

  • click the Run Fix button at the top
  • let the program run unhindered, reboot when it is done
  • post a new OTL log (don't check the boxes beside LOP Check or Purity this time)
If it still crashes, try it in safe mode - see below for instructions on how to enter safe mode.

======================================

Try running aswMBR in safe mode:

To Enter Safemode
  • go to Start> Shut off your Computer> Restart
  • as the computer starts to boot-up, Tap the F8 KEY - this will bring up a menu.
  • use the Up and Down Arrow Keys to scroll up to Safemode
  • then press Enter on your keyboard
Logs to include in the next post:

OTL fix log
New OTL log
aswMBR.txt

Satchfan
Post #48
Set the OTL scan to run last night. This morning it still hadn't moved. I was late for work so I didn't touch the computer. I just got home and had to hold down power button to shut it down. I restarted in safe mode and realized I can paste so I restarted in safe node with networking and just as soon as I tried to open Internet explorer the computer turn off. Tried restarting in plain safe mode and never made it to the desktop before it shut off. I'm getting frustrated and have my grandma in the hospital. Also, dropped my netbook and destroyed hard drive last night. I think I'm gonna have to let this go for now. Maybe in a day or two I can work on it more.
Post #49
I'm so sorry that you are having a bad time and wish your grandma all the best.

Also, dropped my netbook and destroyed hard drive last night.

Laptop hard drives are more robust than desktop hard drives so it's possible that it is the motherboard or some other piece of hardware that has been affected. If you have data on the netbook that you can't afford to lose, there are relatively inexpensive docking stations that you can use to read your data and transfer it to another machine.

I think I'm gonna have to let this go for now. Maybe in a day or two I can work on it more.

I'll keep this thread open for a couple of days. Please let me know if it will be longer.

Best wishes

Satchfan
Post #50
I'm ready to work on this more. It is a network issue. Just brought a new computer home and it was instantly hijacked. Take it away from home and use another network and it's not hijacked.
Post #52 last edited
As soon as a computer connects to my wireless network, it can no longer load the g-mail home page and all google links are redirected like a browser hijacker. It only affects google/google related sites. If you take any of the computers and go to my moms or friends house and log on to their network, everything is normal. You can check g-mail and do google searches and not be redirected. Then come home and connect to my network and the problem is back. This is the problem I've been trying to get fixed since we started. I don't expect you to remember everything about this so here's a recap : 5 computers on this wireless network. All with the same problem described above. Malwarebytes removed a browser hijacker from the computer i'm using now but that didn't fix the problem. Malwarebytes removed "bufpuma" then the redirect became "askthecrew". The redirect changed from bufpuma to askthecrew on all the computers. Whatever happens to one of the computers seems to happen to all of them. There is one exception. Sometimes one or two of the computers acts perfectly normal for a day.
Post #53 last edited
Thanks for the recap. :)

We need to try and get you online. It would appear that this is being caused by the buffpuma.com redirect infection.

As OTL had a problem, we’ll have to manually flush the DNS cache:
Copy and paste these lines in Notepad. 

:@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0


Save as flush.bat to your desktop.

Double click on the flush.bat file to run it. Your computer will reboot itself.

=============================================

Did you reset your router? If not please do so. This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labelled "reset" located on the back of the router. • press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).
• you also need to reconfigure any security settings you had in place prior to the reset.
• you may also need to consult with your Internet service provider to find out which DNS servers your network should be using.
=============================================

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1
Download Mirror #2
  • double-click SystemLook.exe to run it.
  • copy the content of the following codebox into the main textfield:

    :filefind
*buffpuma*
*askthecrew*

:Regfind
*buffpuma*
*askthecrew*

  • click the Look button to start the scan.
  • when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Let me know if there is any change. I may have to consult one of our Networking experts if that doesn’t work.

Satchfan
Post #54 last edited
Now I'm being redirected here when I click on a google search result link : http://dbgame.info/feed.php?kwd=test&u…com%2F&aff=

SystemLook 30.07.11 by jpshortstuff
Log created at 15:59 on 25/02/2012 by Heidi Seitz
Administrator - Elevation successful

========== filefind ==========

Searching for "*buffpuma*"
No files found.

Searching for "*askthecrew*"
No files found.

========== Regfind ==========

Searching for "*buffpuma*"
No data found.

Searching for "*askthecrew*"
No data found.

-= EOF =-



Sorry but still can't load gmail.com either. Whatever it is; it's effecting my entire network and apparently anything google. If you need to hand me over to a Networking expert it's ok.
Post #57
Ok repeated the process one more time in the order you directed. I did the flush.bat, then reset the router, then ran systemlook with the stuff you told me to paste. No changes. Still can't load g-mail.com and still redirected from google links. Here is second systemlook.txt SystemLook 30.07.11 by jpshortstuff Log created at 19:18 on 25/02/2012 by Heidi Seitz Administrator - Elevation successful ========== filefind ========== Searching for "*buffpuma*" No files found. Searching for "*askthecrew*" No files found. ========== Regfind ========== Searching for "*buffpuma*" No data found. Searching for "*askthecrew*" No data found. -= EOF =-
Post #58
I would agree that this is more a networking issue than malware at the moment but the fact that the OTL fix wouldn't work and aswMBR won't run is a bit of a concern, especially as there is mention of an "unknown MBR", (Master Boot Record). This is not always sinister but that combined with the issues I just mentioned makes it worth reviewing further.

I'd like you to try running aswMBR in safe mode.

=================================

Next, before sending you to our Networking experts, I'd like you to run another scan.

Please download MiniToolBox, save it to your desktop and run it.

Checkmark the following checkboxes:
  • Flush DNS
  • Report IE Proxy Settings
  • Reset IE Proxy Settings
  • Report FF Proxy Settings
  • Reset FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Users, Partitions and Memory size.
  • List Minidump Files
Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option, Firefox should be closed.

Thanks

Satchfan
Post #59 last edited
Computer will not stay running in safe mode or safe mode with networking. Tried safemode first then realized the avast could not update so I shut it down and restarted with networking. It shut off before my desktop loaded. Then tried just safemode again and same thing. So I will run the second scan you asked for. Is it possible, if / when you send me to a networking specialist, I could get someone as close to my timezone as possible. I'm on the East coast of the USA so it's 4 p.m. here right now.
Post #60
MiniToolBox by Farbar Version: 18-01-2012 Ran by [removed] (administrator) on 26-02-2012 at 15:51:56 Microsoft Windows XP Professional Service Pack 3 (X86) Boot Mode: Normal *************************************************************************** ========================= Flush DNS: =================================== Windows IP Configuration Successfully flushed the DNS Resolver Cache. ========================= IE Proxy Settings: ============================== Proxy is not enabled. No Proxy Server is set. "Reset IE Proxy Settings": IE Proxy Settings were reset. ========================= FF Proxy Settings: ============================== "Reset FF Proxy Settings": Firefox Proxy settings were reset. ========================= Hosts content: ================================= 127.0.0.1 localhost ========================= IP Configuration: ================================ Broadcom 802.11b/g WLAN = Wireless Network Connection 2 (Connected) 1394 Net Adapter = 1394 Connection (Connected) NVIDIA nForce Networking Controller = Local Area Connection (Media disconnected) # ———————————- # Interface IP Configuration # ———————————- pushd interface ip # Interface IP Configuration for "Local Area Connection" set address name="Local Area Connection" source=dhcp set dns name="Local Area Connection" source=dhcp register=PRIMARY set wins name="Local Area Connection" source=dhcp # Interface IP Configuration for "Wireless Network Connection 2" set address name="Wireless Network Connection 2" source=dhcp set dns name="Wireless Network Connection 2" source=dhcp register=PRIMARY set wins name="Wireless Network Connection 2" source=dhcp popd # End of interface IP configuration Windows IP Configuration Host Name . . . . . . . . . . . . : Heidi Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Unknown IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No Ethernet adapter Local Area Connection: Media State . . . . . . . . . . . : Media disconnected Description . . . . . . . . . . . : NVIDIA nForce Networking Controller Physical Address. . . . . . . . . : 00-16-D3-14-61-33 Ethernet adapter Wireless Network Connection 2: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Broadcom 802.11b/g WLAN Physical Address. . . . . . . . . : 00-14-A5-CF-E5-AA Dhcp Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IP Address. . . . . . . . . . . . : 192.168.1.42 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.1.1 DHCP Server . . . . . . . . . . . : 192.168.1.3 DNS Servers . . . . . . . . . . . : [removed] Lease Obtained. . . . . . . . . . : Sunday, February 26, 2012 3:44:15 PM Lease Expires . . . . . . . . . . : Monday, February 27, 2012 3:44:15 PM Server: UnKnown Address: 85.195.91.34 Name: google.com Address: 85.195.93.243 Pinging google.com [85.195.93.243] with 32 bytes of data: Reply from 85.195.93.243: bytes=32 time=147ms TTL=56 Reply from 85.195.93.243: bytes=32 time=140ms TTL=56 Ping statistics for 85.195.93.243: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 140ms, Maximum = 147ms, Average = 143ms Server: UnKnown Address: 85.195.91.34 Name: yahoo.com Addresses: 209.191.122.70, 98.139.127.62, 98.139.183.24 Pinging yahoo.com [98.139.183.24] with 32 bytes of data: Reply from 98.139.183.24: bytes=32 time=183ms TTL=49 Reply from 98.139.183.24: bytes=32 time=143ms TTL=50 Ping statistics for 98.139.183.24: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 143ms, Maximum = 183ms, Average = 163ms Server: UnKnown Address: 85.195.91.34 Name: bleepingcomputer.com Address: 208.43.87.2 Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data: Reply from 208.43.87.2: Destination host unreachable. Reply from 208.43.87.2: Destination host unreachable. Ping statistics for 208.43.87.2: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms Pinging 127.0.0.1 with 32 bytes of data: Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 Ping statistics for 127.0.0.1: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms =========================================================================== Interface List 0x1 ……………………… MS TCP Loopback interface 0x2 …00 16 d3 14 61 33 …… NVIDIA nForce Networking Controller 0x10004 …00 14 a5 cf e5 aa …… Broadcom 802.11b/g WLAN =========================================================================== =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.42 25 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 169.254.0.0 255.255.0.0 192.168.1.42 192.168.1.42 20 192.168.1.0 255.255.255.0 192.168.1.42 192.168.1.42 25 192.168.1.42 255.255.255.255 127.0.0.1 127.0.0.1 25 192.168.1.255 255.255.255.255 192.168.1.42 192.168.1.42 25 224.0.0.0 240.0.0.0 192.168.1.42 192.168.1.42 25 255.255.255.255 255.255.255.255 192.168.1.42 2 1 255.255.255.255 255.255.255.255 192.168.1.42 192.168.1.42 1 Default Gateway: 192.168.1.1 =========================================================================== Persistent Routes: None ========================= Winsock entries ===================================== Catalog5 01 C:\Windows\System32\mswsock.dll [245248] (Microsoft Corporation) Catalog5 02 C:\Windows\System32\winrnr.dll [16896] (Microsoft Corporation) Catalog5 03 C:\Windows\System32\mswsock.dll [245248] (Microsoft Corporation) Catalog5 04 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.) Catalog9 01 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 02 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 03 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 04 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 05 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 06 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 07 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 08 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 09 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 10 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 11 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 12 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 13 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 14 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 15 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation) Catalog9 16 C:\Windows\system32\rsvpsp.dll [92672] (Microsoft Corporation) Catalog9 17 C:\Windows\system32\rsvpsp.dll [92672] (Microsoft Corporation) ========================= Event log errors: =============================== Application errors: ================== Error: (02/25/2012 04:10:04 PM) (Source: Application Hang) (User: ) Description: Hanging application iexplore.exe, version 7.0.6000.17108, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error: (02/25/2012 04:09:48 PM) (Source: Application Hang) (User: ) Description: Hanging application iexplore.exe, version 7.0.6000.17108, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error: (02/25/2012 04:09:29 PM) (Source: Application Hang) (User: ) Description: Hanging application iexplore.exe, version 7.0.6000.17108, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error: (02/24/2012 07:26:26 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 8000 Error: (02/24/2012 07:26:26 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 8000 Error: (02/24/2012 07:26:26 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (02/24/2012 07:26:24 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 5985 Error: (02/24/2012 07:26:24 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 5985 Error: (02/24/2012 07:26:24 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (02/24/2012 07:26:22 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 4032 System errors: ============= Error: (02/26/2012 03:44:17 PM) (Source: 0) (User: ) Description: 255 Error: (02/26/2012 03:44:17 PM) (Source: 0) (User: ) Description: 255 Error: (02/26/2012 03:42:10 PM) (Source: DCOM) (User: Heidi Seitz) Description: DCOM got error "%%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E} Microsoft Office Sessions: ========================= Error: (02/25/2012 04:10:04 PM) (Source: Application Hang)(User: ) Description: iexplore.exe7.0.6000.17108hungapp0.0.0.000000000 Error: (02/25/2012 04:09:48 PM) (Source: Application Hang)(User: ) Description: iexplore.exe7.0.6000.17108hungapp0.0.0.000000000 Error: (02/25/2012 04:09:29 PM) (Source: Application Hang)(User: ) Description: iexplore.exe7.0.6000.17108hungapp0.0.0.000000000 Error: (02/24/2012 07:26:26 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 8000 Error: (02/24/2012 07:26:26 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 8000 Error: (02/24/2012 07:26:26 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (02/24/2012 07:26:24 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 5985 Error: (02/24/2012 07:26:24 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 5985 Error: (02/24/2012 07:26:24 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (02/24/2012 07:26:22 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 4032 =========================== Installed Programs ============================ Adobe Flash Player 10 ActiveX (Version: 10.1.53.64) Adobe Flash Player 10 Plugin (Version: 10.2.152.32) Adobe Reader 9.4.1 (Version: 9.4.1) Apple Application Support (Version: 1.4.1) Apple Mobile Device Support (Version: 3.3.1.3) Apple Software Update (Version: 2.1.1.116) AutoUpdate (Version: 1.0) Bonjour (Version: 2.0.4.0) BufferChm (Version: 60.0.155.000) Conexant HD Audio Coupon Printer for Windows (Version: 5.0.0.1) CP_AtenaShokunin1Config (Version: 60.0.155.000) CP_CalendarTemplates1 (Version: 60.0.155.000) cp_LightScribeConfig (Version: 60.0.155.000) cp_OnlineProjectsConfig (Version: 60.0.155.000) CP_Package_Basic1 (Version: 60.0.155.000) CP_Package_Variety1 (Version: 60.0.155.000) CP_Package_Variety2 (Version: 60.0.155.000) CP_Package_Variety3 (Version: 60.0.155.000) CP_Panorama1Config (Version: 60.0.155.000) cp_PosterPrintConfig (Version: 60.0.155.000) cp_UpdateProjectsConfig (Version: 60.0.155.000) CueTour (Version: 60.0.155.000) Customer Experience Enhancement (Version: Customer Experience Enhancement -1.0.0.1680) Destinations (Version: 60.0.155.000) DeviceManagementQFolder (Version: 1.00.0000) DivX (Version: 5.2.1) Easy Internet Sign-up (Version: FE UI-4.1.0.1680) EPSON TWAIN 5 ESPNMotion (Version: 2.1.6.0011) FullDPAppQFolder (Version: 1.00.0000) Garmin Communicator Plugin (Version: 3.0.1) Garmin USB Drivers (Version: 2.3.0.0) GemMaster Mystic Google Chrome (Version: 17.0.963.56) HDAUDIO Soft Data Fax Modem with SmartCP HP Help and Support (Version: 4.2.0013) HP Imaging Device Functions 6.0 (Version: 6.0) HP Photosmart Premier Software 6.0 (Version: 6.0) HP Quick Launch Buttons 6.10 A2 (Version: 6.10 A2) HP QuickPlay 2.3 HP Rhapsody HP Update (Version: 5.002.001.004) HP User Guides 0027 (Version: 1.05.0002) HP Wireless Assistant 2.00 G2 (Version: 2.00 G2) HpSdpAppCoreApp (Version: 3.00.0000) InstantShareDevices (Version: 60.0.155.000) iTunes (Version: 10.1.2.17) J2SE Runtime Environment 5.0 Update 6 (Version: 1.5.0.60) Java Auto Updater (Version: 2.0.5.1) Java™ 6 Update 26 (Version: 6.0.260) Java™ 6 Update 4 (Version: 1.6.0.40) LightScribe 1.4.97.1 (Version: 1.4.97.1) Macromedia Shockwave Player (Version: 10.1.1.016) Malwarebytes Anti-Malware version 1.60.1.1000 (Version: 1.60.1.1000) Microsoft .NET Framework 1.0 Hotfix (KB2572066) Microsoft .NET Framework 1.0 Hotfix (KB979904) Microsoft .NET Framework 1.1 (Version: 1.1.4322) Microsoft .NET Framework 1.1 Security Update (KB2656353) Microsoft .NET Framework 1.1 Security Update (KB979906) Microsoft Compression Client Pack 1.0 for Windows XP (Version: 1) Microsoft Internationalized Domain Names Mitigation APIs Microsoft Money 2006 (Version: 15) Microsoft National Language Support Downlevel APIs Microsoft Office File Validation Add-In (Version: 14.0.5130.5003) Microsoft Office Standard Edition 2003 (Version: 11.0.8173.0) Microsoft Silverlight (Version: 4.1.10111.0) Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Works (Version: 08.04.0623) Mozilla Firefox 10.0.1 (x86 en-US) (Version: 10.0.1) MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0) muvee autoProducer 5.0 (Version: 5.00.050) My HP Games (Version: HPLAP0202) Netscape Browser (remove only) NetWaiting (Version: 2.5.37) Norton 360 (Version: 6.0.1.2) NVIDIA Drivers Office 2003 Trial Assistant (Version: 1.0.0) Opera 11.11 (Version: 11.11.2109) OptionalContentQFolder (Version: 1.00.0000) Otto PhotoGallery (Version: 60.0.155.000) Quicken 2006 (Version: 15.1.4.5) QuickTime (Version: 7.69.80.9) RandMap (Version: 60.0.155.000) SkinsHP1 (Version: 60.0.155.000) Sonic Audio Module (Version: 2.0.4) Sonic Copy Module (Version: 2.0.4) Sonic Data Module (Version: 2.0.4) Sonic Express Labeler (Version: 2.0.0) Sonic MyDVD Plus (Version: 6.2.0) Sonic Update Manager (Version: 3.0.0) Sonic_PrimoSDK (Version: 60.0.155.000) SonicAC3Encoder (Version: 1.00.0000) SonicMPEGEncoder (Version: 1.00.0000) Synaptics Pointing Device Driver (Version: 8.3.8.0) TomTom HOME 2.8.2.2264 (Version: 2.8.2.2264) TomTom HOME Visual Studio Merge Modules (Version: 1.0.2) TourSetup (Version: 1.0.0) Unload (Version: 6.0.0) Update for Windows Media Player 10 (KB910393) Update for Windows Media Player 10 (KB913800) Update for Windows Media Player 10 (KB926251) Update for Windows XP (KB2141007) (Version: 1) Update for Windows XP (KB2345886) (Version: 1) Update for Windows XP (KB2467659) (Version: 1) Update for Windows XP (KB2541763) (Version: 1) Update for Windows XP (KB2607712) (Version: 1) Update for Windows XP (KB2616676) (Version: 1) Update for Windows XP (KB2641690) (Version: 1) Update for Windows XP (KB951978) (Version: 1) Update for Windows XP (KB955759) (Version: 1) Update for Windows XP (KB967715) (Version: 1) Update for Windows XP (KB968389) (Version: 1) Update for Windows XP (KB971029) (Version: 1) Update for Windows XP (KB971737) (Version: 1) Update for Windows XP (KB973687) (Version: 1) Update for Windows XP (KB973815) (Version: 1) Update for Windows XP (KB978207) (Version: 1) Update for Windows XP (KB980182) (Version: 1) Update Rollup 2 for Windows XP Media Center Edition 2005 Vongo (Version: 1.31.02) WebFldrs XP (Version: 9.50.7523) WildTangent Web Driver Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0) (Version: 05/27/2006 1.3.2.0) Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) (Version: 06/03/2009 2.3.0.0) Windows Genuine Advantage Validation Tool (KB892130) Windows Genuine Advantage Validation Tool (KB892130) (Version: 1.7.0069.2) Windows Internet Explorer 7 (Version: 20070813.185237) Windows Media Connect Windows Media Format 11 runtime Windows Media Player 11 Windows XP Media Center Edition 2005 KB2502898 Windows XP Media Center Edition 2005 KB2619340 Windows XP Media Center Edition 2005 KB2628259 Windows XP Media Center Edition 2005 KB925766 Windows XP Media Center Edition 2005 KB973768 Windows XP Service Pack 3 (Version: 20080414.031525) Wireless Home Network Setup (Version: 1.1.154.1) ========================= Memory info: =================================== Percentage of memory in use: 56% Total physical RAM: 958.6 MB Available physical RAM: 416.25 MB Total Pagefile: 2313.14 MB Available Pagefile: 1783.84 MB Total Virtual: 2047.88 MB Available Virtual: 1974.72 MB ========================= Partitions: ===================================== 1 Drive c: () (Fixed) (Total:99 GB) (Free:15.2 GB) NTFS 2 Drive d: (HP_RECOVERY) (Fixed) (Total:11.75 GB) (Free:1.15 GB) FAT32 ========================= Users: ======================================== User accounts for \\HEIDI Administrator ASPNET Guest Heidi Seitz HelpAssistant Jolly Beans SUPPORT_388945a0 ========================= Minidump Files ================================== C:\WINDOWS\Minidump\Mini021612-01.dmp C:\WINDOWS\Minidump\Mini021712-01.dmp C:\WINDOWS\Minidump\Mini021712-02.dmp C:\WINDOWS\Minidump\Mini022012-01.dmp C:\WINDOWS\Minidump\Mini040309-01.dmp **** End of log ****

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI