What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Start.funmoods infection [Solved]

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello. I've just been caught out by not concentrating and now whenever I try to use Google it redirects me to the above site, I am running Vista with all the latest updates,also using Microsoft essentials with the latest updates and scans. I think it became infected when I upgraded to the latest Google Chrome or during an upgrade to Sumatra PDF.
I am not very well up on computer useage , so need a guiding hand , again !
I have scanned using (Highjack This) as requested and hopefully have attached the results.Logfile of Trend Micro HijackThis
Thanks in advance , Neale

v2.0.4
Scan saved at 10:54:14, on 11/04/2012
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\QuickTime\qttask.exe
C:\Windows\System32\ATWTUSB.EXE
C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe
C:\Windows\sttray.exe
C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe
C:\Users\`neale\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\WTablet\Pen_TabletUser.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
C:\Users\`neale\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Windows\system32\wuauclt.exe
C:\Users\`neale\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss&am…0000019d14e0c56
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co.uk/ig/dell?hl=en&…amp;ibd=2070422
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\bh\BabylonToolbar.dll
O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Runtime\YontooIEClient.dll
O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarTlbr.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [ECenter] c:\dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [basicsmssmenu] "C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe"
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [ServiceManager.exe] "C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe" /AUTORUN
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [V Stuff Backup] "C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe" /delayed
O4 - HKCU\..\Run: [Google Update] "C:\Users\`neale\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll (file missing)
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: Basics Service - Seagate Technology LLC - C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: ServicepointService - Radialpoint Inc. - C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe

–
End of file - 7298 bytes
Post #2
Hello airbus99 and :welcome:

My name is JonTom

  • Malware Logs can sometimes take a lot of time to research and interpret.
  • Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  • Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  • Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  • PLEASE NOTE: If you do not reply after 3 days your thread will be closed.


Lets take a closer look with the following scans:


  • Download and run OTL by Oldtimer


    • Please download OTL by Oldtimer by clicking here and save the file (called OTL.exe) to your desktop.
    • Close all open windows on your computer then Right click on the OTL.exe icon and select "Run as Administrator" to run the program.
    • Check the boxes beside "LOP Check" and "Purity Check".
    • Under Custom Scan paste this in:

    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    symmpi.sys
    adp3132.sys
    /md5stop
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\drivers\*.sys /90


    • Click the "Run Scan" button. Do not change any settings unless specifically told to do so. The scan will not take long.

    • When the scan completes, it will open two notepad windows: OTL.Txt and Extras.Txt.
    • Note: These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
    • Please Copy and Paste the contents of both files in your next reply. You may need two posts to fit them both in.

  • aswMBR


    • Download aswMBR.exe to your desktop.
    • Double click the aswMBR.exe to run it.
    • When asked if you want to download Avast's virus definitions please select Yes.
    • Click the "Scan" button to start scan.

    [external image: Posted Image]

    • On completion of the scan click save log, save it to your desktop and post in your next reply.

    [external image: Posted Image]

    Please post both OTL logs in your next reply along with the aswMBR log.
Post #3
Hello JonTom,
Thanks for your quick reply;
I have copied and pasted the OTL report as requested;

OTL logfile created on: 11/04/2012 19:46:44 - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\`neale\Cars,Bikes,Planes\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.99 Gb Total Physical Memory | 1.13 Gb Available Physical Memory | 57.05% Memory free
4.21 Gb Paging File | 3.20 Gb Available in Paging File | 76.02% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.79 Gb Total Space | 75.43 Gb Free Space | 33.86% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.38 Gb Free Space | 63.76% Space Free | Partition Type: NTFS

Computer Name: NEALEPC | User Name: `neale | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/11 19:41:53 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Users\`neale\Cars,Bikes,Planes\Downloads\OTL.exe
PRC - [2011/06/15 15:16:48 | 000,997,920 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/04/27 15:39:26 | 000,208,944 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
PRC - [2011/04/27 15:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2011/03/25 13:34:04 | 000,689,464 | —- | M] (Radialpoint Inc.) – C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe
PRC - [2011/03/25 13:34:00 | 004,371,768 | —- | M] (Virgin Media) – C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe
PRC - [2010/04/14 13:27:58 | 008,263,584 | —- | M] (Steek) – C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe
PRC - [2010/04/14 13:26:16 | 007,059,360 | —- | M] () – C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
PRC - [2009/04/11 07:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/09/06 11:38:59 | 000,068,608 | —- | M] () – C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
PRC - [2008/05/01 23:41:38 | 000,136,488 | —- | M] (Wacom Technology, Corp.) – C:\Windows\System32\WTablet\Pen_TabletUser.exe
PRC - [2008/05/01 23:40:44 | 003,032,360 | —- | M] (Wacom Technology, Corp.) – C:\Windows\System32\Pen_Tablet.exe
PRC - [2007/10/09 17:21:06 | 000,169,328 | —- | M] (Maxtor Corporation) – C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
PRC - [2007/10/09 17:21:02 | 000,124,280 | —- | M] (Seagate Technology LLC) – C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
PRC - [2007/02/08 06:16:24 | 000,303,104 | —- | M] (SigmaTel, Inc.) – C:\Windows\sttray.exe
PRC - [2006/11/12 02:19:46 | 000,446,976 | —- | M] (Gteko Ltd.) – C:\Program Files\DellSupport\DSAgnt.exe
PRC - [2006/11/05 11:22:16 | 000,221,184 | —- | M] (Sonic Solutions) – C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
PRC - [2006/11/05 10:55:48 | 000,010,752 | —- | M] (Sonic Solutions) – C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
PRC - [2006/11/02 20:40:12 | 000,174,656 | —- | M] () – C:\Windows\System32\PSIService.exe
PRC - [2006/10/12 15:57:08 | 000,102,400 | —- | M] (SEIKO EPSON CORPORATION) – C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe
PRC - [2006/09/29 12:39:20 | 000,151,552 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2006/09/29 12:38:50 | 000,081,920 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2005/09/21 19:08:48 | 000,290,816 | —- | M] (WALTOP International Corp.) – C:\Windows\System32\ATWTUSB.EXE


========== Modules (No Company Name) ==========

MOD - [2012/04/09 21:28:48 | 000,444,400 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\ppGoogleNaClPluginChrome.dll
MOD - [2012/04/09 21:28:46 | 003,915,248 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\pdf.dll
MOD - [2012/04/09 21:27:21 | 000,122,880 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\avutil-51.dll
MOD - [2012/04/09 21:27:20 | 000,220,672 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\avformat-53.dll
MOD - [2012/04/09 21:27:19 | 001,747,456 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\avcodec-53.dll
MOD - [2012/04/09 20:42:11 | 008,743,584 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\gcswf32.dll
MOD - [2012/04/09 20:42:11 | 008,743,584 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\APPLIC~1\180102~1.152\gcswf32.dll
MOD - [2011/03/25 13:25:14 | 000,158,208 | —- | M] () – C:\Program Files\Virgin Media\Service Manager\Windows7Features.dll
MOD - [2010/04/14 13:26:16 | 007,059,360 | —- | M] () – C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
MOD - [2007/02/09 19:32:36 | 000,061,440 | —- | M] () – C:\Windows\System32\igfxTMM.dll
MOD - [2007/02/09 19:32:28 | 000,077,824 | —- | M] () – C:\Windows\System32\hccutils.dll
MOD - [2006/11/05 10:58:44 | 000,516,096 | —- | M] () – C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\LayoutDll9.dll
MOD - [2006/11/05 10:28:18 | 004,587,520 | R— | M] () – C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\ROXIPP41.dll
MOD - [2002/04/28 17:12:04 | 000,122,880 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/04/27 15:39:26 | 000,208,944 | —- | M] (Microsoft Corporation) [On_Demand | Running] – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe – (NisSrv)
SRV - [2011/04/27 15:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe – (MsMpSvc)
SRV - [2011/03/25 13:34:04 | 000,689,464 | —- | M] (Radialpoint Inc.) [Auto | Running] – C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe – (ServicepointService)
SRV - [2010/02/19 13:37:14 | 000,517,096 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe – (SwitchBoard)
SRV - [2008/09/06 11:38:59 | 000,068,608 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe – (Autodata Limited License Service)
SRV - [2008/05/01 23:40:44 | 003,032,360 | —- | M] (Wacom Technology, Corp.) [Auto | Running] – C:\Windows\System32\Pen_Tablet.exe – (TabletServicePen)
SRV - [2008/01/19 08:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/10/09 17:21:02 | 000,124,280 | —- | M] (Seagate Technology LLC) [Auto | Running] – C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe – (Basics Service)
SRV - [2006/11/07 13:27:02 | 000,070,656 | —- | M] () [On_Demand | Stopped] – C:\Program Files\DellSupport\brkrsvc.exe – (DSBrokerService)
SRV - [2006/11/02 20:40:12 | 000,174,656 | —- | M] () [Auto | Running] – C:\Windows\System32\PSIService.exe – (ProtexisLicensing)
SRV - [2006/09/29 12:38:50 | 000,081,920 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe – (IAANTMON) Intel®


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\`neale\AppData\Local\Temp\catchme.sys – (catchme)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive)
DRV - File not found [Kernel | Disabled | Stopped] – system32\DRIVERS\AVGIDSShim.Sys – (AVGIDSShim)
DRV - [2012/04/11 19:38:06 | 000,029,904 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7910363C-FE80-4912-B76A-4E9EA72454F6}\MpKsl67a56c7f.sys – (MpKsl67a56c7f)
DRV - [2011/04/27 15:25:24 | 000,065,024 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NisDrvWFP.sys – (NisDrv)
DRV - [2011/04/18 13:18:50 | 000,043,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\MpNWMon.sys – (MpNWMon)
DRV - [2009/12/30 11:21:18 | 000,027,192 | —- | M] (VS Revo Group) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\revoflt.sys – (Revoflt)
DRV - [2008/03/17 21:14:52 | 000,015,144 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacmoumonitor.sys – (wacmoumonitor)
DRV - [2008/01/19 05:25:05 | 000,220,672 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2008/01/15 21:11:46 | 000,013,480 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacomvhid.sys – (wacomvhid)
DRV - [2007/02/16 20:12:36 | 000,011,312 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacommousefilter.sys – (wacommousefilter)
DRV - [2007/02/16 01:11:28 | 000,011,440 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\WacomVKHid.sys – (WacomVKHid)
DRV - [2007/02/08 06:16:26 | 000,647,680 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2006/11/10 15:05:00 | 000,018,688 | —- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\afc.sys – (Afc)
DRV - [2006/11/02 08:36:43 | 002,028,032 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2006/10/05 16:07:28 | 000,004,736 | —- | M] (Gteko Ltd.) [Kernel | On_Demand | Running] – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys – (DSproct)
DRV - [2006/08/17 15:43:52 | 000,007,424 | –S- | M] (Gteko Ltd.) [Kernel | Auto | Running] – C:\Program Files\DellSupport\Drivers\dsunidrv.sys – (dsunidrv)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {8A96AF9E-4074-43b7-BEA3-87217BDA7406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUK
IE - HKLM\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = http://www.searchqu.com/web?src=ieb&sy…q={searchTerms}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2769726

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss&am…0000019d14e0c56
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7E B1 56 ED 3C 0A CC 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms…0000019d14e0c56
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = http://www.searchqu.com/web?src=ieb&sy…q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\Virgin Media\Service Manager\nprpspa.dll (Virgin Media)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\`neale\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\`neale\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/04/29 11:30:02 | 000,000,000 | —D | M]

[2012/04/09 17:17:57 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Search (Enabled)
CHR - default_search_provider: search_url = http://start.funmoods.com/results.php?f=4&…q={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\gears.dll
CHR - plugin: Service Manager (Enabled) = C:\Program Files\Virgin Media\Service Manager\nprpspa.dll
CHR - plugin: Google Update (Enabled) = C:\Users\`neale\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2011/05/21 17:17:32 | 000,000,771 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Runtime\YontooIEClient.dll (Yontoo LLC)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarTlbr.dll (Babylon Ltd.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [atwtusb] C:\Windows\System32\ATWTUSB.EXE (WALTOP International Corp.)
O4 - HKLM..\Run: [basicsmssmenu] C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe (Maxtor Corporation)
O4 - HKLM..\Run: [ECenter] c:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [EEventManager] C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [ServiceManager.exe] C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe (Virgin Media)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Windows\sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [V Stuff Backup] C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe (Steek)
O4 - Startup: C:\Users\`neale\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0CD46C3-08EC-4676-B2D6-0382B1DA21DE}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

========== Files/Folders - Created Within 30 Days ==========

[2012/04/09 17:19:49 | 000,000,000 | —D | C] – C:\Program Files\7-Zip
[2012/04/09 17:19:43 | 000,000,000 | —D | C] – C:\Program Files\PriceGong
[2012/04/09 17:18:14 | 000,000,000 | —D | C] – C:\Users\`neale\AppData\Local\Wajam
[2012/04/09 17:18:13 | 000,000,000 | —D | C] – C:\Program Files\Wajam
[2012/04/09 17:17:58 | 000,000,000 | —D | C] – C:\Program Files\Funmoods
[2012/04/09 17:17:57 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2012/04/05 20:03:48 | 000,000,000 | —D | C] – C:\Users\`neale\Cars,Bikes,Planes\Honda CB350
[2012/03/21 18:45:54 | 001,172,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10warp.dll
[2012/03/21 18:45:54 | 001,068,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2012/03/21 18:45:54 | 000,219,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1core.dll
[2012/03/21 18:45:53 | 000,683,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d2d1.dll
[2012/03/21 18:45:53 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2012/03/21 18:45:51 | 002,044,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/03/21 18:45:35 | 000,613,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpencom.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/11 19:44:08 | 000,001,021 | —- | M] () – C:\Users\`neale\Desktop\OTL - Shortcut.lnk
[2012/04/11 19:42:45 | 000,610,860 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/04/11 19:42:45 | 000,109,268 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/04/11 19:39:45 | 000,054,156 | -H– | M] () – C:\Windows\QTFont.qfn
[2012/04/11 19:37:54 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/11 19:37:54 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/11 19:37:38 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/04/11 18:58:00 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000UA.job
[2012/04/11 18:58:00 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000Core.job
[2012/04/11 16:45:55 | 030,890,992 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\pspbrwse.jbf
[2012/04/11 16:36:03 | 000,002,635 | —- | M] () – C:\Users\`neale\Desktop\Jasc Paint Shop Pro 9.lnk
[2012/04/11 11:01:23 | 000,002,049 | —- | M] () – C:\Users\`neale\Desktop\Google Chrome.lnk
[2012/04/11 11:01:23 | 000,002,011 | —- | M] () – C:\Users\`neale\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/03/21 18:54:22 | 003,720,208 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/03/16 18:58:40 | 000,210,944 | —- | M] () – C:\Users\`neale\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/03/16 18:45:17 | 000,057,227 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\Rotax 250 stripdown web 09
[2012/03/16 18:00:24 | 002,901,282 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop.JPG
[2012/03/16 17:59:55 | 002,639,454 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop (2).JPG
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/11 19:44:08 | 000,001,021 | —- | C] () – C:\Users\`neale\Desktop\OTL - Shortcut.lnk
[2012/04/09 18:53:50 | 000,000,912 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000UA.job
[2012/04/09 18:53:48 | 000,000,860 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000Core.job
[2012/03/16 18:58:25 | 000,057,227 | —- | C] () – C:\Users\`neale\Cars,Bikes,Planes\Rotax 250 stripdown web 09
[2012/03/16 17:57:15 | 002,901,282 | —- | C] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop.JPG
[2012/03/16 17:57:15 | 002,639,454 | —- | C] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop (2).JPG
[2011/09/04 15:44:28 | 000,098,304 | —- | C] () – C:\Windows\System32\redmonnt.dll
[2011/09/02 20:23:31 | 000,000,132 | —- | C] () – C:\Users\`neale\AppData\Roaming\Adobe AIFF Format CS5 Prefs
[2011/06/18 12:30:02 | 000,000,132 | —- | C] () – C:\Users\`neale\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2011/04/16 11:17:49 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2011/03/17 18:07:56 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011/03/16 15:53:25 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2011/03/16 15:53:24 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2010/12/13 18:41:10 | 000,140,800 | —- | C] () – C:\Windows\serifun.exe
[2010/12/13 18:22:46 | 000,061,440 | —- | C] () – C:\Windows\System32\cdTextCtl.dll
[2010/11/17 18:21:50 | 000,000,008 | RHS- | C] () – C:\Windows\System32\B841734FE1.sys
[2010/07/27 20:35:49 | 000,006,224 | —- | C] () – C:\Users\`neale\AppData\Roaming\pspbrwse.jbf

========== LOP Check ==========

[2007/08/12 17:46:50 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Alien Skin
[2011/03/09 17:25:57 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\AVG10
[2011/09/04 15:43:56 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Babylon
[2010/12/10 15:46:46 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Blender Foundation
[2010/12/03 18:18:59 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Canneverbe Limited
[2011/09/05 13:39:46 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\CasaPortale.de
[2010/12/14 18:26:39 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\CD Label Designer
[2008/05/09 14:23:53 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\EPSON
[2007/07/02 19:59:47 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Hemera
[2010/09/01 19:39:48 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\InterTrust
[2007/08/27 16:34:22 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Opera
[2011/05/21 18:50:26 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011/07/11 17:10:16 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\SumatraPDF
[2007/04/25 20:03:28 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Template
[2011/05/11 13:44:47 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Virgin Media
[2012/04/11 19:29:52 | 000,032,620 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< Post #2 >

< >

< >

< SuperMember >

< >

< >

< Group: Classroom Teacher >

< Posts: 3,414 >

< Joined: 5-February 09 >

< From: UK >

< Member No.: 84,008 >

< Operating System: Vista Home Premium, 64-bit, SP2 >

< >

< >

< >

< Hello airbus99 and >

< >

< My name is JonTom >

< >

< Malware Logs can sometimes take a lot of time to research and interpret. >

< Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation. >

< Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean. >

< Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet. >

< PLEASE NOTE: If you do not reply after 3 days your thread will be closed. >

< >

< >

< >

< Lets take a closer look with the following scans: >

< >

< >

< Download and run OTL by Oldtimer >

< >

< >

< Please download OTL by Oldtimer by clicking here and save the file (called OTL.exe) to your desktop. >

< Close all open windows on your computer then Right click on the OTL.exe icon and select "Run as Administrator" to run the program. >

< Check the boxes beside "LOP Check" and "Purity Check". >

< Under Custom Scan paste this in: >

< >

< >

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2008/01/19 08:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008/01/19 08:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008/01/19 08:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008/01/19 08:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2007/04/22 01:41:42 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\ERDNT\cache\AGP440.sys
[2007/04/22 01:41:42 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\System32\drivers\AGP440.sys
[2007/04/22 01:41:42 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_8ed06b47\AGP440.sys
[2007/04/22 01:41:42 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.16400_none_b82caac9c18a4e3b\AGP440.sys
[2007/04/22 01:41:41 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=BF34B4A0E0B64440C5389AA6B902F4AD – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20496_none_b85af81edaeb8461\AGP440.sys
[2006/11/02 10:49:52 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/04/11 07:32:26 | 000,019,944 | —- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009/04/11 07:32:26 | 000,019,944 | —- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008/01/19 08:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/19 08:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 10:49:36 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2007/04/22 01:42:25 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=5653737BAD8C6C10136451C195C19881 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20485_none_db8a029f3dbd443b\atapi.sys
[2007/04/22 01:42:16 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\ERDNT\cache\atapi.sys
[2007/04/22 01:42:16 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\System32\drivers\atapi.sys
[2007/04/22 01:42:16 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_5a9555b4\atapi.sys
[2007/04/22 01:42:16 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20509_none_dbe4850d3d78c736\atapi.sys
[2007/04/22 01:42:25 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_82339ef2\atapi.sys
[2007/04/22 01:42:25 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16391_none_daf194c024ab5b06\atapi.sys
[2011/03/09 15:00:29 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2011/03/09 15:00:29 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2011/03/09 15:00:28 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys
[2011/03/09 15:00:28 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 10:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\ERDNT\cache\cngaudit.dll
[2006/11/02 10:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\System32\cngaudit.dll
[2006/11/02 10:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTOR.SYS >
[2006/09/29 13:16:20 | 000,495,896 | —- | M] (Intel Corporation) MD5=C212BE4F068A02E54EB0CF6F5B23569B – C:\Program Files\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys
[2006/09/29 20:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Drivers\storage\R139843\iaStor.sys
[2006/09/29 11:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Program Files\Intel\Intel Matrix Storage Manager\Driver\iaStor.sys
[2006/09/29 20:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Windows\System32\drivers\iaStor.sys
[2006/09/29 20:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_6a23f079\iaStor.sys
[2006/09/29 20:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Windows\System32\DriverStore\FileRepository\iastor.inf_0afadd92\iaStor.sys

< MD5 for: IASTORV.SYS >
[2008/01/19 08:42:51 | 000,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008/01/19 08:42:51 | 000,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 10:51:25 | 000,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 10:51:25 | 000,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 10:46:11 | 000,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009/04/11 07:28:23 | 000,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\ERDNT\cache\netlogon.dll
[2009/04/11 07:28:23 | 000,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\System32\netlogon.dll
[2009/04/11 07:28:23 | 000,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008/01/19 08:35:36 | 000,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2006/11/02 10:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 10:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/19 08:42:09 | 000,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008/01/19 08:42:09 | 000,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/19 08:36:19 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 10:46:12 | 000,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009/04/11 07:28:24 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\ERDNT\cache\scecli.dll
[2009/04/11 07:28:24 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\System32\scecli.dll
[2009/04/11 07:28:24 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2006/11/02 10:46:04 | 000,380,957 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\system32\expsrv.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2011/04/18 13:18:50 | 000,043,392 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\system32\drivers\MpNWMon.sys

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %systemroot%\system32\drivers\*.sys /90 >

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Wolseley Ten 1923 (2):Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\TWN:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Thundersprint web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Thundersprint 2010 (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Teifi Valley Railway.Wales (24) copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Teifi Valley Railway.Wales (13) copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Tatton Park July (27).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Steam car (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Sideways car.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Rotax (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC .JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC - Copy.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC - Copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Punto.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (89).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (88).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (87).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\llangollen feb 2007 002.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Jap Jag copy,Micra based web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\India Bombay03.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\IMG_0871.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Hurricane.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Honton 250 email (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Fruin.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Ferrari bike.02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\EMC V car.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\EMC V car mod2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Ducati 125 four073.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DOT (2):Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW068.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 05072.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 03070.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 02069.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DEC 2006 136.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Concorde.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Car.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Car jigsaw.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Boeing 777.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Birkenhead tram museum web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter03JPG.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter01.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga Straight from SD card 030.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga Straight from SD card 030 (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 08.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 07.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 06.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 05.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 04.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 01.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park modified 01.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (22).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (19).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle 2009 (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car.tif:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Amal carb067.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera (5).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera (3).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\AJS.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.09.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.08.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.06.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 13.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 12.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 11.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 03.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (9).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (7).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (6).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (5).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (40).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (14).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (13).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (11).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A350.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A350 02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A340.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A329.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus a321 at Hamburg.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320 04.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320 02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A319.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (8).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (7).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (6).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (5).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (4).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (28).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (27).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (26).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (25).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (15).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (14).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (13).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (12).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (11).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (10).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine modified copy (3).jpg:Roxio EMC Stream

< End of report >


OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\`neale\Cars,Bikes,Planes\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.99 Gb Total Physical Memory | 1.13 Gb Available Physical Memory | 57.05% Memory free
4.21 Gb Paging File | 3.20 Gb Available in Paging File | 76.02% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.79 Gb Total Space | 75.43 Gb Free Space | 33.86% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.38 Gb Free Space | 63.76% Space Free | Partition Type: NTFS

Computer Name: NEALEPC | User Name: `neale | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/11 19:41:53 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Users\`neale\Cars,Bikes,Planes\Downloads\OTL.exe
PRC - [2011/06/15 15:16:48 | 000,997,920 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/04/27 15:39:26 | 000,208,944 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
PRC - [2011/04/27 15:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2011/03/25 13:34:04 | 000,689,464 | —- | M] (Radialpoint Inc.) – C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe
PRC - [2011/03/25 13:34:00 | 004,371,768 | —- | M] (Virgin Media) – C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe
PRC - [2010/04/14 13:27:58 | 008,263,584 | —- | M] (Steek) – C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe
PRC - [2010/04/14 13:26:16 | 007,059,360 | —- | M] () – C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
PRC - [2009/04/11 07:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/09/06 11:38:59 | 000,068,608 | —- | M] () – C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
PRC - [2008/05/01 23:41:38 | 000,136,488 | —- | M] (Wacom Technology, Corp.) – C:\Windows\System32\WTablet\Pen_TabletUser.exe
PRC - [2008/05/01 23:40:44 | 003,032,360 | —- | M] (Wacom Technology, Corp.) – C:\Windows\System32\Pen_Tablet.exe
PRC - [2007/10/09 17:21:06 | 000,169,328 | —- | M] (Maxtor Corporation) – C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
PRC - [2007/10/09 17:21:02 | 000,124,280 | —- | M] (Seagate Technology LLC) – C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
PRC - [2007/02/08 06:16:24 | 000,303,104 | —- | M] (SigmaTel, Inc.) – C:\Windows\sttray.exe
PRC - [2006/11/12 02:19:46 | 000,446,976 | —- | M] (Gteko Ltd.) – C:\Program Files\DellSupport\DSAgnt.exe
PRC - [2006/11/05 11:22:16 | 000,221,184 | —- | M] (Sonic Solutions) – C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
PRC - [2006/11/05 10:55:48 | 000,010,752 | —- | M] (Sonic Solutions) – C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
PRC - [2006/11/02 20:40:12 | 000,174,656 | —- | M] () – C:\Windows\System32\PSIService.exe
PRC - [2006/10/12 15:57:08 | 000,102,400 | —- | M] (SEIKO EPSON CORPORATION) – C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe
PRC - [2006/09/29 12:39:20 | 000,151,552 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2006/09/29 12:38:50 | 000,081,920 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2005/09/21 19:08:48 | 000,290,816 | —- | M] (WALTOP International Corp.) – C:\Windows\System32\ATWTUSB.EXE


========== Modules (No Company Name) ==========

MOD - [2012/04/09 21:28:48 | 000,444,400 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\ppGoogleNaClPluginChrome.dll
MOD - [2012/04/09 21:28:46 | 003,915,248 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\pdf.dll
MOD - [2012/04/09 21:27:21 | 000,122,880 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\avutil-51.dll
MOD - [2012/04/09 21:27:20 | 000,220,672 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\avformat-53.dll
MOD - [2012/04/09 21:27:19 | 001,747,456 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\avcodec-53.dll
MOD - [2012/04/09 20:42:11 | 008,743,584 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\gcswf32.dll
MOD - [2012/04/09 20:42:11 | 008,743,584 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\APPLIC~1\180102~1.152\gcswf32.dll
MOD - [2011/03/25 13:25:14 | 000,158,208 | —- | M] () – C:\Program Files\Virgin Media\Service Manager\Windows7Features.dll
MOD - [2010/04/14 13:26:16 | 007,059,360 | —- | M] () – C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
MOD - [2007/02/09 19:32:36 | 000,061,440 | —- | M] () – C:\Windows\System32\igfxTMM.dll
MOD - [2007/02/09 19:32:28 | 000,077,824 | —- | M] () – C:\Windows\System32\hccutils.dll
MOD - [2006/11/05 10:58:44 | 000,516,096 | —- | M] () – C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\LayoutDll9.dll
MOD - [2006/11/05 10:28:18 | 004,587,520 | R— | M] () – C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\ROXIPP41.dll
MOD - [2002/04/28 17:12:04 | 000,122,880 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/04/27 15:39:26 | 000,208,944 | —- | M] (Microsoft Corporation) [On_Demand | Running] – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe – (NisSrv)
SRV - [2011/04/27 15:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe – (MsMpSvc)
SRV - [2011/03/25 13:34:04 | 000,689,464 | —- | M] (Radialpoint Inc.) [Auto | Running] – C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe – (ServicepointService)
SRV - [2010/02/19 13:37:14 | 000,517,096 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe – (SwitchBoard)
SRV - [2008/09/06 11:38:59 | 000,068,608 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe – (Autodata Limited License Service)
SRV - [2008/05/01 23:40:44 | 003,032,360 | —- | M] (Wacom Technology, Corp.) [Auto | Running] – C:\Windows\System32\Pen_Tablet.exe – (TabletServicePen)
SRV - [2008/01/19 08:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/10/09 17:21:02 | 000,124,280 | —- | M] (Seagate Technology LLC) [Auto | Running] – C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe – (Basics Service)
SRV - [2006/11/07 13:27:02 | 000,070,656 | —- | M] () [On_Demand | Stopped] – C:\Program Files\DellSupport\brkrsvc.exe – (DSBrokerService)
SRV - [2006/11/02 20:40:12 | 000,174,656 | —- | M] () [Auto | Running] – C:\Windows\System32\PSIService.exe – (ProtexisLicensing)
SRV - [2006/09/29 12:38:50 | 000,081,920 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe – (IAANTMON) Intel®


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\`neale\AppData\Local\Temp\catchme.sys – (catchme)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive)
DRV - File not found [Kernel | Disabled | Stopped] – system32\DRIVERS\AVGIDSShim.Sys – (AVGIDSShim)
DRV - [2012/04/11 19:38:06 | 000,029,904 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7910363C-FE80-4912-B76A-4E9EA72454F6}\MpKsl67a56c7f.sys – (MpKsl67a56c7f)
DRV - [2011/04/27 15:25:24 | 000,065,024 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NisDrvWFP.sys – (NisDrv)
DRV - [2011/04/18 13:18:50 | 000,043,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\MpNWMon.sys – (MpNWMon)
DRV - [2009/12/30 11:21:18 | 000,027,192 | —- | M] (VS Revo Group) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\revoflt.sys – (Revoflt)
DRV - [2008/03/17 21:14:52 | 000,015,144 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacmoumonitor.sys – (wacmoumonitor)
DRV - [2008/01/19 05:25:05 | 000,220,672 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2008/01/15 21:11:46 | 000,013,480 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacomvhid.sys – (wacomvhid)
DRV - [2007/02/16 20:12:36 | 000,011,312 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacommousefilter.sys – (wacommousefilter)
DRV - [2007/02/16 01:11:28 | 000,011,440 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\WacomVKHid.sys – (WacomVKHid)
DRV - [2007/02/08 06:16:26 | 000,647,680 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2006/11/10 15:05:00 | 000,018,688 | —- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\afc.sys – (Afc)
DRV - [2006/11/02 08:36:43 | 002,028,032 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2006/10/05 16:07:28 | 000,004,736 | —- | M] (Gteko Ltd.) [Kernel | On_Demand | Running] – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys – (DSproct)
DRV - [2006/08/17 15:43:52 | 000,007,424 | –S- | M] (Gteko Ltd.) [Kernel | Auto | Running] – C:\Program Files\DellSupport\Drivers\dsunidrv.sys – (dsunidrv)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {8A96AF9E-4074-43b7-BEA3-87217BDA7406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUK
IE - HKLM\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = http://www.searchqu.com/web?src=ieb&sy…q={searchTerms}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2769726

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss&am…0000019d14e0c56
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7E B1 56 ED 3C 0A CC 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms…0000019d14e0c56
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = http://www.searchqu.com/web?src=ieb&sy…q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\Virgin Media\Service Manager\nprpspa.dll (Virgin Media)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\`neale\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\`neale\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/04/29 11:30:02 | 000,000,000 | —D | M]

[2012/04/09 17:17:57 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Search (Enabled)
CHR - default_search_provider: search_url = http://start.funmoods.com/results.php?f=4&…q={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\gears.dll
CHR - plugin: Service Manager (Enabled) = C:\Program Files\Virgin Media\Service Manager\nprpspa.dll
CHR - plugin: Google Update (Enabled) = C:\Users\`neale\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2011/05/21 17:17:32 | 000,000,771 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Runtime\YontooIEClient.dll (Yontoo LLC)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarTlbr.dll (Babylon Ltd.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [atwtusb] C:\Windows\System32\ATWTUSB.EXE (WALTOP International Corp.)
O4 - HKLM..\Run: [basicsmssmenu] C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe (Maxtor Corporation)
O4 - HKLM..\Run: [ECenter] c:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [EEventManager] C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [ServiceManager.exe] C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe (Virgin Media)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Windows\sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [V Stuff Backup] C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe (Steek)
O4 - Startup: C:\Users\`neale\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0CD46C3-08EC-4676-B2D6-0382B1DA21DE}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

========== Files/Folders - Created Within 30 Days ==========

[2012/04/09 17:19:49 | 000,000,000 | —D | C] – C:\Program Files\7-Zip
[2012/04/09 17:19:43 | 000,000,000 | —D | C] – C:\Program Files\PriceGong
[2012/04/09 17:18:14 | 000,000,000 | —D | C] – C:\Users\`neale\AppData\Local\Wajam
[2012/04/09 17:18:13 | 000,000,000 | —D | C] – C:\Program Files\Wajam
[2012/04/09 17:17:58 | 000,000,000 | —D | C] – C:\Program Files\Funmoods
[2012/04/09 17:17:57 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2012/04/05 20:03:48 | 000,000,000 | —D | C] – C:\Users\`neale\Cars,Bikes,Planes\Honda CB350
[2012/03/21 18:45:54 | 001,172,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10warp.dll
[2012/03/21 18:45:54 | 001,068,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2012/03/21 18:45:54 | 000,219,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1core.dll
[2012/03/21 18:45:53 | 000,683,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d2d1.dll
[2012/03/21 18:45:53 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2012/03/21 18:45:51 | 002,044,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/03/21 18:45:35 | 000,613,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpencom.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/11 19:44:08 | 000,001,021 | —- | M] () – C:\Users\`neale\Desktop\OTL - Shortcut.lnk
[2012/04/11 19:42:45 | 000,610,860 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/04/11 19:42:45 | 000,109,268 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/04/11 19:39:45 | 000,054,156 | -H– | M] () – C:\Windows\QTFont.qfn
[2012/04/11 19:37:54 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/11 19:37:54 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/11 19:37:38 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/04/11 18:58:00 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000UA.job
[2012/04/11 18:58:00 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000Core.job
[2012/04/11 16:45:55 | 030,890,992 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\pspbrwse.jbf
[2012/04/11 16:36:03 | 000,002,635 | —- | M] () – C:\Users\`neale\Desktop\Jasc Paint Shop Pro 9.lnk
[2012/04/11 11:01:23 | 000,002,049 | —- | M] () – C:\Users\`neale\Desktop\Google Chrome.lnk
[2012/04/11 11:01:23 | 000,002,011 | —- | M] () – C:\Users\`neale\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/03/21 18:54:22 | 003,720,208 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/03/16 18:58:40 | 000,210,944 | —- | M] () – C:\Users\`neale\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/03/16 18:45:17 | 000,057,227 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\Rotax 250 stripdown web 09
[2012/03/16 18:00:24 | 002,901,282 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop.JPG
[2012/03/16 17:59:55 | 002,639,454 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop (2).JPG
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/11 19:44:08 | 000,001,021 | —- | C] () – C:\Users\`neale\Desktop\OTL - Shortcut.lnk
[2012/04/09 18:53:50 | 000,000,912 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000UA.job
[2012/04/09 18:53:48 | 000,000,860 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000Core.job
[2012/03/16 18:58:25 | 000,057,227 | —- | C] () – C:\Users\`neale\Cars,Bikes,Planes\Rotax 250 stripdown web 09
[2012/03/16 17:57:15 | 002,901,282 | —- | C] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop.JPG
[2012/03/16 17:57:15 | 002,639,454 | —- | C] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop (2).JPG
[2011/09/04 15:44:28 | 000,098,304 | —- | C] () – C:\Windows\System32\redmonnt.dll
[2011/09/02 20:23:31 | 000,000,132 | —- | C] () – C:\Users\`neale\AppData\Roaming\Adobe AIFF Format CS5 Prefs
[2011/06/18 12:30:02 | 000,000,132 | —- | C] () – C:\Users\`neale\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2011/04/16 11:17:49 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2011/03/17 18:07:56 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011/03/16 15:53:25 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2011/03/16 15:53:24 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2010/12/13 18:41:10 | 000,140,800 | —- | C] () – C:\Windows\serifun.exe
[2010/12/13 18:22:46 | 000,061,440 | —- | C] () – C:\Windows\System32\cdTextCtl.dll
[2010/11/17 18:21:50 | 000,000,008 | RHS- | C] () – C:\Windows\System32\B841734FE1.sys
[2010/07/27 20:35:49 | 000,006,224 | —- | C] () – C:\Users\`neale\AppData\Roaming\pspbrwse.jbf

========== LOP Check ==========

[2007/08/12 17:46:50 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Alien Skin
[2011/03/09 17:25:57 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\AVG10
[2011/09/04 15:43:56 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Babylon
[2010/12/10 15:46:46 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Blender Foundation
[2010/12/03 18:18:59 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Canneverbe Limited
[2011/09/05 13:39:46 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\CasaPortale.de
[2010/12/14 18:26:39 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\CD Label Designer
[2008/05/09 14:23:53 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\EPSON
[2007/07/02 19:59:47 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Hemera
[2010/09/01 19:39:48 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\InterTrust
[2007/08/27 16:34:22 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Opera
[2011/05/21 18:50:26 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011/07/11 17:10:16 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\SumatraPDF
[2007/04/25 20:03:28 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Template
[2011/05/11 13:44:47 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Virgin Media
[2012/04/11 19:29:52 | 000,032,620 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< Post #2 >

< >

< >

< SuperMember >

< >

< >

< Group: Classroom Teacher >

< Posts: 3,414 >

< Joined: 5-February 09 >

< From: UK >

< Member No.: 84,008 >

< Operating System: Vista Home Premium, 64-bit, SP2 >

< >

< >

< >

< Hello airbus99 and >

< >

< My name is JonTom >

< >

< Malware Logs can sometimes take a lot of time to research and interpret. >

< Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation. >

< Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean. >

< Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet. >

< PLEASE NOTE: If you do not reply after 3 days your thread will be closed. >

< >

< >

< >

< Lets take a closer look with the following scans: >

< >

< >

< Download and run OTL by Oldtimer >

< >

< >

< Please download OTL by Oldtimer by clicking here and save the file (called OTL.exe) to your desktop. >

< Close all open windows on your computer then Right click on the OTL.exe icon and select "Run as Administrator" to run the program. >

< Check the boxes beside "LOP Check" and "Purity Check". >

< Under Custom Scan paste this in: >

< >

< >

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2008/01/19 08:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008/01/19 08:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008/01/19 08:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008/01/19 08:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2007/04/22 01:41:42 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\ERDNT\cache\AGP440.sys
[2007/04/22 01:41:42 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\System32\drivers\AGP440.sys
[2007/04/22 01:41:42 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_8ed06b47\AGP440.sys
[2007/04/22 01:41:42 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.16400_none_b82caac9c18a4e3b\AGP440.sys
[2007/04/22 01:41:41 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=BF34B4A0E0B64440C5389AA6B902F4AD – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20496_none_b85af81edaeb8461\AGP440.sys
[2006/11/02 10:49:52 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/04/11 07:32:26 | 000,019,944 | —- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009/04/11 07:32:26 | 000,019,944 | —- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008/01/19 08:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/19 08:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 10:49:36 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2007/04/22 01:42:25 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=5653737BAD8C6C10136451C195C19881 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20485_none_db8a029f3dbd443b\atapi.sys
[2007/04/22 01:42:16 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\ERDNT\cache\atapi.sys
[2007/04/22 01:42:16 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\System32\drivers\atapi.sys
[2007/04/22 01:42:16 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_5a9555b4\atapi.sys
[2007/04/22 01:42:16 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20509_none_dbe4850d3d78c736\atapi.sys
[2007/04/22 01:42:25 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_82339ef2\atapi.sys
[2007/04/22 01:42:25 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16391_none_daf194c024ab5b06\atapi.sys
[2011/03/09 15:00:29 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2011/03/09 15:00:29 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2011/03/09 15:00:28 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys
[2011/03/09 15:00:28 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 10:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\ERDNT\cache\cngaudit.dll
[2006/11/02 10:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\System32\cngaudit.dll
[2006/11/02 10:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTOR.SYS >
[2006/09/29 13:16:20 | 000,495,896 | —- | M] (Intel Corporation) MD5=C212BE4F068A02E54EB0CF6F5B23569B – C:\Program Files\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys
[2006/09/29 20:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Drivers\storage\R139843\iaStor.sys
[2006/09/29 11:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Program Files\Intel\Intel Matrix Storage Manager\Driver\iaStor.sys
[2006/09/29 20:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Windows\System32\drivers\iaStor.sys
[2006/09/29 20:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_6a23f079\iaStor.sys
[2006/09/29 20:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Windows\System32\DriverStore\FileRepository\iastor.inf_0afadd92\iaStor.sys

< MD5 for: IASTORV.SYS >
[2008/01/19 08:42:51 | 000,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008/01/19 08:42:51 | 000,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 10:51:25 | 000,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 10:51:25 | 000,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 10:46:11 | 000,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009/04/11 07:28:23 | 000,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\ERDNT\cache\netlogon.dll
[2009/04/11 07:28:23 | 000,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\System32\netlogon.dll
[2009/04/11 07:28:23 | 000,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008/01/19 08:35:36 | 000,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2006/11/02 10:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 10:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/19 08:42:09 | 000,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008/01/19 08:42:09 | 000,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/19 08:36:19 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 10:46:12 | 000,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009/04/11 07:28:24 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\ERDNT\cache\scecli.dll
[2009/04/11 07:28:24 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\System32\scecli.dll
[2009/04/11 07:28:24 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2006/11/02 10:46:04 | 000,380,957 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\system32\expsrv.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2011/04/18 13:18:50 | 000,043,392 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\system32\drivers\MpNWMon.sys

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %systemroot%\system32\drivers\*.sys /90 >

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Wolseley Ten 1923 (2):Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\TWN:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Thundersprint web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Thundersprint 2010 (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Teifi Valley Railway.Wales (24) copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Teifi Valley Railway.Wales (13) copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Tatton Park July (27).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Steam car (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Sideways car.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Rotax (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC .JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC - Copy.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC - Copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Punto.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (89).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (88).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (87).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\llangollen feb 2007 002.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Jap Jag copy,Micra based web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\India Bombay03.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\IMG_0871.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Hurricane.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Honton 250 email (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Fruin.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Ferrari bike.02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\EMC V car.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\EMC V car mod2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Ducati 125 four073.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DOT (2):Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW068.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 05072.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 03070.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 02069.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DEC 2006 136.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Concorde.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Car.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Car jigsaw.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Boeing 777.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Birkenhead tram museum web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter03JPG.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter01.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga Straight from SD card 030.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga Straight from SD card 030 (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 08.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 07.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 06.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 05.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 04.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 01.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park modified 01.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (22).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (19).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle 2009 (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car.tif:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Amal carb067.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera (5).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera (3).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\AJS.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.09.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.08.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.06.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 13.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 12.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 11.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 03.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (9).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (7).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (6).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (5).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (40).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (14).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (13).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (11).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A350.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A350 02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A340.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A329.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus a321 at Hamburg.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320 04.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320 02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A319.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (8).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (7).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (6).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (5).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (4).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (28).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (27).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (26).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (25).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (15).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (14).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (13).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (12).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (11).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (10).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine modified copy (3).jpg:Roxio EMC Stream

< End of report >


OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\`neale\Cars,Bikes,Planes\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.99 Gb Total Physical Memory | 1.13 Gb Available Physical Memory | 57.05% Memory free
4.21 Gb Paging File | 3.20 Gb Available in Paging File | 76.02% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.79 Gb Total Space | 75.43 Gb Free Space | 33.86% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.38 Gb Free Space | 63.76% Space Free | Partition Type: NTFS

Computer Name: NEALEPC | User Name: `neale | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/11 19:41:53 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Users\`neale\Cars,Bikes,Planes\Downloads\OTL.exe
PRC - [2011/06/15 15:16:48 | 000,997,920 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/04/27 15:39:26 | 000,208,944 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
PRC - [2011/04/27 15:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2011/03/25 13:34:04 | 000,689,464 | —- | M] (Radialpoint Inc.) – C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe
PRC - [2011/03/25 13:34:00 | 004,371,768 | —- | M] (Virgin Media) – C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe
PRC - [2010/04/14 13:27:58 | 008,263,584 | —- | M] (Steek) – C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe
PRC - [2010/04/14 13:26:16 | 007,059,360 | —- | M] () – C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
PRC - [2009/04/11 07:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/09/06 11:38:59 | 000,068,608 | —- | M] () – C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
PRC - [2008/05/01 23:41:38 | 000,136,488 | —- | M] (Wacom Technology, Corp.) – C:\Windows\System32\WTablet\Pen_TabletUser.exe
PRC - [2008/05/01 23:40:44 | 003,032,360 | —- | M] (Wacom Technology, Corp.) – C:\Windows\System32\Pen_Tablet.exe
PRC - [2007/10/09 17:21:06 | 000,169,328 | —- | M] (Maxtor Corporation) – C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
PRC - [2007/10/09 17:21:02 | 000,124,280 | —- | M] (Seagate Technology LLC) – C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
PRC - [2007/02/08 06:16:24 | 000,303,104 | —- | M] (SigmaTel, Inc.) – C:\Windows\sttray.exe
PRC - [2006/11/12 02:19:46 | 000,446,976 | —- | M] (Gteko Ltd.) – C:\Program Files\DellSupport\DSAgnt.exe
PRC - [2006/11/05 11:22:16 | 000,221,184 | —- | M] (Sonic Solutions) – C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
PRC - [2006/11/05 10:55:48 | 000,010,752 | —- | M] (Sonic Solutions) – C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
PRC - [2006/11/02 20:40:12 | 000,174,656 | —- | M] () – C:\Windows\System32\PSIService.exe
PRC - [2006/10/12 15:57:08 | 000,102,400 | —- | M] (SEIKO EPSON CORPORATION) – C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe
PRC - [2006/09/29 12:39:20 | 000,151,552 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2006/09/29 12:38:50 | 000,081,920 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2005/09/21 19:08:48 | 000,290,816 | —- | M] (WALTOP International Corp.) – C:\Windows\System32\ATWTUSB.EXE


========== Modules (No Company Name) ==========

MOD - [2012/04/09 21:28:48 | 000,444,400 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\ppGoogleNaClPluginChrome.dll
MOD - [2012/04/09 21:28:46 | 003,915,248 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\pdf.dll
MOD - [2012/04/09 21:27:21 | 000,122,880 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\avutil-51.dll
MOD - [2012/04/09 21:27:20 | 000,220,672 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\avformat-53.dll
MOD - [2012/04/09 21:27:19 | 001,747,456 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\avcodec-53.dll
MOD - [2012/04/09 20:42:11 | 008,743,584 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\gcswf32.dll
MOD - [2012/04/09 20:42:11 | 008,743,584 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\APPLIC~1\180102~1.152\gcswf32.dll
MOD - [2011/03/25 13:25:14 | 000,158,208 | —- | M] () – C:\Program Files\Virgin Media\Service Manager\Windows7Features.dll
MOD - [2010/04/14 13:26:16 | 007,059,360 | —- | M] () – C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
MOD - [2007/02/09 19:32:36 | 000,061,440 | —- | M] () – C:\Windows\System32\igfxTMM.dll
MOD - [2007/02/09 19:32:28 | 000,077,824 | —- | M] () – C:\Windows\System32\hccutils.dll
MOD - [2006/11/05 10:58:44 | 000,516,096 | —- | M] () – C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\LayoutDll9.dll
MOD - [2006/11/05 10:28:18 | 004,587,520 | R— | M] () – C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\ROXIPP41.dll
MOD - [2002/04/28 17:12:04 | 000,122,880 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/04/27 15:39:26 | 000,208,944 | —- | M] (Microsoft Corporation) [On_Demand | Running] – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe – (NisSrv)
SRV - [2011/04/27 15:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe – (MsMpSvc)
SRV - [2011/03/25 13:34:04 | 000,689,464 | —- | M] (Radialpoint Inc.) [Auto | Running] – C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe – (ServicepointService)
SRV - [2010/02/19 13:37:14 | 000,517,096 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe – (SwitchBoard)
SRV - [2008/09/06 11:38:59 | 000,068,608 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe – (Autodata Limited License Service)
SRV - [2008/05/01 23:40:44 | 003,032,360 | —- | M] (Wacom Technology, Corp.) [Auto | Running] – C:\Windows\System32\Pen_Tablet.exe – (TabletServicePen)
SRV - [2008/01/19 08:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/10/09 17:21:02 | 000,124,280 | —- | M] (Seagate Technology LLC) [Auto | Running] – C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe – (Basics Service)
SRV - [2006/11/07 13:27:02 | 000,070,656 | —- | M] () [On_Demand | Stopped] – C:\Program Files\DellSupport\brkrsvc.exe – (DSBrokerService)
SRV - [2006/11/02 20:40:12 | 000,174,656 | —- | M] () [Auto | Running] – C:\Windows\System32\PSIService.exe – (ProtexisLicensing)
SRV - [2006/09/29 12:38:50 | 000,081,920 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe – (IAANTMON) Intel®


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\`neale\AppData\Local\Temp\catchme.sys – (catchme)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive)
DRV - File not found [Kernel | Disabled | Stopped] – system32\DRIVERS\AVGIDSShim.Sys – (AVGIDSShim)
DRV - [2012/04/11 19:38:06 | 000,029,904 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7910363C-FE80-4912-B76A-4E9EA72454F6}\MpKsl67a56c7f.sys – (MpKsl67a56c7f)
DRV - [2011/04/27 15:25:24 | 000,065,024 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NisDrvWFP.sys – (NisDrv)
DRV - [2011/04/18 13:18:50 | 000,043,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\MpNWMon.sys – (MpNWMon)
DRV - [2009/12/30 11:21:18 | 000,027,192 | —- | M] (VS Revo Group) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\revoflt.sys – (Revoflt)
DRV - [2008/03/17 21:14:52 | 000,015,144 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacmoumonitor.sys – (wacmoumonitor)
DRV - [2008/01/19 05:25:05 | 000,220,672 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2008/01/15 21:11:46 | 000,013,480 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacomvhid.sys – (wacomvhid)
DRV - [2007/02/16 20:12:36 | 000,011,312 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacommousefilter.sys – (wacommousefilter)
DRV - [2007/02/16 01:11:28 | 000,011,440 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\WacomVKHid.sys – (WacomVKHid)
DRV - [2007/02/08 06:16:26 | 000,647,680 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2006/11/10 15:05:00 | 000,018,688 | —- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\afc.sys – (Afc)
DRV - [2006/11/02 08:36:43 | 002,028,032 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2006/10/05 16:07:28 | 000,004,736 | —- | M] (Gteko Ltd.) [Kernel | On_Demand | Running] – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys – (DSproct)
DRV - [2006/08/17 15:43:52 | 000,007,424 | –S- | M] (Gteko Ltd.) [Kernel | Auto | Running] – C:\Program Files\DellSupport\Drivers\dsunidrv.sys – (dsunidrv)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {8A96AF9E-4074-43b7-BEA3-87217BDA7406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUK
IE - HKLM\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = http://www.searchqu.com/web?src=ieb&sy…q={searchTerms}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2769726

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss&am…0000019d14e0c56
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7E B1 56 ED 3C 0A CC 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms…0000019d14e0c56
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = http://www.searchqu.com/web?src=ieb&sy…q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\Virgin Media\Service Manager\nprpspa.dll (Virgin Media)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\`neale\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\`neale\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/04/29 11:30:02 | 000,000,000 | —D | M]

[2012/04/09 17:17:57 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Search (Enabled)
CHR - default_search_provider: search_url = http://start.funmoods.com/results.php?f=4&…q={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\gears.dll
CHR - plugin: Service Manager (Enabled) = C:\Program Files\Virgin Media\Service Manager\nprpspa.dll
CHR - plugin: Google Update (Enabled) = C:\Users\`neale\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2011/05/21 17:17:32 | 000,000,771 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Runtime\YontooIEClient.dll (Yontoo LLC)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarTlbr.dll (Babylon Ltd.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [atwtusb] C:\Windows\System32\ATWTUSB.EXE (WALTOP International Corp.)
O4 - HKLM..\Run: [basicsmssmenu] C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe (Maxtor Corporation)
O4 - HKLM..\Run: [ECenter] c:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [EEventManager] C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [ServiceManager.exe] C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe (Virgin Media)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Windows\sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [V Stuff Backup] C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe (Steek)
O4 - Startup: C:\Users\`neale\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0CD46C3-08EC-4676-B2D6-0382B1DA21DE}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

========== Files/Folders - Created Within 30 Days ==========

[2012/04/09 17:19:49 | 000,000,000 | —D | C] – C:\Program Files\7-Zip
[2012/04/09 17:19:43 | 000,000,000 | —D | C] – C:\Program Files\PriceGong
[2012/04/09 17:18:14 | 000,000,000 | —D | C] – C:\Users\`neale\AppData\Local\Wajam
[2012/04/09 17:18:13 | 000,000,000 | —D | C] – C:\Program Files\Wajam
[2012/04/09 17:17:58 | 000,000,000 | —D | C] – C:\Program Files\Funmoods
[2012/04/09 17:17:57 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2012/04/05 20:03:48 | 000,000,000 | —D | C] – C:\Users\`neale\Cars,Bikes,Planes\Honda CB350
[2012/03/21 18:45:54 | 001,172,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10warp.dll
[2012/03/21 18:45:54 | 001,068,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2012/03/21 18:45:54 | 000,219,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1core.dll
[2012/03/21 18:45:53 | 000,683,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d2d1.dll
[2012/03/21 18:45:53 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2012/03/21 18:45:51 | 002,044,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/03/21 18:45:35 | 000,613,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpencom.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/11 19:44:08 | 000,001,021 | —- | M] () – C:\Users\`neale\Desktop\OTL - Shortcut.lnk
[2012/04/11 19:42:45 | 000,610,860 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/04/11 19:42:45 | 000,109,268 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/04/11 19:39:45 | 000,054,156 | -H– | M] () – C:\Windows\QTFont.qfn
[2012/04/11 19:37:54 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/11 19:37:54 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/11 19:37:38 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/04/11 18:58:00 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000UA.job
[2012/04/11 18:58:00 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000Core.job
[2012/04/11 16:45:55 | 030,890,992 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\pspbrwse.jbf
[2012/04/11 16:36:03 | 000,002,635 | —- | M] () – C:\Users\`neale\Desktop\Jasc Paint Shop Pro 9.lnk
[2012/04/11 11:01:23 | 000,002,049 | —- | M] () – C:\Users\`neale\Desktop\Google Chrome.lnk
[2012/04/11 11:01:23 | 000,002,011 | —- | M] () – C:\Users\`neale\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/03/21 18:54:22 | 003,720,208 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/03/16 18:58:40 | 000,210,944 | —- | M] () – C:\Users\`neale\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/03/16 18:45:17 | 000,057,227 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\Rotax 250 stripdown web 09
[2012/03/16 18:00:24 | 002,901,282 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop.JPG
[2012/03/16 17:59:55 | 002,639,454 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop (2).JPG
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/11 19:44:08 | 000,001,021 | —- | C] () – C:\Users\`neale\Desktop\OTL - Shortcut.lnk
[2012/04/09 18:53:50 | 000,000,912 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000UA.job
[2012/04/09 18:53:48 | 000,000,860 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000Core.job
[2012/03/16 18:58:25 | 000,057,227 | —- | C] () – C:\Users\`neale\Cars,Bikes,Planes\Rotax 250 stripdown web 09
[2012/03/16 17:57:15 | 002,901,282 | —- | C] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop.JPG
[2012/03/16 17:57:15 | 002,639,454 | —- | C] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop (2).JPG
[2011/09/04 15:44:28 | 000,098,304 | —- | C] () – C:\Windows\System32\redmonnt.dll
[2011/09/02 20:23:31 | 000,000,132 | —- | C] () – C:\Users\`neale\AppData\Roaming\Adobe AIFF Format CS5 Prefs
[2011/06/18 12:30:02 | 000,000,132 | —- | C] () – C:\Users\`neale\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2011/04/16 11:17:49 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2011/03/17 18:07:56 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011/03/16 15:53:25 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2011/03/16 15:53:24 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2010/12/13 18:41:10 | 000,140,800 | —- | C] () – C:\Windows\serifun.exe
[2010/12/13 18:22:46 | 000,061,440 | —- | C] () – C:\Windows\System32\cdTextCtl.dll
[2010/11/17 18:21:50 | 000,000,008 | RHS- | C] () – C:\Windows\System32\B841734FE1.sys
[2010/07/27 20:35:49 | 000,006,224 | —- | C] () – C:\Users\`neale\AppData\Roaming\pspbrwse.jbf

========== LOP Check ==========

[2007/08/12 17:46:50 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Alien Skin
[2011/03/09 17:25:57 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\AVG10
[2011/09/04 15:43:56 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Babylon
[2010/12/10 15:46:46 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Blender Foundation
[2010/12/03 18:18:59 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Canneverbe Limited
[2011/09/05 13:39:46 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\CasaPortale.de
[2010/12/14 18:26:39 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\CD Label Designer
[2008/05/09 14:23:53 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\EPSON
[2007/07/02 19:59:47 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Hemera
[2010/09/01 19:39:48 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\InterTrust
[2007/08/27 16:34:22 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Opera
[2011/05/21 18:50:26 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011/07/11 17:10:16 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\SumatraPDF
[2007/04/25 20:03:28 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Template
[2011/05/11 13:44:47 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Virgin Media
[2012/04/11 19:29:52 | 000,032,620 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< Post #2 >

< >

< >

< SuperMember >

< >

< >

< Group: Classroom Teacher >

< Posts: 3,414 >

< Joined: 5-February 09 >

< From: UK >

< Member No.: 84,008 >

< Operating System: Vista Home Premium, 64-bit, SP2 >

< >

< >

< >

< Hello airbus99 and >

< >

< My name is JonTom >

< >

< Malware Logs can sometimes take a lot of time to research and interpret. >

< Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation. >

< Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean. >

< Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet. >

< PLEASE NOTE: If you do not reply after 3 days your thread will be closed. >

< >

< >

< >

< Lets take a closer look with the following scans: >

< >

< >

< Download and run OTL by Oldtimer >

< >

< >

< Please download OTL by Oldtimer by clicking here and save the file (called OTL.exe) to your desktop. >

< Close all open windows on your computer then Right click on the OTL.exe icon and select "Run as Administrator" to run the program. >

< Check the boxes beside "LOP Check" and "Purity Check". >

< Under Custom Scan paste this in: >

< >

< >

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2008/01/19 08:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008/01/19 08:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008/01/19 08:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008/01/19 08:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2007/04/22 01:41:42 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\ERDNT\cache\AGP440.sys
[2007/04/22 01:41:42 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\System32\drivers\AGP440.sys
[2007/04/22 01:41:42 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_8ed06b47\AGP440.sys
[2007/04/22 01:41:42 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.16400_none_b82caac9c18a4e3b\AGP440.sys
[2007/04/22 01:41:41 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=BF34B4A0E0B64440C5389AA6B902F4AD – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20496_none_b85af81edaeb8461\AGP440.sys
[2006/11/02 10:49:52 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/04/11 07:32:26 | 000,019,944 | —- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009/04/11 07:32:26 | 000,019,944 | —- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008/01/19 08:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/19 08:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 10:49:36 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2007/04/22 01:42:25 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=5653737BAD8C6C10136451C195C19881 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20485_none_db8a029f3dbd443b\atapi.sys
[2007/04/22 01:42:16 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\ERDNT\cache\atapi.sys
[2007/04/22 01:42:16 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\System32\drivers\atapi.sys
[2007/04/22 01:42:16 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_5a9555b4\atapi.sys
[2007/04/22 01:42:16 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20509_none_dbe4850d3d78c736\atapi.sys
[2007/04/22 01:42:25 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_82339ef2\atapi.sys
[2007/04/22 01:42:25 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16391_none_daf194c024ab5b06\atapi.sys
[2011/03/09 15:00:29 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2011/03/09 15:00:29 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2011/03/09 15:00:28 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys
[2011/03/09 15:00:28 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 10:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\ERDNT\cache\cngaudit.dll
[2006/11/02 10:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\System32\cngaudit.dll
[2006/11/02 10:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTOR.SYS >
[2006/09/29 13:16:20 | 000,495,896 | —- | M] (Intel Corporation) MD5=C212BE4F068A02E54EB0CF6F5B23569B – C:\Program Files\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys
[2006/09/29 20:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Drivers\storage\R139843\iaStor.sys
[2006/09/29 11:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Program Files\Intel\Intel Matrix Storage Manager\Driver\iaStor.sys
[2006/09/29 20:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Windows\System32\drivers\iaStor.sys
[2006/09/29 20:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_6a23f079\iaStor.sys
[2006/09/29 20:59:58 | 000,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Windows\System32\DriverStore\FileRepository\iastor.inf_0afadd92\iaStor.sys

< MD5 for: IASTORV.SYS >
[2008/01/19 08:42:51 | 000,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008/01/19 08:42:51 | 000,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 10:51:25 | 000,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 10:51:25 | 000,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 10:46:11 | 000,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009/04/11 07:28:23 | 000,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\ERDNT\cache\netlogon.dll
[2009/04/11 07:28:23 | 000,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\System32\netlogon.dll
[2009/04/11 07:28:23 | 000,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008/01/19 08:35:36 | 000,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2006/11/02 10:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 10:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/19 08:42:09 | 000,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008/01/19 08:42:09 | 000,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/19 08:36:19 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 10:46:12 | 000,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009/04/11 07:28:24 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\ERDNT\cache\scecli.dll
[2009/04/11 07:28:24 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\System32\scecli.dll
[2009/04/11 07:28:24 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2006/11/02 10:46:04 | 000,380,957 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\system32\expsrv.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2011/04/18 13:18:50 | 000,043,392 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\system32\drivers\MpNWMon.sys

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %systemroot%\system32\drivers\*.sys /90 >

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Wolseley Ten 1923 (2):Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\TWN:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Thundersprint web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Thundersprint 2010 (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Teifi Valley Railway.Wales (24) copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Teifi Valley Railway.Wales (13) copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Tatton Park July (27).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Steam car (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Sideways car.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Rotax (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC .JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC - Copy.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC - Copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Punto.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (89).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (88).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (87).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\llangollen feb 2007 002.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Jap Jag copy,Micra based web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\India Bombay03.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\IMG_0871.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Hurricane.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Honton 250 email (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Fruin.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Ferrari bike.02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\EMC V car.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\EMC V car mod2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Ducati 125 four073.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DOT (2):Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW068.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 05072.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 03070.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 02069.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DEC 2006 136.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Concorde.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Car.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Car jigsaw.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Boeing 777.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Birkenhead tram museum web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter03JPG.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter01.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga Straight from SD card 030.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga Straight from SD card 030 (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 08.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 07.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 06.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 05.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 04.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 01.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park modified 01.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (22).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (19).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle 2009 (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car.tif:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Amal carb067.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera (5).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera (3).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\AJS.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.09.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.08.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.06.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 13.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 12.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 11.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 03.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (9).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (7).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (6).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (5).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (40).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (14).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (13).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (11).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A350.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A350 02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A340.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A329.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus a321 at Hamburg.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320 04.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320 02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A319.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (8).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (7).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (6).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (5).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (4).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (28).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (27).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (26).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (25).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (15).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (14).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (13).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (12).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (11).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (10).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine modified copy (3).jpg:Roxio EMC Stream

< End of report >
I'll send the rest on another post as suggested, Neale
Post #4
Hello Jontom, Here is the aswMBR.exe result for your examination; aswMBR version 0.9.4 Copyright© 2011 AVAST Software Run date: 2012-04-11 20:27:04 —————————– 20:27:04.297 OS Version: Windows 6.0.6002 Service Pack 2 20:27:04.297 Number of processors: 1 586 0x605 20:27:04.298 ComputerName: NEALEPC UserName: `neale 20:27:06.029 Initialize success 20:27:21.959 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 20:27:21.963 Disk 0 Vendor: ST325082 3.AD Size: 238418MB BusType: 3 20:27:21.993 Disk 0 MBR read successfully 20:27:21.997 Disk 0 MBR scan 20:27:22.005 Disk 0 scanning sectors +488278016 20:27:22.034 Disk 0 scanning C:\Windows\system32\drivers 20:27:28.813 Service scanning 20:27:30.029 Disk 0 trace - called modules: 20:27:30.046 ntkrnlpa.exe CLASSPNP.SYS disk.sys iastor.sys hal.dll 20:27:30.053 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85c166d0] 20:27:30.059 3 CLASSPNP.SYS[883a08b3] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x84860030] 20:27:30.067 Scan finished successfully I hope that makes sense to you !! Thanks , Neale
Post #5
Hello JonTom,
Ooops ! I think I should have added this report as well;
OTL Extras logfile created on: 11/04/2012 19:46:44 - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\`neale\Cars,Bikes,Planes\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.99 Gb Total Physical Memory | 1.13 Gb Available Physical Memory | 57.05% Memory free
4.21 Gb Paging File | 3.20 Gb Available in Paging File | 76.02% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.79 Gb Total Space | 75.43 Gb Free Space | 33.86% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.38 Gb Free Space | 63.76% Space Free | Partition Type: NTFS

Computer Name: NEALEPC | User Name: `neale | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] – C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02E0644F-32F0-4EEC-8493-F15D28665E42}" = lport=445 | protocol=6 | dir=in | app=system |
"{4E67B049-E370-46CD-9A55-F6391AD6BE4A}" = lport=138 | protocol=17 | dir=in | app=system |
"{564A22A4-7729-42A5-8019-CEA5AD2B82AE}" = rport=137 | protocol=17 | dir=out | app=system |
"{61AB20FC-2CAE-4368-AE03-9E3CC0B3F21F}" = lport=139 | protocol=6 | dir=in | app=system |
"{81F5A2A9-53F1-4EB4-AF50-E9189887B3FD}" = rport=445 | protocol=6 | dir=out | app=system |
"{B1E4D1AD-E9E8-488B-9364-D8D0C526CCD9}" = rport=139 | protocol=6 | dir=out | app=system |
"{BEE8E44A-58B4-40DF-BAD1-C12C306DDD4B}" = rport=138 | protocol=17 | dir=out | app=system |
"{C1A9F22F-FE5C-48AB-93F4-4F11CBAC2D4B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{CED533A9-BF16-4BD1-862D-91520F560870}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{EA9073FC-D869-4CD6-A599-460C55554CBA}" = lport=137 | protocol=17 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04FA8F2A-D382-46C3-B094-C7B808AA63FC}" = protocol=6 | dir=in | app=c:\program files\virgin media\service manager\servicepointservice.exe |
"{0BE2E2F3-128D-4CC4-B31B-056C898184B4}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
"{134C21B8-C904-48E4-BD30-E7A6FD48E585}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
"{176229E5-7299-4B5F-8169-F9070D98F0C5}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
"{1EB7BD76-C23F-4237-8C0F-EEFE1426121D}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe |
"{2F7F541F-EEA9-4A7E-AD69-34A4C79A1548}" = protocol=17 | dir=in | app=c:\program files\windows ilivid toolbar\toolbar\dtuser.exe |
"{49A9DA69-8B24-4E0A-B1C7-48A5D61F9FD7}" = protocol=17 | dir=in | app=c:\program files\virgin media\service manager\servicepointservice.exe |
"{56C7053B-42A9-46B3-92F2-A41A4D5F853A}" = protocol=6 | dir=in | app=c:\program files\virgin media\hub\servicepointservice.exe |
"{574F458E-1102-4507-97F7-D684FBFE343D}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
"{5B7B2C27-740F-4794-BDEB-5949370AA3F8}" = protocol=17 | dir=in | app=c:\program files\virgin media\hub\servicepointservice.exe |
"{5B86EB6E-8752-417E-A112-D90B61A0F0F8}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
"{6962256F-88D2-485C-AC81-B7D4212BAD5E}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
"{858752F5-DC4F-4A47-AAA6-F15373533790}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
"{8EDF80B9-D8EE-4378-963B-04169C7481A2}" = protocol=6 | dir=in | app=c:\program files\windows ilivid toolbar\toolbar\dtuser.exe |
"{8FBE75AD-4074-4B9B-B15E-179558788D52}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{96EDBA9A-A9B8-49E1-ACAE-D53C9EFAEB49}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{9C733537-C43E-45E6-BD75-834E96847E74}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{B2BB86E4-34D3-4907-987D-8C03D7146EB4}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
"{C69F1422-6A06-4BB6-90BE-3C13DD6FE714}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe |
"{E12B2B3A-E1F2-4ED7-A0BA-EE65143F1C1D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E522E7DB-3E7C-46A4-99A2-AB6E1A5079B2}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
"{E7E2A9CE-86A1-4ACA-86F6-FE74F2522762}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}" = Dell System Customization Wizard
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{1A3E23D7-7A1E-43EC-B35D-EB8A31BED943}" = FinalBurner Free v2.24.0.195
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{203E9709-186B-46FE-A995-FE51210E7F25}" = Wireless Tablet Series
"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"{24960CD0-661D-4957-9D5F-D2905A30EDB1}" = Jasc Paint Shop Photo Album 5
"{254BEB3E-1085-4D66-9CDC-0152C0DC2E93}" = EPSON TWAIN 5
"{285614E0-7C82-4219-AB0F-999DEFE70EAC}" = Simple Cover Printer
"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant
"{2C70DBA0-6150-487B-A358-CF08A682743B}" = Focus 10,000 Photos
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{48B0F38D-1913-44F3-99AA-D4C55A2B038E}" = Drive Manager
"{48F22622-1CC2-4A83-9C1E-644DD96F832D}" = EPSON Event Manager
"{4C2E5A82-DA8B-4c72-91A6-EBB4E0463537}_is1" = V Stuff Backup v1.6.2.18253
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{64E72FB1-2343-4977-B4A8-262CD53D0BD3}" = Corel Paint Shop Pro Photo X2
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.3
"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{72ABF89E-E41F-40EF-9F86-AB739893171A}" = Focus 30,000 Photos
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo Layers Runtime 1.10.01
"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B74D4E10-1033-0000-0000-000000000001}" = Adobe Bridge 1.0
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0
"{F843C6A3-224D-4615-94F8-3C461BD9AEA0}" = Jasc Paint Shop Pro 9
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player Plugin
"Audacity_is1" = Audacity 1.2.6
"BabylonToolbar" = Babylon toolbar on IE
"CdCoverCreator" = CdCoverCreator 2.5.3
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"Disketch" = Disketch CD Label Software
"EPSON PERFECTION V200 PHOTO User’s Guide" = EPSON PERFECTION V200 PHOTO Manual
"EPSON Scanner" = EPSON Scan
"exPressit S.E. 3.0" = exPressit S.E. 3.0
"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"InstallShield_{2C70DBA0-6150-487B-A358-CF08A682743B}" = Focus 10,000 Photos
"InstallShield_{48B0F38D-1913-44F3-99AA-D4C55A2B038E}" = Drive Manager
"InstallShield_{72ABF89E-E41F-40EF-9F86-AB739893171A}" = Focus 30,000 Photos
"InterCover_1.20" = InterCover 1.24
"LAME for Audacity_is1" = LAME v3.98.3 for Audacity
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"Pen Tablet Driver" = Pen Tablet
"QuickTime" = QuickTime
"RadialpointClientGateway_is1" = Virgin Media Service Manager 3.7.47
"RmTablet" = Wireless Tablet Series
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"SSC Service Utility_is1" = SSC Service Utility v4.30
"SumatraPDF" = SumatraPDF
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 06/02/2012 13:26:28 | Computer Name = nealepc | Source = TabletServicePen | ID = 0
Description =

Error - 12/02/2012 13:25:35 | Computer Name = nealepc | Source = Application Hang | ID = 1002
Description = The program rundll32.exe version 6.0.6000.16386 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: ac Start Time: 01cce99edd8a0983 Termination Time: 45

Error - 12/02/2012 13:25:49 | Computer Name = nealepc | Source = Application Hang | ID = 1002
Description = The program chrome.exe version 0.0.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Problem Reports and Solutions control panel. Process
ID: e8 Start Time: 01cce99ec9b1d643 Termination Time: 57

Error - 13/02/2012 09:28:27 | Computer Name = nealepc | Source = Windows Search Service | ID = 3013
Description =

Error - 13/02/2012 09:28:27 | Computer Name = nealepc | Source = Windows Search Service | ID = 3013
Description =

Error - 19/02/2012 13:19:19 | Computer Name = nealepc | Source = Application Hang | ID = 1002
Description = The program Paint Shop Pro 9.exe version 9.0.0.0 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 1444 Start Time: 01ccef29490a8ea0 Termination Time: 201

Error - 20/02/2012 09:01:53 | Computer Name = nealepc | Source = TabletServicePen | ID = 0
Description =

Error - 20/02/2012 15:33:39 | Computer Name = nealepc | Source = Application Hang | ID = 1002
Description = The program Paint Shop Pro 9.exe version 9.0.0.0 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 81c Start Time: 01cceff3ca14bba8 Termination Time: 296

Error - 26/02/2012 13:42:18 | Computer Name = nealepc | Source = TabletServicePen | ID = 0
Description =

Error - 26/02/2012 13:42:31 | Computer Name = nealepc | Source = TabletServicePen | ID = 0
Description =

[ System Events ]
Error - 21/03/2012 13:47:25 | Computer Name = nealepc | Source = Microsoft Antimalware | ID = 2001
Description = %%860 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.121.1898.0 Update Source: %%859 Update Stage:
%%853 Source Path: http://www.microsoft.com Signature Type: %%800 Update Type: %%803

User:
NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8101.0 Error
code: 0x80240016 Error description: An unexpected problem occurred while checking
for updates. For information on installing or troubleshooting updates, see Help
and Support.

Error - 02/04/2012 11:30:32 | Computer Name = nealepc | Source = Service Control Manager | ID = 7009
Description =

Error - 02/04/2012 11:30:32 | Computer Name = nealepc | Source = Service Control Manager | ID = 7000
Description =

Error - 04/04/2012 08:25:31 | Computer Name = nealepc | Source = Service Control Manager | ID = 7009
Description =

Error - 04/04/2012 08:25:31 | Computer Name = nealepc | Source = Service Control Manager | ID = 7000
Description =

Error - 05/04/2012 12:27:14 | Computer Name = nealepc | Source = Print | ID = 6161
Description = The document Facilities at Fairfield Nursing Home - Wirral, owned
by `neale, failed to print on printer Epson Stylus Photo R300 (M). Try to print
the document again, or restart the print spooler. Data type: NT EMF 1.008. Size
of the spool file in bytes: 1508628. Number of bytes printed: 1508456. Total number
of pages in the document: 2. Number of pages printed: 1. Client computer: \\NEALEPC.
Win32 error code returned by the print processor: 0. The operation completed successfully.


Error - 09/04/2012 14:17:24 | Computer Name = nealepc | Source = Print | ID = 6161
Description = The document Print - A Brief History of Britain, owned by `neale,
failed to print on printer Epson Stylus Photo R300 (M). Try to print the document
again, or restart the print spooler. Data type: NT EMF 1.008. Size of the spool
file in bytes: 5636096. Number of bytes printed: 1989136. Total number of pages
in the document: 2. Number of pages printed: 1. Client computer: \\NEALEPC. Win32
error code returned by the print processor: 0. The operation completed successfully.


Error - 09/04/2012 14:19:59 | Computer Name = nealepc | Source = Print | ID = 6161
Description = The document Arrowe, owned by `neale, failed to print on printer Epson
Stylus Photo R300 (M). Try to print the document again, or restart the print spooler.
Data type: NT EMF 1.008. Size of the spool file in bytes: 15296316. Number of bytes
printed: 15296224. Total number of pages in the document: 2. Number of pages printed:
1. Client computer: \\NEALEPC. Win32 error code returned by the print processor:
0. The operation completed successfully.

Error - 11/04/2012 05:43:00 | Computer Name = nealepc | Source = Service Control Manager | ID = 7009
Description =

Error - 11/04/2012 05:43:00 | Computer Name = nealepc | Source = Service Control Manager | ID = 7000
Description =


< End of report >

Thanks again, Neale
Post #6
Hello airbus99

Thank you for the logs.

I'm going to need a little more information before we continue:

  • CKScanner


  • Download CKScanner by askey127 from here and save it to your Desktop.
  • Right click CKScanner.exe and select "Run as Administrator", then click on Search For Files.
  • When the cursor hourglass disappears, click Save List To File.
  • A message box will verify the file saved.
  • Double click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply.
Post #8
Hello airbus99

You appear to have a cracked copy of Adobe Photoshop on your machine. Cracked and keygened files are illegal. This forum does not support or condone the use of cracked or keygened software of any kind.

If you wish to receive assistance at this forum your must remove this material immediately:


  • Please open OTL


  • Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.

    :OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

:Files
c:\users\`neale\documents\photoshop cs5 extended. crack.pspimage

:Commands
[resethosts]
[purity]
[emptytemp]
[emptyflash]
[start explorer]
[Reboot]

  • Once you have pasted the information into the Custom Scans/Fixes box, click the "Run Fix" button at the top.
  • Allow the program to run unhindered.
  • Your machine will re-start itself. This is normal.
  • A log will be created after your machine reboots. Please post the contents of the log in your next reply.
Post #9
Hello JonTom, Thanks for your quick reply , I have run the OTL scan and have posted the contents of the log for your examination. I am slightly surprised that the Photoshop copy was illegal as it seems to be working correctly, my good friend loaded it on my computer for me ! I shall remove it. Thanks in advance for your kind help, Neale All processes killed Error: Unable to interpret in the current context! ========== OTL ========== No active process named explorer.exe was found! ========== FILES ========== c:\users\`neale\documents\Photoshop CS5 extended. crack.pspimage moved successfully. ========== COMMANDS ========== C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 41627 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: `neale ->Temp folder emptied: 315078013 bytes ->Temporary Internet Files folder emptied: 1078661939 bytes ->Java cache emptied: 0 bytes ->Google Chrome cache emptied: 418788703 bytes ->Flash cache emptied: 120010 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 61856790 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 1,788.00 mb [EMPTYFLASH] User: All Users User: Default ->Flash cache emptied: 0 bytes User: Default User ->Flash cache emptied: 0 bytes User: Public User: `neale ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.39.2 log created on 04132012_192728 Files\Folders moved on Reboot… C:\Windows\temp\JETEF7C.tmp moved successfully. Registry entries deleted on Reboot…
Post #10
Hello airbus99

Thank you for the log.

Lets continue:

You appear to have had McAfee and AVG installed on this machine at some point. If you no longer use these products let me know and I will provide some removal tools to take care of the leftovers.


  • Please un-install the following


    • Click on "Windows Orb" then on "Computer" and then on the "Uninstall or change a program" tab.
    • A list of currently installed programs will be displayed.
    • Find the "Yontoo Layers Runtime 1.10.01" program, click on it once and then click on the "uninstall" button.
    • If you are prompted to re-boot your computer to complete the uninstall please do so.
    • Repeat for "Babylon toolbar on IE"

  • Please open OTL


    • Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.
    • DO NOT copy the word "CODE".

      :OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
IE - HKLM\..\SearchScopes,DefaultScope = {8A96AF9E-4074-43b7-BEA3-87217BDA7406}
IE - HKLM\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = http://www.searchqu.com/web?src=ieb&sy…q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss&am…0000019d14e0c56
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms…0000019d14e0c56
IE - HKCU\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = http://www.searchqu.com/web?src=ieb&sy…q={searchTerms}
CHR - default_search_provider: search_url = http://start.funmoods.com/results.php?f=4&…q={searchTerms}
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Runtime\YontooIEClient.dll (Yontoo LLC)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarTlbr.dll (Babylon Ltd.)
O4 - HKCU..\Run: [AdobeBridge] File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
[2010/11/17 18:21:50 | 000,000,008 | RHS- | C] () – C:\Windows\System32\B841734FE1.sys
[2011/09/04 15:43:56 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Babylon
[2012/04/09 17:19:43 | 000,000,000 | —D | C] – C:\Program Files\PriceGong
[2012/04/09 17:17:58 | 000,000,000 | —D | C] – C:\Program Files\Funmoods
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

:Files
ipconfig /flushdns /c
C:\Program Files\BabylonToolbar
C:\Program Files\Yontoo Layers Runtime
c:\program files\windows ilivid toolbar

:Commands
[resethosts]
[purity]
[emptytemp]
[emptyflash]
[start explorer]
[Reboot]
    • Once you have pasted the information into the Custom Scans/Fixes box, click the "Run Fix" button at the top.
    • Allow the program to run unhindered.
    • Your machine will re-start itself. This is normal.
    • A log will be created after your machine reboots. Please post the contents of the log in your next reply.

    Please post the OTL fix log in your next reply, then re-scan with OTL and post the new scan log for me to review.
Post #11
Hello JonTom,
I have run the programs as you have instructed also I've pasted the results as requested.
I hope all is well with the scans,thanks again for your very quick help, Neale

OTL logfile created on: 14/04/2012 17:44:35 - Run 2
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\`neale\Cars,Bikes,Planes\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.99 Gb Total Physical Memory | 0.97 Gb Available Physical Memory | 48.77% Memory free
4.21 Gb Paging File | 3.14 Gb Available in Paging File | 74.48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.79 Gb Total Space | 78.50 Gb Free Space | 35.24% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.38 Gb Free Space | 63.76% Space Free | Partition Type: NTFS

Computer Name: NEALEPC | User Name: `neale | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/11 19:41:53 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Users\`neale\Cars,Bikes,Planes\Downloads\OTL.exe
PRC - [2011/06/15 15:16:48 | 000,997,920 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/04/27 15:39:26 | 000,208,944 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
PRC - [2011/04/27 15:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2011/03/25 13:34:04 | 000,689,464 | —- | M] (Radialpoint Inc.) – C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe
PRC - [2011/03/25 13:34:00 | 004,371,768 | —- | M] (Virgin Media) – C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe
PRC - [2010/04/14 13:27:58 | 008,263,584 | —- | M] (Steek) – C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe
PRC - [2010/04/14 13:26:16 | 007,059,360 | —- | M] () – C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
PRC - [2009/04/11 07:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/09/06 11:38:59 | 000,068,608 | —- | M] () – C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
PRC - [2008/05/01 23:41:38 | 000,136,488 | —- | M] (Wacom Technology, Corp.) – C:\Windows\System32\WTablet\Pen_TabletUser.exe
PRC - [2008/05/01 23:40:44 | 003,032,360 | —- | M] (Wacom Technology, Corp.) – C:\Windows\System32\Pen_Tablet.exe
PRC - [2007/10/09 17:21:06 | 000,169,328 | —- | M] (Maxtor Corporation) – C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
PRC - [2007/10/09 17:21:02 | 000,124,280 | —- | M] (Seagate Technology LLC) – C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
PRC - [2007/02/08 06:16:24 | 000,303,104 | —- | M] (SigmaTel, Inc.) – C:\Windows\sttray.exe
PRC - [2006/11/12 02:19:46 | 000,446,976 | —- | M] (Gteko Ltd.) – C:\Program Files\DellSupport\DSAgnt.exe
PRC - [2006/11/05 11:22:16 | 000,221,184 | —- | M] (Sonic Solutions) – C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
PRC - [2006/11/05 10:55:48 | 000,010,752 | —- | M] (Sonic Solutions) – C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
PRC - [2006/11/02 20:40:12 | 000,174,656 | —- | M] () – C:\Windows\System32\PSIService.exe
PRC - [2006/10/12 15:57:08 | 000,102,400 | —- | M] (SEIKO EPSON CORPORATION) – C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe
PRC - [2006/09/29 12:39:20 | 000,151,552 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2006/09/29 12:38:50 | 000,081,920 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2005/09/21 19:08:48 | 000,290,816 | —- | M] (WALTOP International Corp.) – C:\Windows\System32\ATWTUSB.EXE


========== Modules (No Company Name) ==========

MOD - [2012/04/09 21:28:48 | 000,444,400 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\ppGoogleNaClPluginChrome.dll
MOD - [2012/04/09 21:28:46 | 003,915,248 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\pdf.dll
MOD - [2012/04/09 21:27:21 | 000,122,880 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\avutil-51.dll
MOD - [2012/04/09 21:27:20 | 000,220,672 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\avformat-53.dll
MOD - [2012/04/09 21:27:19 | 001,747,456 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\avcodec-53.dll
MOD - [2012/04/09 20:42:11 | 008,743,584 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\gcswf32.dll
MOD - [2012/04/09 20:42:11 | 008,743,584 | —- | M] () – C:\Users\`neale\AppData\Local\Google\Chrome\APPLIC~1\180102~1.152\gcswf32.dll
MOD - [2011/03/25 13:25:14 | 000,158,208 | —- | M] () – C:\Program Files\Virgin Media\Service Manager\Windows7Features.dll
MOD - [2010/04/14 13:26:16 | 007,059,360 | —- | M] () – C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
MOD - [2007/02/09 19:32:36 | 000,061,440 | —- | M] () – C:\Windows\System32\igfxTMM.dll
MOD - [2007/02/09 19:32:28 | 000,077,824 | —- | M] () – C:\Windows\System32\hccutils.dll
MOD - [2006/11/05 10:58:44 | 000,516,096 | —- | M] () – C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\LayoutDll9.dll
MOD - [2006/11/05 10:28:18 | 004,587,520 | R— | M] () – C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\ROXIPP41.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/04/27 15:39:26 | 000,208,944 | —- | M] (Microsoft Corporation) [On_Demand | Running] – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe – (NisSrv)
SRV - [2011/04/27 15:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe – (MsMpSvc)
SRV - [2011/03/25 13:34:04 | 000,689,464 | —- | M] (Radialpoint Inc.) [Auto | Running] – C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe – (ServicepointService)
SRV - [2010/02/19 13:37:14 | 000,517,096 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe – (SwitchBoard)
SRV - [2008/09/06 11:38:59 | 000,068,608 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe – (Autodata Limited License Service)
SRV - [2008/05/01 23:40:44 | 003,032,360 | —- | M] (Wacom Technology, Corp.) [Auto | Running] – C:\Windows\System32\Pen_Tablet.exe – (TabletServicePen)
SRV - [2008/01/19 08:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/10/09 17:21:02 | 000,124,280 | —- | M] (Seagate Technology LLC) [Auto | Running] – C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe – (Basics Service)
SRV - [2006/11/07 13:27:02 | 000,070,656 | —- | M] () [On_Demand | Stopped] – C:\Program Files\DellSupport\brkrsvc.exe – (DSBrokerService)
SRV - [2006/11/02 20:40:12 | 000,174,656 | —- | M] () [Auto | Running] – C:\Windows\System32\PSIService.exe – (ProtexisLicensing)
SRV - [2006/09/29 12:38:50 | 000,081,920 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe – (IAANTMON) Intel®


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\`neale\AppData\Local\Temp\catchme.sys – (catchme)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive)
DRV - File not found [Kernel | Disabled | Stopped] – system32\DRIVERS\AVGIDSShim.Sys – (AVGIDSShim)
DRV - [2011/04/27 15:25:24 | 000,065,024 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NisDrvWFP.sys – (NisDrv)
DRV - [2011/04/18 13:18:50 | 000,043,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\MpNWMon.sys – (MpNWMon)
DRV - [2009/12/30 11:21:18 | 000,027,192 | —- | M] (VS Revo Group) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\revoflt.sys – (Revoflt)
DRV - [2008/03/17 21:14:52 | 000,015,144 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacmoumonitor.sys – (wacmoumonitor)
DRV - [2008/01/19 05:25:05 | 000,220,672 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2008/01/15 21:11:46 | 000,013,480 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacomvhid.sys – (wacomvhid)
DRV - [2007/02/16 20:12:36 | 000,011,312 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacommousefilter.sys – (wacommousefilter)
DRV - [2007/02/16 01:11:28 | 000,011,440 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\WacomVKHid.sys – (WacomVKHid)
DRV - [2007/02/08 06:16:26 | 000,647,680 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2006/11/10 15:05:00 | 000,018,688 | —- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\afc.sys – (Afc)
DRV - [2006/11/02 08:36:43 | 002,028,032 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2006/10/05 16:07:28 | 000,004,736 | —- | M] (Gteko Ltd.) [Kernel | On_Demand | Running] – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys – (DSproct)
DRV - [2006/08/17 15:43:52 | 000,007,424 | –S- | M] (Gteko Ltd.) [Kernel | Auto | Running] – C:\Program Files\DellSupport\Drivers\dsunidrv.sys – (dsunidrv)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUK
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2769726

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7E B1 56 ED 3C 0A CC 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\Virgin Media\Service Manager\nprpspa.dll (Virgin Media)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\`neale\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\`neale\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/04/29 11:30:02 | 000,000,000 | —D | M]

[2012/04/09 17:17:57 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Search (Enabled)
CHR - default_search_provider: search_url = http://start.funmoods.com/results.php?f=4&…q={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\gears.dll
CHR - plugin: Service Manager (Enabled) = C:\Program Files\Virgin Media\Service Manager\nprpspa.dll
CHR - plugin: Google Update (Enabled) = C:\Users\`neale\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2012/04/14 17:33:44 | 000,000,098 | —- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [atwtusb] C:\Windows\System32\ATWTUSB.EXE (WALTOP International Corp.)
O4 - HKLM..\Run: [basicsmssmenu] C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe (Maxtor Corporation)
O4 - HKLM..\Run: [ECenter] c:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [EEventManager] C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [ServiceManager.exe] C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe (Virgin Media)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Windows\sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [V Stuff Backup] C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe (Steek)
O4 - Startup: C:\Users\`neale\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0CD46C3-08EC-4676-B2D6-0382B1DA21DE}: DhcpNameServer = [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/04/13 20:29:51 | 000,000,000 | —D | C] – C:\Users\`neale\Cars,Bikes,Planes\Triumph 500 racer
[2012/04/13 19:27:28 | 000,000,000 | —D | C] – C:\_OTL
[2012/04/09 17:19:49 | 000,000,000 | —D | C] – C:\Program Files\7-Zip
[2012/04/09 17:18:14 | 000,000,000 | —D | C] – C:\Users\`neale\AppData\Local\Wajam
[2012/04/09 17:18:13 | 000,000,000 | —D | C] – C:\Program Files\Wajam
[2012/04/09 17:17:58 | 000,000,000 | —D | C] – C:\Program Files\Funmoods
[2012/04/09 17:17:57 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2012/04/05 20:03:48 | 000,000,000 | —D | C] – C:\Users\`neale\Cars,Bikes,Planes\Honda CB350
[2012/03/21 18:45:54 | 001,172,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10warp.dll
[2012/03/21 18:45:54 | 001,068,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2012/03/21 18:45:54 | 000,219,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1core.dll
[2012/03/21 18:45:53 | 000,683,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d2d1.dll
[2012/03/21 18:45:53 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2012/03/21 18:45:51 | 002,044,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/03/21 18:45:35 | 000,613,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpencom.dll

========== Files - Modified Within 30 Days ==========

[2012/04/14 17:43:57 | 000,610,860 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/04/14 17:43:57 | 000,109,268 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/04/14 17:40:42 | 000,054,156 | -H– | M] () – C:\Windows\QTFont.qfn
[2012/04/14 17:37:35 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/14 17:37:35 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/14 17:37:12 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/04/14 17:33:44 | 000,000,098 | —- | M] () – C:\Windows\System32\drivers\etc\Hosts
[2012/04/14 17:13:45 | 000,002,635 | —- | M] () – C:\Users\`neale\Desktop\Jasc Paint Shop Pro 9.lnk
[2012/04/13 19:58:04 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000UA.job
[2012/04/11 20:28:16 | 000,000,512 | —- | M] () – C:\Users\`neale\Desktop\MBR.dat
[2012/04/11 19:44:08 | 000,001,021 | —- | M] () – C:\Users\`neale\Desktop\OTL - Shortcut.lnk
[2012/04/11 18:58:00 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000Core.job
[2012/04/11 16:45:55 | 030,890,992 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\pspbrwse.jbf
[2012/04/11 11:01:23 | 000,002,049 | —- | M] () – C:\Users\`neale\Desktop\Google Chrome.lnk
[2012/04/11 11:01:23 | 000,002,011 | —- | M] () – C:\Users\`neale\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/03/21 18:54:22 | 003,720,208 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/03/16 18:58:40 | 000,210,944 | —- | M] () – C:\Users\`neale\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/03/16 18:45:17 | 000,057,227 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\Rotax 250 stripdown web 09
[2012/03/16 18:00:24 | 002,901,282 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop.JPG
[2012/03/16 17:59:55 | 002,639,454 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop (2).JPG

========== Files Created - No Company Name ==========

[2012/04/11 20:28:16 | 000,000,512 | —- | C] () – C:\Users\`neale\Desktop\MBR.dat
[2012/04/11 19:44:08 | 000,001,021 | —- | C] () – C:\Users\`neale\Desktop\OTL - Shortcut.lnk
[2012/04/09 18:53:50 | 000,000,912 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000UA.job
[2012/04/09 18:53:48 | 000,000,860 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000Core.job
[2012/03/16 18:58:25 | 000,057,227 | —- | C] () – C:\Users\`neale\Cars,Bikes,Planes\Rotax 250 stripdown web 09
[2012/03/16 17:57:15 | 002,901,282 | —- | C] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop.JPG
[2012/03/16 17:57:15 | 002,639,454 | —- | C] () – C:\Users\`neale\Cars,Bikes,Planes\Honda Reg shop (2).JPG
[2011/09/04 15:44:28 | 000,098,304 | —- | C] () – C:\Windows\System32\redmonnt.dll
[2011/09/02 20:23:31 | 000,000,132 | —- | C] () – C:\Users\`neale\AppData\Roaming\Adobe AIFF Format CS5 Prefs
[2011/06/18 12:30:02 | 000,000,132 | —- | C] () – C:\Users\`neale\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2011/04/16 11:17:49 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2011/03/17 18:07:56 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011/03/16 15:53:25 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2011/03/16 15:53:24 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2010/12/13 18:41:10 | 000,140,800 | —- | C] () – C:\Windows\serifun.exe
[2010/12/13 18:22:46 | 000,061,440 | —- | C] () – C:\Windows\System32\cdTextCtl.dll
[2010/07/27 20:35:49 | 000,006,224 | —- | C] () – C:\Users\`neale\AppData\Roaming\pspbrwse.jbf

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Wolseley Ten 1923 (2):Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\TWN:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Thundersprint web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Thundersprint 2010 (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Teifi Valley Railway.Wales (24) copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Teifi Valley Railway.Wales (13) copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Tatton Park July (27).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Steam car (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Sideways car.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Rotax (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC .JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC - Copy.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC - Copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Punto.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (89).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (88).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (87).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\llangollen feb 2007 002.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Jap Jag copy,Micra based web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\India Bombay03.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\IMG_0871.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Hurricane.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Honton 250 email (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Fruin.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Ferrari bike.02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\EMC V car.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\EMC V car mod2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Ducati 125 four073.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DOT (2):Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW068.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 05072.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 03070.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 02069.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DEC 2006 136.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Concorde.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Car.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Car jigsaw.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Boeing 777.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Birkenhead tram museum web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter03JPG.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter01.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga Straight from SD card 030.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga Straight from SD card 030 (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 08.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 07.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 06.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 05.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 04.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 01.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park modified 01.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (22).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (19).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle 2009 (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car.tif:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Amal carb067.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera (5).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera (3).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\AJS.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.09.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.08.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.06.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 13.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 12.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 11.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 03.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (9).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (7).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (6).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (5).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (40).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (14).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (13).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (11).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A350.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A350 02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A340.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A329.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus a321 at Hamburg.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320 04.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320 02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A319.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (8).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (7).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (6).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (5).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (4).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (28).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (27).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (26).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (25).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (15).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (14).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (13).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (12).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (11).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (10).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine modified copy (3).jpg:Roxio EMC Stream

< End of report >

All processes killed
========== OTL ==========
No active process named explorer.exe was found!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found.
Unable to fix default_search_provider items.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
File C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\bh\BabylonToolbar.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\ deleted successfully.
File C:\Program Files\Yontoo Layers Runtime\YontooIEClient.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ not found.
File C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarTlbr.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\avgsecuritytoolbar\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2DDE6B2-9684-4A55-86D4-E255E237B77C}\ deleted successfully.
File {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll File not found not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
C:\Windows\System32\B841734FE1.sys moved successfully.
C:\Users\`neale\AppData\Roaming\Babylon folder moved successfully.
C:\Program Files\PriceGong\2.6.4\FF\components folder moved successfully.
C:\Program Files\PriceGong\2.6.4\FF\chrome\skin folder moved successfully.
C:\Program Files\PriceGong\2.6.4\FF\chrome\locale\en-US folder moved successfully.
C:\Program Files\PriceGong\2.6.4\FF\chrome\locale folder moved successfully.
C:\Program Files\PriceGong\2.6.4\FF\chrome\content folder moved successfully.
C:\Program Files\PriceGong\2.6.4\FF\chrome folder moved successfully.
C:\Program Files\PriceGong\2.6.4\FF folder moved successfully.
C:\Program Files\PriceGong\2.6.4 folder moved successfully.
C:\Program Files\PriceGong folder moved successfully.
C:\Program Files\Funmoods\Funmoods\1.5.11.16 folder moved successfully.
C:\Program Files\Funmoods\Funmoods folder moved successfully.
File/Folder C:\Windows\*.tmp not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\`neale\Cars,Bikes,Planes\Downloads\cmd.bat deleted successfully.
C:\Users\`neale\Cars,Bikes,Planes\Downloads\cmd.txt deleted successfully.
File\Folder C:\Program Files\BabylonToolbar not found.
File\Folder C:\Program Files\Yontoo Layers Runtime not found.
File\Folder c:\program files\windows ilivid toolbar not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: `neale
->Temp folder emptied: 1711830 bytes
->Temporary Internet Files folder emptied: 105809 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 10492764 bytes
->Flash cache emptied: 343 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 13166 bytes
RecycleBin emptied: 2624741 bytes

Total Files Cleaned = 14.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: `neale
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.39.2 log created on 04142012_173320

Files\Folders moved on Reboot…
C:\Windows\temp\JETBA59.tmp moved successfully.

Registry entries deleted on Reboot…
Post #12
Hello airbus99

Please let me know if you require removal tools for AVG and McAfee.

I hope all is well with the scans

It looks as though the removal of funmoods from your Chrome browser will require manual intervention.

Lets try the following:

  • Open Chrome.
  • Click the wrench icon on the browser toolbar.
  • Select Settings.
  • Click the Basics tab.
  • Click Manage search engines in the "Search" section.
  • To Remove a search engine: Select the search engine from the list (all instances of funmoods) and click the "x" that ought to appear at the end of the row.
  • If there is no "X" available, you may have to select another default browser as default before the replacement is permitted to occur.

  • To do this, click the wrench icon on the browser toolbar.
  • Select Settings.
  • Click the Basics tab and find the "Search" section.
  • Select the search engine you want to use from the menu. If the search engine you want to use doesn't appear in the menu, click Manage search engines.
  • In the Search Engines dialog that appears, select the search engine that you'd like to use from the list.
  • Click the Make Default button that appears in the row.
  • Once completed, go back and delete all instances of funmoods.


  • Please delete the following folder


    • Right-click your "Start" button and select "Explore".
    • Navigate to and delete the following files/folders in bold.

    C:\Program Files\Funmoods <==== Delete this folder.

    • Once deleted, empty your Recycle Bin.

  • MalwareBytes AntiMalware:


    • I can see that you have MBAM installed.
    • Double click on your MalwareBytes AntiMalware icon to launch the program.
    • Click on the "Update" tab and then on "Check for Updates".
    • The program will now install the latest Malware definition files.
    • Once complete, click on the "Scanner" tab, select "Perform Quick Scan"and then click on "Scan".
    • Once the program has scanned your computer, a log file will be created in Notepad.
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.


    • If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
    • The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
    • Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
    • Come back here to this thread and Paste the log in your next reply.

  • Please run the following scan


    • Note: You will need to use Internet Explorer for this scan.
    • Note for Vista/Windows 7 Users: ESET is compatible but Internet Explorer must be run as Administrator. To do this, right-click on your Internet Explorer icon and select "Run as Administrator".
    • Please disable your real time security programs before performing the scan.


    • Scan your system with Eset Online Scanner
    • Place a check mark in the box YES, I accept the Terms Of Use.
    • Click the [external image: Posted Image] button.
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps).
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.


    • Check [external image: Posted Image]
    • Click the [external image: Posted Image] button.
    • Accept any security warnings from your browser.
    • Check [external image: Posted Image]
    • Make sure that the option to "Remove Found Threats" is UN checked.
    • Push the "Start" button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push [external image: Posted Image]
    • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • Push the [external image: Posted Image] button.
    • Push [external image: Posted Image]

    Please post the MBAM and ESET logs in your next reply and let me know how the machine is running now.
Post #13
Hello JonTom, I've included the results of the ESET scan and the Malware Bytes scan, the computer is working much better and the cursed Funmoods has not re-appeared ,finger crossed !! I hope these scans are pasted correctly, thanks again for your kind help , Cheers Neale Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.04.15.04 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 `neale :: NEALEPC [administrator] 15/04/2012 16:20:13 mbam-log-2012-04-15 (16-20-13).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 185919 Time elapsed: 6 minute(s), 42 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 3 C:\Users\`neale\Cars,Bikes,Planes\Downloads\SoftonicDownloader_for_posterazor (1).exe (PUP.OfferBundler.ST) -> Quarantined and deleted successfully. C:\Users\`neale\Cars,Bikes,Planes\Downloads\SoftonicDownloader_for_posterazor.exe (PUP.OfferBundler.ST) -> Quarantined and deleted successfully. C:\Users\`neale\Cars,Bikes,Planes\Downloads\PDFConverterSetup.exe (Adware.InstallCore) -> Quarantined and deleted successfully. (end) Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.04.15.04 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 `neale :: NEALEPC [administrator] 15/04/2012 16:20:13 mbam-log-2012-04-15 (16-20-13).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 185919 Time elapsed: 6 minute(s), 42 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 3 C:\Users\`neale\Cars,Bikes,Planes\Downloads\SoftonicDownloader_for_posterazor (1).exe (PUP.OfferBundler.ST) -> Quarantined and deleted successfully. C:\Users\`neale\Cars,Bikes,Planes\Downloads\SoftonicDownloader_for_posterazor.exe (PUP.OfferBundler.ST) -> Quarantined and deleted successfully. C:\Users\`neale\Cars,Bikes,Planes\Downloads\PDFConverterSetup.exe (Adware.InstallCore) -> Quarantined and deleted successfully. (end) Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.04.15.04 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 `neale :: NEALEPC [administrator] 15/04/2012 16:20:13 mbam-log-2012-04-15 (16-20-13).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 185919 Time elapsed: 6 minute(s), 42 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 3 C:\Users\`neale\Cars,Bikes,Planes\Downloads\SoftonicDownloader_for_posterazor (1).exe (PUP.OfferBundler.ST) -> Quarantined and deleted successfully. C:\Users\`neale\Cars,Bikes,Planes\Downloads\SoftonicDownloader_for_posterazor.exe (PUP.OfferBundler.ST) -> Quarantined and deleted successfully. C:\Users\`neale\Cars,Bikes,Planes\Downloads\PDFConverterSetup.exe (Adware.InstallCore) -> Quarantined and deleted successfully. (end)
Post #14
Hello JonTom, Ooops , I have pasted the files that should have been with my last post. C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe a variant of Win32/InstallCore.D application C:\Users\`neale\AppData\Local\Babylon\Setup\Setup.exe Win32/Toolbar.Babylon application C:\Users\`neale\Cars,Bikes,Planes\Downloads\registrybooster.exe Win32/RegistryBooster application C:\Users\`neale\Desktop\PageRage-SilentInstaller.exe probably a variant of Win32/Adware.NDUTHJB application All the best, Neale
Post #15
Hello airbus99

Thank you for the logs.

ESET has detected a number items that need our attention.

We do not recommend the use of Registry Cleaners, as in some cases they can cause more harm than good.

Please work your way through the following steps:


  • Please open OTL


  • Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.
  • Do Not copy the word "Code".

    :OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

:Files
C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe
C:\Users\`neale\Cars,Bikes,Planes\Downloads\registrybooster.exe
C:\Users\`neale\AppData\Local\Babylon
C:\Users\`neale\Desktop\PageRage-SilentInstaller.exe

:Commands
[purity]
[emptytemp]
[emptyflash]
[start explorer]
[Reboot]

  • Once you have pasted the information into the Custom Scans/Fixes box, click the "Run Fix" button at the top.
  • Allow the program to run unhindered.
  • Your machine will re-start itself. This is normal.
  • A log will be created after your machine reboots. Please post the contents of the log in your next reply.

Please post the OTL fix log along with a new OTL scan log in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI