Slow PC; Browser leaves stubs; CD drive not seen [Solved]

I just wonder if there are multiple problems with my PC.

1. I have my Task Manager running all the time, so as to be able to remove processes which become bogged down
2. Frequently, the Google Chrome Browser becomes bogged down. When I close it & view the task manager, there are many stubs which remain for about one minute (+/-), thus preventing me from reopening the browser till the all go away. I usually allow them to diminish on their own & sometimes I kill them all via the task manager
3. When I run Firefox, it will behave the same way, leaving up "Firefox" and "Plugin Container" [viewed on my Task Manager] till I end them both via the Task manager. If I try to restart Firefox with Firefox still showing on my Task manager process list, it will tell me that Firefox is already running. However, I cannot see it or use it till I remove it from my Task manager process list.
4. When attempting to burn an audio CD, my software [Burn 4 Free] does not "see" the Drive I wish to use. The software tells me it is ready to burn, but only can "see" the drive which is a Read Only. However, I am able to use the drive which burns to read CDs.
===============================================================================

Here is my "Hijacjackthis"


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:57:43 PM, on 9/5/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\MSTMON_S.EXE
C:\Program Files\Ask.com\Updater\Updater.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Washer\washer.exe
C:\Program Files\WordWeb\wweb32.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\SNDVOL32.EXE
C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/def…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/?.intl=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
R3 - URLSearchHook: YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: BHO_PROJECT - {BA0454C5-FD30-428E-8DB9-3FF87A612F64} - C:\Program Files\OpenApp\bho_project.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: FVD Suite Toolbar - {2B171655-A69C-5c18-B693-6CB5DC269D41} - C:\Program Files\FVD Suite\addons\IE\FVDToolbar.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KONICA MINOLTA magicolor 2400W STD] C:\WINDOWS\system32\MSTMON_S.EXE STARTUP
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ApnUpdater] "C:\Program Files\Ask.com\Updater\Updater.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netwaiting.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_3_300_271_Plugin.exe -update plugin
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.0.207\SSScheduler.exe
O8 - Extra context menu item: &WordWeb… - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Open FVD Suite Toolbar - {2B171655-A69C-5c18-B693-6CB5DC269D43} - C:\Program Files\FVD Suite\addons\IE\FVDToolbar.dll (HKCU)
O9 - Extra 'Tools' menuitem: Open FVD Suite Toolbar - {2B171655-A69C-5c18-B693-6CB5DC269D43} - C:\Program Files\FVD Suite\addons\IE\FVDToolbar.dll (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c15.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.0.207\McCHSvc.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 9773 bytes

Thank you JonTom

During the C/P motion, the PC hung, necessitating to press the main button to turn off & reboot.


Here, find all of DDS.txt and Attach.txt & aswMBR log files. Please advise next.
################################################################################
################################################


.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.7.2
Run by [removed] at 8:45:58 on 2012-09-08
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.201 [GMT -4:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\MSTMON_S.EXE
C:\Program Files\Ask.com\Updater\Updater.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WordWeb\wweb32.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\SNDVOL32.EXE
C:\Program Files\DVDVideoSoft\Free Video to MP3 Converter\FreeVideoToMP3Converter.exe
C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://mail.yahoo.com/?.intl=us
uSearch Page = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
uDefault_Page_URL =
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Settings,ProxyOverride = *.local
uCustomizeSearch =
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
uURLSearchHooks: YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre7\bin\ssv.dll
BHO: VideoFileDownload: {ba0454c5-fd30-428e-8db9-3ff87a612f64} - c:\program files\openapp\bho_project.dll
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: FVD Suite Toolbar: {2b171655-a69c-5c18-b693-6cb5dc269d41} - c:\program files\fvd suite\addons\ie\FVDToolbar.dll
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
TB: {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [ModemOnHold] c:\program files\netwaiting\netwaiting.exe
uRun: [Google Update] "c:\documents and settings\peter\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YahooMessenger.exe" -quiet
uRun: [Washer] c:\program files\washer\washer.exe /0
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [KONICA MINOLTA magicolor 2400W STD] c:\windows\system32\MSTMON_S.EXE STARTUP
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: []
mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\docume~1\peter\startm~1\programs\startup\wordweb.lnk - c:\program files\wordweb\wweb32.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodaks~1.lnk - c:\program files\kodak\kodak software updater\7288971\program\Kodak Software Updater.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.207\SSScheduler.exe
IE: &WordWeb… - c:\windows\wweb32.dll/lookup.html
IE: &Yahoo! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\yahoo!\Common/ycdict.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - {4C171D40-8277-11D5-AD55-00010333D0AD}
IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\program files\bonjour\ExplorerPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: aol.com\free
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - hxxp://static.windupdates.com/cab/CDT/ie/bridge-c15.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} - hxxp://support.f-secure.com/ols/fscax.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} - hxxp://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab
TCP: DhcpNameServer = 192.168.1.1 [removed] [removed]
TCP: Interfaces\{A67D86CB-7EF9-414A-BC85-AC3EEF166B61} : DhcpNameServer = 192.168.1.1 [removed] [removed]
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\peter\application data\mozilla\firefox\profiles\default.43v\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3106518&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/|https://login.yahoo.com/config/login_verify2?.intl=us&.src=ym|http://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z206&form=ZGAADF&install_date=20111115&q=
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\peter\local settings\application data\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_271.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
FF - plugin: c:\windows\system32\npwmsdrm.dll
.
—- FIREFOX POLICIES —-
user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0);
============= SERVICES / DRIVERS ===============
.
R0 xmasbus;xmasbus;c:\windows\system32\drivers\xmasbus.sys [2004-9-29 140800]
R0 xmasscsi;xmasscsi;c:\windows\system32\drivers\xmasscsi.sys [2004-9-29 5248]
R2 MLPTDR_Q;MLPTDR_Q;c:\windows\system32\MLPTDR_Q.SYS [2003-7-22 18848]
S2 GoldrushUSB;GoldrushUSB;c:\windows\system32\drivers\goldrush.sys [2004-7-6 11387]
S2 SVKP;SVKP;\??\c:\windows\system32\svkp.sys –> c:\windows\system32\SVKP.sys [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-7 250056]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.207\McCHSvc.exe [2011-6-17 237008]
S4 MsaSvc;Microsoft authenticate service;c:\windows\system32\msasvc.exe –> c:\windows\system32\msasvc.exe [?]
.
=============== Created Last 30 ================
.
2012-09-05 21:56:49 388096 —-a-r- c:\documents and settings\peter\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2012-09-05 21:56:48 ——– d—–w- c:\program files\Trend Micro
2012-09-05 18:29:06 5600 —-a-w- c:\windows\system\WINASPI.DLL
2012-09-05 18:29:06 4672 —-a-w- c:\windows\system\WOWPOST.EXE
2012-09-05 18:29:06 45056 —-a-w- c:\windows\system32\WNASPI32.DLL
2012-09-05 18:29:06 25244 —-a-w- c:\windows\system32\drivers\ASPI32.SYS
2012-09-05 18:24:19 ——– d—–w- c:\program files\OpenApp
2012-09-05 18:22:38 ——– d—–w- c:\program files\TSearch
2012-09-05 18:22:16 ——– d—–w- c:\program files\smartdl
2012-09-02 20:55:15 93672 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-08-29 16:04:49 ——– d—–w- c:\windows\system32\wbem\repository\FS
2012-08-29 16:04:49 ——– d—–w- c:\windows\system32\wbem\Repository
2012-08-22 20:22:00 209269 —-a-w- C:\torrent.exe
.
==================== Find3M ====================
.
2012-09-02 20:53:32 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-09-02 20:53:29 821736 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-09-02 20:53:29 746984 —-a-w- c:\windows\system32\deployJava1.dll
2012-08-15 10:18:02 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-15 10:18:01 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-11 15:51:02 3993600 —-a-w- c:\program files\GUT73.tmp
2012-07-11 15:50:38 0 —-a-w- c:\program files\GUM6F.tmp
2012-07-06 13:58:51 78336 —-a-w- c:\windows\system32\browser.dll
2012-07-04 14:05:18 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40:15 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49:33 916992 —-a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49:32 43520 ——w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49:32 1469440 ——w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05:43 385024 ——w- c:\windows\system32\html.iec
.
============= FINISH: 8:48:39.42 ===============



################################################################################
################################################




.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 4/12/2004 5:09:02 PM
System Uptime: 9/8/2012 6:37:00 AM (2 hours ago)
.
Motherboard: | | nVidia-nForce
Processor: AMD Athlon™ XP 2000+ | Socket A | 1664/133mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 57 GiB total, 10.002 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is FIXED (NTFS) - 298 GiB total, 76.884 GiB free.
G: is CDROM ()
H: is Removable
I: is Removable
J: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP339: 6/9/2012 10:25:01 AM - System Checkpoint
RP340: 6/10/2012 11:46:07 AM - System Checkpoint
RP341: 6/11/2012 2:34:59 PM - System Checkpoint
RP342: 6/12/2012 3:57:50 PM - System Checkpoint
RP343: 6/13/2012 12:18:14 PM - Printer Driver doPDF 7 Printer Driver Installed
RP344: 6/14/2012 5:15:54 PM - System Checkpoint
RP345: 6/14/2012 6:00:29 PM - Software Distribution Service 3.0
RP346: 6/16/2012 8:00:43 AM - System Checkpoint
RP347: 6/17/2012 11:22:35 AM - System Checkpoint
RP348: 6/18/2012 12:09:37 PM - System Checkpoint
RP349: 6/19/2012 3:50:23 PM - System Checkpoint
RP350: 6/21/2012 6:03:58 AM - System Checkpoint
RP351: 6/20/2012 7:53:18 PM - System Checkpoint
RP352: 6/22/2012 6:04:34 AM - System Checkpoint
RP353: 6/23/2012 8:02:56 AM - System Checkpoint
RP354: 6/23/2012 7:02:17 PM - Restore Operation
RP355: 6/24/2012 9:53:06 AM - Installed Java™ 7 Update 5
RP356: 6/24/2012 9:57:09 AM - Installed JavaFX 2.1.1
RP357: 6/28/2012 9:45:49 AM - System Checkpoint
RP358: 6/29/2012 11:37:22 AM - System Checkpoint
RP359: 7/2/2012 12:54:44 PM - System Checkpoint
RP360: 7/5/2012 12:33:11 PM - System Checkpoint
RP361: 7/7/2012 1:52:50 PM - System Checkpoint
RP362: 7/7/2012 10:24:40 PM - Installed DirectX
RP363: 7/7/2012 10:57:31 PM - Installed DirectX
RP364: 7/8/2012 7:54:25 AM - Removed OpenOffice.org Installer 1.0
RP365: 7/9/2012 9:44:55 AM - System Checkpoint
RP366: 7/11/2012 8:06:26 PM - Software Distribution Service 3.0
RP367: 7/12/2012 8:14:21 PM - Installed DirectX
RP368: 7/15/2012 7:29:10 PM - System Checkpoint
RP369: 7/17/2012 10:27:48 AM - System Checkpoint
RP370: 7/18/2012 8:57:39 PM - System Checkpoint
RP371: 7/20/2012 10:40:08 AM - System Checkpoint
RP372: 7/28/2012 7:01:59 AM - System Checkpoint
RP373: 7/29/2012 10:37:23 AM - System Checkpoint
RP374: 7/30/2012 4:41:10 PM - System Checkpoint
RP375: 8/5/2012 9:30:01 PM - System Checkpoint
RP376: 8/8/2012 12:20:16 PM - System Checkpoint
RP377: 8/9/2012 4:31:28 PM - System Checkpoint
RP378: 8/11/2012 6:13:55 PM - System Checkpoint
RP379: 8/15/2012 6:00:44 AM - System Checkpoint
RP380: 8/15/2012 6:00:47 PM - Software Distribution Service 3.0
RP381: 8/16/2012 10:34:19 PM - Software Distribution Service 3.0
RP382: 8/18/2012 12:40:49 PM - System Checkpoint
RP383: 8/19/2012 1:55:09 PM - System Checkpoint
RP384: 8/21/2012 8:14:52 PM - System Checkpoint
RP385: 8/23/2012 6:02:05 AM - System Checkpoint
RP386: 8/24/2012 4:06:51 PM - System Checkpoint
RP387: 8/26/2012 10:25:34 AM - System Checkpoint
RP388: 8/27/2012 2:14:06 PM - System Checkpoint
RP389: 8/29/2012 10:01:58 AM - System Checkpoint
RP390: 8/29/2012 12:03:36 PM - Restore Operation
RP391: 8/31/2012 10:34:02 AM - System Checkpoint
RP392: 9/1/2012 5:11:25 PM - System Checkpoint
RP393: 9/2/2012 4:49:49 PM - Removed Java™ 7 Update 5
RP394: 9/2/2012 4:51:59 PM - Installed Java 7 Update 7
RP395: 9/5/2012 5:56:46 PM - Installed HiJackThis
RP396: 9/7/2012 9:14:01 AM - System Checkpoint
.
==== Installed Programs ======================
.
Active@ Data CD/DVD Burner v 2.0
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Download Manager 1.2 (Remove Only)
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.4)
Alcohol 120% (Trial Version)
ArcSoft Camera Suite
Ask Toolbar
Ask Toolbar Updater
Avant Browser (remove only)
Belarc Advisor 7.1
Bonjour
Broadxent V.92 PCI DI3631-1
Burn4Free CD & DVD [removed]
Burn4Free DVD Burning [removed]
CardRd81
CCScore
CDBurnerXP
CR2
Critical Update for Windows Media Player 11 (KB959772)
doPDF 7.3 printer
Enigma Browser (remove only)
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESShelp
ESSini
ESSPCD
ESSPDock
ESSSONIC
ESSTOOLS
essvatgt
essvcpt
Express Burn Disc Burning Software
Free Video to MP3 Converter version 5.0.15.706
FrostWire 5.3.7
FVD Suite 2.6.9
Google Chrome
Google Earth
HamsterFreeVideoConverter
HiJackThis
HijackThis 1.99.1
HLPPDOCK
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB981793)
IrfanView (remove only)
iTunes
Java 7 Update 7
Java Auto Updater
Java™ 6 Update 30
JavaFX 2.1.1
kgcbase
Kodak EasyShare software
KONICA MINOLTA magicolor 2400W
KONICA MINOLTA PagePro 1350W
KSU
Macromedia Shockwave Player
Malwarebytes Anti-Malware version 1.61.0.1400
McAfee Security Scan Plus
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Age of Empires Gold
Microsoft Age of Empires II
Microsoft Age of Empires II: The Conquerors Expansion
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Small Business Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
MOV Converter 3
Mozilla (1.7.8)
Mozilla Firefox 10.0.2 (x86 en-US)
MSN Messenger 7.0
MSN Music Assistant
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6 Service Pack 2 (KB973686)
MSXML4 Parser
NetWaiting
Notifier
NVIDIA Display Driver
NVIDIA Windows 2000/XP nForce Drivers
OfotoXMI
Opera
OTtBP
OTtBPSDK
Pando Media Booster
Pazera Free FLV to AVI Converter 1.4
RealPlayer
Rise of Nations
Search Toolbar
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2722913)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2718523)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135)
Security Update for Windows XP (KB2731847)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982665)
SFR
SHASTA
SKIN0001
SKINXSDK
SLOW-PCfighter
staticcr
TeamSpeak 2 RC2
TOPO!
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB2598845)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2718704)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VideoFileDownload
VLC media player 0.9.8a
VPRINTOL
WebFldrs XP
Window Washer
Windows Backup Utility
Windows Genuine Advantage Notifications (KB905474)
Windows Imaging Component
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows XP Service Pack 3
WinRAR 4.01 (32-bit)
WinZip
WIRELESS
WordWeb
Yahoo! Address AutoComplete
Yahoo! Anti-Spy
Yahoo! extras
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Messenger Explorer Bar
Yahoo! Software Update
Yahoo! Toolbar
.
==== Event Viewer Messages From Past Week ========
.
9/1/2012 1:05:59 AM, error: Service Control Manager [7022] - The Bonjour Service service hung on starting.
9/1/2012 1:04:33 AM, error: Service Control Manager [7000] - The SVKP service failed to start due to the following error: The system cannot find the file specified.
9/1/2012 1:04:33 AM, error: Service Control Manager [7000] - The GoldrushUSB service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
9/1/2012 1:04:31 AM, error: nvidesm [9] - The device, \Device\Scsi\nvidesm1, did not respond within the timeout period.
.
==== End Of File ===========================






################################################################################
################################################









aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-09-08 08:52:21
—————————–
08:52:21.953 OS Version: Windows 5.1.2600 Service Pack 3
08:52:21.953 Number of processors: 1 586 0xA00
08:52:21.953 ComputerName: PH UserName:
08:52:23.765 Initialize success
08:55:53.796 AVAST engine defs: 12090800
08:57:47.656 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Scsi\nvidesm1Port0Path0Target0Lun0
08:57:47.656 Disk 0 Vendor: Maxtor_6 YAR4 Size: 58644MB BusType: 1
08:57:47.687 Disk 1 \Device\Harddisk1\DR1 -> \Device\Scsi\nvidesm1Port0Path0Target1Lun0
08:57:47.687 Disk 1 Vendor: WDC_WD32 00.0 Size: 305245MB BusType: 1
08:57:47.687 Device \Driver\nvidesm -> MajorFunction 82d1e740
08:57:47.734 Disk 0 MBR read successfully
08:57:47.734 Disk 0 MBR scan
08:57:47.875 Disk 0 Windows XP default MBR code
08:57:47.890 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 58635 MB offset 63
08:57:47.906 Disk 0 scanning sectors +120085875
08:57:48.062 Disk 0 scanning C:\WINDOWS\system32\drivers
08:58:08.062 Service scanning
08:58:31.921 Modules scanning
08:58:33.593 Module: C:\WINDOWS\system32\hal.dll **SUSPICIOUS**
08:58:33.828 Module: C:\WINDOWS\System32\Drivers\xmasbus.sys **SUSPICIOUS**
08:58:34.031 Module: C:\WINDOWS\System32\Drivers\ACPI.sys **SUSPICIOUS**
08:58:34.734 Module: C:\WINDOWS\System32\Drivers\ftdisk.sys **SUSPICIOUS**
08:58:35.234 Module: C:\WINDOWS\system32\drivers\SCSIPORT.SYS **SUSPICIOUS**
08:58:35.890 Module: C:\WINDOWS\System32\Drivers\Ntfs.sys **SUSPICIOUS**
08:58:36.000 Module: C:\WINDOWS\System32\Drivers\NDIS.sys **SUSPICIOUS**
08:58:36.250 Module: C:\WINDOWS\System32\Drivers\Mup.sys **SUSPICIOUS**
08:58:36.515 Module: C:\WINDOWS\System32\DRIVERS\USBPORT.SYS **SUSPICIOUS**
08:58:36.875 Module: C:\WINDOWS\System32\DRIVERS\winachcf.sys **SUSPICIOUS**
08:58:37.234 Module: C:\WINDOWS\System32\DRIVERS\ks.sys **SUSPICIOUS**
08:58:37.578 Module: C:\WINDOWS\System32\DRIVERS\nv4_mini.sys **SUSPICIOUS**
08:58:37.890 Module: C:\WINDOWS\System32\DRIVERS\parport.sys **SUSPICIOUS**
08:58:38.265 Module: C:\WINDOWS\system32\drivers\portcls.sys **SUSPICIOUS**
08:58:39.500 Module: C:\WINDOWS\system32\drivers\nvapu.sys **SUSPICIOUS**
08:58:39.703 Module: C:\WINDOWS\system32\drivers\nvmcp.sys **SUSPICIOUS**
08:58:40.515 Module: C:\WINDOWS\System32\DRIVERS\ipsec.sys **SUSPICIOUS**
08:58:40.671 Module: C:\WINDOWS\System32\DRIVERS\tcpip.sys **SUSPICIOUS**
08:58:40.765 Module: C:\WINDOWS\System32\DRIVERS\netbt.sys **SUSPICIOUS**
08:58:40.984 Module: C:\WINDOWS\System32\drivers\afd.sys **SUSPICIOUS**
08:58:41.328 Module: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys **SUSPICIOUS**
08:58:41.531 Module: C:\WINDOWS\System32\DRIVERS\ipnat.sys **SUSPICIOUS**
08:58:42.093 Module: C:\WINDOWS\System32\Drivers\Fastfat.SYS **SUSPICIOUS**
08:58:42.609 Module: C:\WINDOWS\System32\win32k.sys **SUSPICIOUS**
08:58:57.421 Module: C:\WINDOWS\System32\DRIVERS\srv.sys **SUSPICIOUS**
08:58:58.484 Module: C:\WINDOWS\system32\drivers\wdmaud.sys **SUSPICIOUS**
08:58:58.984 Module: C:\WINDOWS\System32\Drivers\HTTP.sys **SUSPICIOUS**
08:58:59.453 Module: C:\WINDOWS\system32\drivers\kmixer.sys **SUSPICIOUS**
08:58:59.640 Module: C:\WINDOWS\system32\ntdll.dll **SUSPICIOUS**
08:58:59.640 Disk 0 trace - called modules:
08:58:59.671 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x82d1e740]<<
08:58:59.671 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82f10ab8]
08:58:59.671 3 CLASSPNP.SYS[f8676fd7] -> nt!IofCallDriver -> \Device\00000063[0x82fa71c8]
08:58:59.671 5 ACPI.sys[f85ca620] -> nt!IofCallDriver -> \Device\Scsi\nvidesm1Port0Path0Target0Lun0[0x82f1a030]
08:58:59.687 \Driver\nvidesm[0x82f8b8c8] -> IRP_MJ_CREATE -> 0x82d1e740
08:59:00.718 AVAST engine scan C:\WINDOWS
08:59:35.640 AVAST engine scan C:\WINDOWS\system32
09:03:57.140 AVAST engine scan C:\WINDOWS\system32\drivers
09:04:19.578 AVAST engine scan C:\Documents and Settings\Peter
09:06:22.750 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Peter\Desktop\MBR.dat"
09:06:22.750 The log file has been saved successfully to "C:\Documents and Settings\Peter\Desktop\aswMBR.txt"

Hello peteinmaine

Thank you for the logs.

You do not appear to have a real time antivirus installed. Please let me know if this is indeed the case.

• P2P Programs:
  
  
  
  • P2P programs are a major source of Malware infections.
  • From your log I see you have FrostWire 5.3.7. We do not pass judgment on file-sharing, however we must inform you that engaging in this activity and having this kind of software installed on your system will always make you more susceptible to Malware infections.
  • The use of P2P programs may be contributing to your current situation, and you would certainly be doing yourself a favour by removing them.
  • If you wish to keep the program(s), please do not use them until your computer is cleaned.
  • Information regarding the risk of using these programs can be found from here and here.
  • It is strongly recommend that you uninstall any P2P programs you have on your system.
  • To do this, Click on "Start" then on "Control Panel" and then on "Add or remove programs".
  • A list of currently installed programs will be displayed.
  • Find the "FrostWire 5.3.7" program, click on it once and then click on the "Remove" button.
  • If you are prompted to re-boot your computer to complete the uninstall please do so.
    
    
    PLEASE NOTE:
  • Even if you are using a P2P program that is deemed safe, it is only the program that is safe. Any files that you receive using a "safe" P2P program may be infected with Malware. The malware writers use P2P file-sharing as a major conduit to spread infected files.
  
  
• DeFogger
  
  
  
  • Please download DeFogger to your desktop.
  • Click on DeFogger to run the tool.
  • The application window will appear.
  • Click the Disable button to disable your CD Emulation drivers.
  • Click Yes to continue.
  • A 'Finished!' message will appear.
  • Click OK.
  • DeFogger will now ask to reboot the machine - click OK.
    IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.
    Do not re-enable these drivers until otherwise instructed.
  
  Once you have ran DeFogger, re-scan with aswMBR and post the new log created.
  
  
  The next tool may present you with the option of cleaning what has been detected.
  
  At this point please do not allow the tool to clean anything.
  
  
  
• TDSS Killer
  
  
  
  • Please read carefully and follow these steps.
  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop.
  • Once extracted, open the TDSSKiller folder and Right click on TDSSKiller.exe and select "Run as Administrator" to run the application.
  • When the window opens, click on Change Parameters.
  • Under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”.
  • Click on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on SKIP.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
  
  Please post the aswMBR log and the TDSSKiller log in your next reply.

Hello JonTom

Re: "You do not appear to have a real time antivirus installed."
Yes, this is in fact correct. There is a history to this which I believe is no longer applicable. Will install Avast upon this clean-up completion.

Re: "P2P programs are a major source of Malware infections."
Understood & will apply corrective action upon clean-up completion.

At first, I missed the instruction to run the aswMBR scan I ran first the TDSSKiller, which produced nothing. I then realized my error & ran the aswMBR scan.
During the aswMBR scan, the machine HUNG! :-(
I rebooted, and reran aswMBR scan. While running the scan, I attempted to reinitialize my browser "Google Chrome". This crashed multiple times.
[See attachment : "Chrome Crash"]
Again the entire machine hung during the scan. :-(
I rebooted, and reran aswMBR scan, this time without attempting to run any other applications. I question if the scan was complete, although I saved the log file.
The machine then gave errors for ALL applications I attempted to run:
Google Chrome
Notpad
Would not run MSPaint at all, so I could not save a screen capture of the error box.

I rebooted & ran TDSSKiller.exe.

Next, I posted.


Re: "Right click on TDSSKiller.exe and select "Run as Administrator" to run the application."

Since my user IS the Admin, the ONLY selection I see is to run as ME. After selecting my own user, I recieve the error entitled "TDS Root" [see attached pic]
It then returns me to reselect. I may only select "Current User".
Before I am able to view "Change Parameters", I recieve two errors: "Can't Initialize" & Can't Load" [see attachments]
I have also included 2 more files showing:
Settings
Scan

The scan produced nothing & took zero time [see attachment]. No reboot was reqested by TDSSKiller.

The ""TDSSKiller.[Version]_[Date]_[Time]_log.txt"" was located directly on my root directory.

[6 attachments with this reply]

Please find the aswMBR log and the TDSSKiller log in this reply reply below.

###############################################################################



aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-09-08 15:18:30
—————————–
15:18:30.390 OS Version: Windows 5.1.2600 Service Pack 3
15:18:30.390 Number of processors: 1 586 0xA00
15:18:30.390 ComputerName: PH UserName:
15:18:30.906 Initialize success
15:18:50.000 AVAST engine defs: 12090800
15:19:05.171 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Scsi\nvidesm1Port0Path0Target0Lun0
15:19:05.171 Disk 0 Vendor: Maxtor_6 YAR4 Size: 58644MB BusType: 1
15:19:05.171 Disk 1 \Device\Harddisk1\DR1 -> \Device\Scsi\nvidesm1Port0Path0Target1Lun0
15:19:05.171 Disk 1 Vendor: WDC_WD32 00.0 Size: 305245MB BusType: 1
15:19:05.187 Disk 0 MBR read successfully
15:19:05.203 Disk 0 MBR scan
15:19:05.296 Disk 0 Windows XP default MBR code
15:19:05.312 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 58635 MB offset 63
15:19:05.312 Disk 0 scanning sectors +120085875
15:19:05.406 Disk 0 scanning C:\WINDOWS\system32\drivers
15:19:20.671 Service scanning
15:19:44.609 Modules scanning
15:19:46.562 Module: C:\WINDOWS\system32\hal.dll **SUSPICIOUS**
15:19:47.250 Module: C:\WINDOWS\System32\Drivers\ACPI.sys **SUSPICIOUS**
15:19:47.765 Module: C:\WINDOWS\System32\Drivers\ftdisk.sys **SUSPICIOUS**
15:19:48.156 Module: C:\WINDOWS\system32\drivers\SCSIPORT.SYS **SUSPICIOUS**
15:19:48.531 Module: C:\WINDOWS\System32\Drivers\KSecDD.sys **SUSPICIOUS**
15:19:48.718 Module: C:\WINDOWS\System32\Drivers\Ntfs.sys **SUSPICIOUS**
15:19:48.859 Module: C:\WINDOWS\System32\Drivers\NDIS.sys **SUSPICIOUS**
15:19:49.015 Module: C:\WINDOWS\System32\Drivers\Mup.sys **SUSPICIOUS**
15:19:49.203 Module: C:\WINDOWS\System32\DRIVERS\USBPORT.SYS **SUSPICIOUS**
15:19:49.546 Module: C:\WINDOWS\System32\DRIVERS\winachcf.sys **SUSPICIOUS**
15:19:49.890 Module: C:\WINDOWS\System32\DRIVERS\ks.sys **SUSPICIOUS**
15:19:50.328 Module: C:\WINDOWS\System32\DRIVERS\nv4_mini.sys **SUSPICIOUS**
15:19:50.562 Module: C:\WINDOWS\System32\DRIVERS\parport.sys **SUSPICIOUS**
15:19:50.843 Module: C:\WINDOWS\system32\drivers\portcls.sys **SUSPICIOUS**
15:19:51.781 Module: C:\WINDOWS\system32\drivers\nvapu.sys **SUSPICIOUS**
15:19:51.968 Module: C:\WINDOWS\system32\drivers\nvmcp.sys **SUSPICIOUS**
15:19:52.656 Module: C:\WINDOWS\System32\DRIVERS\ipsec.sys **SUSPICIOUS**
15:19:52.781 Module: C:\WINDOWS\System32\DRIVERS\tcpip.sys **SUSPICIOUS**
15:19:52.890 Module: C:\WINDOWS\System32\DRIVERS\netbt.sys **SUSPICIOUS**
15:19:53.093 Module: C:\WINDOWS\System32\drivers\afd.sys **SUSPICIOUS**
15:19:53.281 Module: C:\WINDOWS\System32\DRIVERS\rdbss.sys **SUSPICIOUS**
15:19:53.437 Module: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys **SUSPICIOUS**
15:19:53.609 Module: C:\WINDOWS\System32\DRIVERS\ipnat.sys **SUSPICIOUS**
15:19:54.171 Module: C:\WINDOWS\System32\Drivers\Fastfat.SYS **SUSPICIOUS**
15:19:54.593 Module: C:\WINDOWS\System32\win32k.sys **SUSPICIOUS**
15:19:57.515 Module: C:\WINDOWS\System32\nv4_disp.dll **SUSPICIOUS**
15:19:57.656 Module: C:\WINDOWS\System32\ATMFD.DLL **SUSPICIOUS**
15:19:57.968 Module: C:\WINDOWS\System32\DRIVERS\srv.sys **SUSPICIOUS**
15:19:58.187 Module: C:\WINDOWS\system32\drivers\wdmaud.sys **SUSPICIOUS**
15:19:58.453 Module: C:\WINDOWS\System32\Drivers\HTTP.sys **SUSPICIOUS**
15:19:58.703 Module: C:\WINDOWS\system32\ntdll.dll **SUSPICIOUS**
15:19:58.718 Disk 0 trace - called modules:
15:19:58.734 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll SCSIPORT.SYS nvidesm.sys
15:19:58.734 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82f129c0]
15:19:58.750 3 CLASSPNP.SYS[f8676fd7] -> nt!IofCallDriver -> \Device\00000062[0x82faf740]
15:19:58.750 5 ACPI.sys[f85ed620] -> nt!IofCallDriver -> \Device\Scsi\nvidesm1Port0Path0Target0Lun0[0x82faf030]
15:19:59.437 AVAST engine scan C:\WINDOWS
15:20:24.796 AVAST engine scan C:\WINDOWS\system32
15:23:55.078 AVAST engine scan C:\WINDOWS\system32\drivers
15:24:15.515 AVAST engine scan C:\Documents and Settings\Peter
15:32:42.171 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Peter\Desktop\MBR.dat"
15:32:42.187 The log file has been saved successfully to "C:\Documents and Settings\Peter\Desktop\aswMBR-2.txt"


aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-09-08 15:18:30
—————————–
15:18:30.390 OS Version: Windows 5.1.2600 Service Pack 3
15:18:30.390 Number of processors: 1 586 0xA00
15:18:30.390 ComputerName: PH UserName:
15:18:30.906 Initialize success
15:18:50.000 AVAST engine defs: 12090800
15:19:05.171 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Scsi\nvidesm1Port0Path0Target0Lun0
15:19:05.171 Disk 0 Vendor: Maxtor_6 YAR4 Size: 58644MB BusType: 1
15:19:05.171 Disk 1 \Device\Harddisk1\DR1 -> \Device\Scsi\nvidesm1Port0Path0Target1Lun0
15:19:05.171 Disk 1 Vendor: WDC_WD32 00.0 Size: 305245MB BusType: 1
15:19:05.187 Disk 0 MBR read successfully
15:19:05.203 Disk 0 MBR scan
15:19:05.296 Disk 0 Windows XP default MBR code
15:19:05.312 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 58635 MB offset 63
15:19:05.312 Disk 0 scanning sectors +120085875
15:19:05.406 Disk 0 scanning C:\WINDOWS\system32\drivers
15:19:20.671 Service scanning
15:19:44.609 Modules scanning
15:19:46.562 Module: C:\WINDOWS\system32\hal.dll **SUSPICIOUS**
15:19:47.250 Module: C:\WINDOWS\System32\Drivers\ACPI.sys **SUSPICIOUS**
15:19:47.765 Module: C:\WINDOWS\System32\Drivers\ftdisk.sys **SUSPICIOUS**
15:19:48.156 Module: C:\WINDOWS\system32\drivers\SCSIPORT.SYS **SUSPICIOUS**
15:19:48.531 Module: C:\WINDOWS\System32\Drivers\KSecDD.sys **SUSPICIOUS**
15:19:48.718 Module: C:\WINDOWS\System32\Drivers\Ntfs.sys **SUSPICIOUS**
15:19:48.859 Module: C:\WINDOWS\System32\Drivers\NDIS.sys **SUSPICIOUS**
15:19:49.015 Module: C:\WINDOWS\System32\Drivers\Mup.sys **SUSPICIOUS**
15:19:49.203 Module: C:\WINDOWS\System32\DRIVERS\USBPORT.SYS **SUSPICIOUS**
15:19:49.546 Module: C:\WINDOWS\System32\DRIVERS\winachcf.sys **SUSPICIOUS**
15:19:49.890 Module: C:\WINDOWS\System32\DRIVERS\ks.sys **SUSPICIOUS**
15:19:50.328 Module: C:\WINDOWS\System32\DRIVERS\nv4_mini.sys **SUSPICIOUS**
15:19:50.562 Module: C:\WINDOWS\System32\DRIVERS\parport.sys **SUSPICIOUS**
15:19:50.843 Module: C:\WINDOWS\system32\drivers\portcls.sys **SUSPICIOUS**
15:19:51.781 Module: C:\WINDOWS\system32\drivers\nvapu.sys **SUSPICIOUS**
15:19:51.968 Module: C:\WINDOWS\system32\drivers\nvmcp.sys **SUSPICIOUS**
15:19:52.656 Module: C:\WINDOWS\System32\DRIVERS\ipsec.sys **SUSPICIOUS**
15:19:52.781 Module: C:\WINDOWS\System32\DRIVERS\tcpip.sys **SUSPICIOUS**
15:19:52.890 Module: C:\WINDOWS\System32\DRIVERS\netbt.sys **SUSPICIOUS**
15:19:53.093 Module: C:\WINDOWS\System32\drivers\afd.sys **SUSPICIOUS**
15:19:53.281 Module: C:\WINDOWS\System32\DRIVERS\rdbss.sys **SUSPICIOUS**
15:19:53.437 Module: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys **SUSPICIOUS**
15:19:53.609 Module: C:\WINDOWS\System32\DRIVERS\ipnat.sys **SUSPICIOUS**
15:19:54.171 Module: C:\WINDOWS\System32\Drivers\Fastfat.SYS **SUSPICIOUS**
15:19:54.593 Module: C:\WINDOWS\System32\win32k.sys **SUSPICIOUS**
15:19:57.515 Module: C:\WINDOWS\System32\nv4_disp.dll **SUSPICIOUS**
15:19:57.656 Module: C:\WINDOWS\System32\ATMFD.DLL **SUSPICIOUS**
15:19:57.968 Module: C:\WINDOWS\System32\DRIVERS\srv.sys **SUSPICIOUS**
15:19:58.187 Module: C:\WINDOWS\system32\drivers\wdmaud.sys **SUSPICIOUS**
15:19:58.453 Module: C:\WINDOWS\System32\Drivers\HTTP.sys **SUSPICIOUS**
15:19:58.703 Module: C:\WINDOWS\system32\ntdll.dll **SUSPICIOUS**
15:19:58.718 Disk 0 trace - called modules:
15:19:58.734 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll SCSIPORT.SYS nvidesm.sys
15:19:58.734 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82f129c0]
15:19:58.750 3 CLASSPNP.SYS[f8676fd7] -> nt!IofCallDriver -> \Device\00000062[0x82faf740]
15:19:58.750 5 ACPI.sys[f85ed620] -> nt!IofCallDriver -> \Device\Scsi\nvidesm1Port0Path0Target0Lun0[0x82faf030]
15:19:59.437 AVAST engine scan C:\WINDOWS
15:20:24.796 AVAST engine scan C:\WINDOWS\system32
15:23:55.078 AVAST engine scan C:\WINDOWS\system32\drivers
15:24:15.515 AVAST engine scan C:\Documents and Settings\Peter
15:32:42.171 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Peter\Desktop\MBR.dat"
15:32:42.187 The log file has been saved successfully to "C:\Documents and Settings\Peter\Desktop\aswMBR-2.txt"
15:33:32.640 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Peter\Desktop\MBR.dat"
15:33:32.640 The log file has been saved successfully to "C:\Documents and Settings\Peter\Desktop\aswMBR-2.txt"







###############################################################################







15:44:42.0640 2884 TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
15:44:43.0421 2884 ============================================================
15:44:43.0421 2884 Current date / time: 2012/09/08 15:44:43.0421
15:44:43.0421 2884 SystemInfo:
15:44:43.0421 2884
15:44:43.0421 2884 OS Version: 5.1.2600 ServicePack: 3.0
15:44:43.0421 2884 Product type: Workstation
15:44:43.0421 2884 ComputerName: PH
15:44:43.0421 2884 UserName: Peter
15:44:43.0421 2884 Windows directory: C:\WINDOWS
15:44:43.0421 2884 System windows directory: C:\WINDOWS
15:44:43.0421 2884 Processor architecture: Intel x86
15:44:43.0421 2884 Number of processors: 1
15:44:43.0421 2884 Page size: 0x1000
15:44:43.0421 2884 Boot type: Normal boot
15:44:43.0421 2884 ============================================================
15:44:44.0687 2884 Drive \Device\Harddisk0\DR0 - Size: 0xE51424000 (57.27 Gb), SectorSize: 0x200, Cylinders: 0x1D34, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000058
15:44:44.0687 2884 Drive \Device\Harddisk1\DR1 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000058
15:44:44.0687 2884 Drive \Device\Harddisk2\DR4 - Size: 0x3C780000 (0.94 Gb), SectorSize: 0x200, Cylinders: 0x7B, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
15:44:44.0687 2884 Drive \Device\Harddisk3\DR5 - Size: 0x78F000000 (30.23 Gb), SectorSize: 0x200, Cylinders: 0xF6A, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
15:44:44.0687 2884 ============================================================
15:44:44.0687 2884 \Device\Harddisk0\DR0:
15:44:44.0687 2884 MBR partitions:
15:44:44.0687 2884 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x7285D34
15:44:44.0687 2884 \Device\Harddisk1\DR1:
15:44:44.0687 2884 MBR partitions:
15:44:44.0687 2884 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2542DEA1
15:44:44.0687 2884 \Device\Harddisk2\DR4:
15:44:44.0687 2884 MBR partitions:
15:44:44.0687 2884 \Device\Harddisk2\DR4\Partition1: MBR, Type 0x6, StartLBA 0x20, BlocksNum 0x1E3BE0
15:44:44.0687 2884 \Device\Harddisk3\DR5:
15:44:44.0687 2884 MBR partitions:
15:44:44.0687 2884 \Device\Harddisk3\DR5\Partition1: MBR, Type 0xC, StartLBA 0x20, BlocksNum 0x3C77FE0
15:44:44.0687 2884 ============================================================
15:44:44.0703 2884 C: <-> \Device\Harddisk0\DR0\Partition1
15:44:44.0781 2884 F: <-> \Device\Harddisk1\DR1\Partition1
15:44:44.0781 2884 ============================================================
15:44:44.0781 2884 Initialize success
15:44:44.0781 2884 ============================================================
15:44:48.0796 2880 Deinitialize success

Hi JonTom,

Ran rkill.exe
It seemed to work fine.
However,

You'll be able to tell rkill has done it's job when your desktop (explorer.exe) cycles off and then on again.

This happens to my screen many times a day. i.e. explorer.exe cycles off and then on again"

Ran Combofix. Combofix is still prevented from running.

Note> As I ran OTL, I noticed that the ending line failed to display "CREATERESTOREPOINT". I figured that I must have missed this in the copy/paste. So, I ran OTL again. However, on "Run 2", no "Extra.txt" was produced . It was also then, that I learned that this line is NOT displayed upon execution. Fortunately, I had backed up the original files to s stick drive [OTL.txt & Extras.txt]. The files to follow are the original "Run 1" log files.

The two log files to follow

Ran OTL. Follows both log files:


###############################################################################
OTL logfile created on: 9/10/2012 8:39:01 AM - Run 1
OTL by OldTimer - Version 3.2.61.3 Folder = C:\Documents and Settings\Peter\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.49 Mb Total Physical Memory | 367.97 Mb Available Physical Memory | 71.94% Memory free
1.22 Gb Paging File | 1.02 Gb Available in Paging File | 84.02% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57.26 Gb Total Space | 9.40 Gb Free Space | 16.42% Space Free | Partition Type: NTFS
Drive E: | 967.22 Mb Total Space | 741.67 Mb Free Space | 76.68% Space Free | Partition Type: FAT
Drive F: | 298.09 Gb Total Space | 76.86 Gb Free Space | 25.78% Space Free | Partition Type: NTFS
Drive H: | 30.21 Gb Total Space | 1.04 Gb Free Space | 3.43% Space Free | Partition Type: FAT32
Drive J: | 30.22 Gb Total Space | 22.24 Gb Free Space | 73.61% Space Free | Partition Type: FAT32

Computer Name: PH | User Name: Peter | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/09/10 07:49:12 | 000,600,064 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Peter\Desktop\OTL.exe
PRC - [2012/09/02 16:53:43 | 000,161,768 | —- | M] (Oracle Corporation) – C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2012/06/06 21:33:42 | 001,564,872 | —- | M] (Ask) – C:\Program Files\Ask.com\Updater\Updater.exe
PRC - [2010/03/04 23:38:00 | 000,071,096 | —- | M] () – C:\Program Files\CDBurnerXP\NMSAccessU.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/14 06:42:20 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2005/08/29 16:10:34 | 000,019,968 | —- | M] (Antony Lewis) – C:\Program Files\WordWeb\wweb32.exe
PRC - [2005/01/28 22:00:01 | 000,180,269 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2003/03/31 08:00:00 | 000,138,752 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\sndvol32.exe
PRC - [2003/01/13 10:08:56 | 000,818,688 | —- | M] (Webroot Software, Inc.) – C:\Program Files\Washer\washer.exe


========== Modules (No Company Name) ==========

MOD - [2012/05/25 04:25:00 | 000,921,600 | —- | M] () – C:\Program Files\Yahoo!\Messenger\yui.dll
MOD - [2011/05/28 23:04:56 | 000,140,288 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll
MOD - [2010/03/04 23:38:00 | 000,071,096 | —- | M] () – C:\Program Files\CDBurnerXP\NMSAccessU.exe
MOD - [2008/04/14 06:42:00 | 000,014,336 | —- | M] () – C:\WINDOWS\system32\msdmo.dll


========== Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] – C:\WINDOWS\system32\msasvc.exe – (MsaSvc)
SRV - File not found [Disabled | Stopped] – %SystemRoot%\System32\hidserv.dll – (HidServ)
SRV - File not found [On_Demand | Stopped] – %SystemRoot%\System32\appmgmts.dll – (AppMgmt)
SRV - [2012/09/02 16:53:43 | 000,161,768 | —- | M] (Oracle Corporation) [Auto | Running] – C:\Program Files\Java\jre7\bin\jqs.exe – (JavaQuickStarterService)
SRV - [2012/08/15 06:18:08 | 000,250,056 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2010/03/04 23:38:00 | 000,071,096 | —- | M] () [Auto | Running] – C:\Program Files\CDBurnerXP\NMSAccessU.exe – (NMSAccess)
SRV - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | Auto | Stopped] – C:\WINDOWS\system32\SVKP.sys – (SVKP)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (i2omgmt)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - [2009/11/12 14:48:56 | 000,007,168 | —- | M] () [File_System | On_Demand | Stopped] – C:\WINDOWS\System32\drivers\StarOpen.sys – (StarOpen)
DRV - [2008/04/14 01:15:30 | 000,010,624 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\gameenum.sys – (gameenum)
DRV - [2005/04/07 17:18:34 | 000,003,840 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\drivers\BANTExt.sys – (BANTExt)
DRV - [2003/12/23 02:15:42 | 000,005,248 | —- | M] ( ) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\drivers\xmasscsi.sys – (xmasscsi)
DRV - [2003/12/21 17:24:22 | 000,140,800 | —- | M] ( ) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\drivers\xmasbus.sys – (xmasbus)
DRV - [2003/07/22 03:04:46 | 000,018,848 | —- | M] (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) [Kernel | Auto | Running] – C:\WINDOWS\system32\MLPTDR_Q.SYS – (MLPTDR_Q)
DRV - [2002/12/05 00:01:00 | 000,241,664 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nvapu.sys – (nvnforce)
DRV - [2002/12/05 00:01:00 | 000,013,056 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nvax.sys – (nvax)
DRV - [2002/11/27 07:52:00 | 000,080,896 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\NVENET.sys – (NVENET)
DRV - [2002/11/13 03:10:00 | 000,020,224 | R— | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\nvidesm.sys – (nvidesm)
DRV - [2002/10/18 05:06:28 | 000,842,128 | —- | M] (Conexant) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\winachcf.sys – (Winachcf)
DRV - [2002/09/05 23:24:00 | 000,013,568 | R— | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\nv_agp.SYS – (nv_agp)
DRV - [2001/08/17 13:28:02 | 000,907,456 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\HCF_MSFT.sys – (HCF_MSFT)
DRV - [2001/08/17 10:00:04 | 000,002,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\msmpu401.sys – (ms_mpu401)
DRV - [2001/08/13 13:59:36 | 000,011,387 | R— | M] (Agilent Technologies) [Kernel | Auto | Stopped] – C:\WINDOWS\system32\drivers\goldrush.sys – (GoldrushUSB)
DRV - [2000/10/25 08:27:24 | 000,003,000 | R— | M] () [Kernel | Auto | Running] – C:\WINDOWS\system32\SetupNT.sys – (SetupNT)
DRV - [1999/09/10 12:06:00 | 000,025,244 | —- | M] (Adaptec) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\ASPI32.SYS – (ASPI32)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/def…/search/ie.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/?.intl=us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://mail.yahoo.com/?.intl=us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch =
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {8A64D544-98BB-C260-590A-335EB1FB0846}
IE - HKCU\..\SearchScopes\{0169E633-8781-F882-9BC7-7B014AE4DE4E}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{188C1581-6C74-42A6-9A73-5D018DFDA96E}: "URL" = http://websearch.ask.com/redirect?client=i…C8-4C7FD6259F88
IE - HKCU\..\SearchScopes\{6C59297E-BFFE-4E6A-0BF5-4187155432D8}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\..\SearchScopes\{8A64D544-98BB-C260-590A-335EB1FB0846}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\..\SearchScopes\{8D664689-231B-40C7-8EA3-870A3132D4DE}: "URL" = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT3106518
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.1: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2027: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2088: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1040: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{9051303c-7e41-4311-a783-d6fe5ef2832d}: C:\Program Files\FVD Suite\addons\Firefox [2011/12/01 08:46:56 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla 1.7.8\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2012/06/24 22:18:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla 1.7.8\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2012/08/17 05:37:20 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/27 13:01:34 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/08/17 05:37:20 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{EB132DB0-A4CA-11DF-9732-0E29E0D72085}: C:\Program Files\Object\facetheme
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla 1.7.8\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2012/06/24 22:18:33 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla 1.7.8\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2012/08/17 05:37:20 | 000,000,000 | —D | M]

[2011/11/15 19:23:18 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Extensions
[2012/09/05 14:24:20 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions
[2012/05/20 06:35:50 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/06/08 21:05:11 | 000,000,000 | —D | M] ("FVD Suite Addon") – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{9051303c-7e41-4311-a783-d6fe5ef2832d}
[2012/03/29 17:32:30 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/09/05 14:24:20 | 000,000,000 | —D | M] (VideoFileDownload - Download YouTube Videos) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2011/11/15 19:23:18 | 000,000,000 | —D | M] (EpicPlay Games) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2012/07/08 06:23:46 | 000,000,000 | —D | M] (Ask Toolbar) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2006/11/06 15:02:48 | 000,000,000 | —D | M] ("VideoDownloader") – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2011/11/13 20:02:17 | 000,145,972 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2012/02/27 13:02:50 | 000,020,591 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
[2012/07/31 08:01:36 | 002,227,573 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{5FF97DB7-2EF7-4a7f-8E36-5214B5C5C65A}.xpi
[2011/11/13 20:02:29 | 000,031,532 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{9ab67d74-ec41-4cb2-b417-df5d93ba1beb}.xpi
[2012/07/21 13:15:15 | 000,702,524 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
[2011/11/13 20:02:41 | 000,879,991 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{DCBD1271-D228-4082-9FBC-36D9B7660B03}.xpi
[2012/02/27 13:01:49 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/11/13 20:01:23 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2011/11/13 20:01:23 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/02/27 13:01:34 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/27 13:01:27 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010/01/01 04:00:00 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml.old
[2012/02/27 13:01:27 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://mail.yahoo.com/?.intl=us
CHR - default_search_provider: Yahoo! (Enabled)
CHR - default_search_provider: search_url = http://search.yahoo.com/search?ei={inputEn…p={searchTerms}
CHR - default_search_provider: suggest_url = http://ff.search.yahoo.com/gossip?output=f…d={searchTerms}
CHR - homepage: http://mail.yahoo.com/?.intl=us
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np32dsw.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U5 (Enabled) = C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.50.255 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: VideoFileDownload = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kincjchfokkeneeofpeefomkikfkiedl\1.0_0\
CHR - Extension: Fade to White Aero Skin (by Skarv) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\oekemfmehiakocmomemagciajlikigkl\1.0_0\
CHR - Extension: Gmail = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2004/08/21 23:07:46 | 000,000,848 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (VideoFileDownload) - {BA0454C5-FD30-428E-8DB9-3FF87A612F64} - C:\Program Files\OpenApp\bho_project.dll (VideoFileDownload)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (FVD Suite Toolbar) - {2B171655-A69C-5c18-B693-6CB5DC269D41} - C:\Program Files\FVD Suite\addons\IE\FVDToolbar.dll (www.flashvideodownloader.org/fvd-suite/)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [KONICA MINOLTA magicolor 2400W STD] C:\WINDOWS\System32\MSTMON_S.EXE (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netwaiting.exe ()
O4 - HKCU..\Run: [Washer] C:\Program Files\Washer\washer.exe (Webroot Software, Inc.)
O4 - HKLM..\RunOnceEx: [] File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe ()
O4 - Startup: C:\Documents and Settings\Peter\Start Menu\Programs\Startup\WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe (Antony Lewis)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O8 - Extra context menu item: &WordWeb… - C:\WINDOWS\wweb32.dll (Antony Lewis)
O8 - Extra context menu item: &Yahoo! Search - C:\Program Files\Yahoo!\Common [2012/08/02 20:12:49 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &Dictionary - C:\Program Files\Yahoo!\Common [2012/08/02 20:12:49 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &Maps - C:\Program Files\Yahoo!\Common [2012/08/02 20:12:49 | 000,000,000 | —D | M]
O9 - Extra Button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - Reg Error: Key error. File not found
O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll (Apple Computer, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab (Reg Error: Key error.)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} http://static.windupdates.com/cab/CDT/ie/bridge-c15.cab (Reg Error: Key error.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} http://support.f-secure.com/ols/fscax.cab (F-Secure Online Scanner)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} http://download.microsoft.com/download/7/E…04/clearadj.cab (CTAdjust Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A67D86CB-7EF9-414A-BC85-AC3EEF166B61}: DhcpNameServer = 192.168.1.1 [removed] [removed]
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/06/26 15:00:20 | 000,000,032 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: Ip6FwHlp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/09/10 07:49:09 | 000,600,064 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Peter\Desktop\OTL.exe
[2012/09/09 22:25:35 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\uSeRiNiT_rkill_5.exe
[2012/09/09 22:24:59 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\WiNlOgOn_rkill_4.exe
[2012/09/09 22:23:46 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_3.scr
[2012/09/09 22:23:21 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_2.com
[2012/09/09 22:22:02 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_1.exe
[2012/09/08 23:05:44 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Start Menu\Programs\Window Washer
[2012/09/08 14:03:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Desktop\tdsskiller
[2012/09/05 17:56:48 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/09/05 17:56:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Start Menu\Programs\HiJackThis
[2012/09/05 17:34:35 | 000,000,000 | —D | C] – C:\Program Files\HijackThis
[2012/09/05 14:29:06 | 000,045,056 | —- | C] (Adaptec) – C:\WINDOWS\System32\WNASPI32.DLL
[2012/09/05 14:29:06 | 000,025,244 | —- | C] (Adaptec) – C:\WINDOWS\System32\drivers\ASPI32.SYS
[2012/09/05 14:29:06 | 000,005,600 | —- | C] (Adaptec) – C:\WINDOWS\System\WINASPI.DLL
[2012/09/05 14:29:06 | 000,004,672 | —- | C] (Adaptec) – C:\WINDOWS\System\WOWPOST.EXE
[2012/09/05 14:27:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\My Documents\FORCEASPI
[2012/09/05 14:24:19 | 000,000,000 | —D | C] – C:\Program Files\OpenApp
[2012/09/05 14:22:38 | 000,000,000 | —D | C] – C:\Program Files\TSearch
[2012/09/05 14:22:16 | 000,000,000 | —D | C] – C:\Program Files\smartdl
[2012/09/02 16:57:44 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/09/02 16:55:48 | 000,246,760 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/09/02 16:55:15 | 000,174,056 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/09/02 16:55:15 | 000,093,672 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2012/09/02 16:55:13 | 000,174,056 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[3 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/09/10 08:48:02 | 000,000,234 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012/09/10 08:17:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/09/10 08:04:00 | 000,000,978 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-2000478354-839522115-1004UA.job
[2012/09/10 07:49:12 | 000,600,064 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Peter\Desktop\OTL.exe
[2012/09/10 07:38:07 | 000,030,720 | —- | M] () – C:\Documents and Settings\Peter\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/10 05:47:38 | 000,001,374 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/09/10 05:46:56 | 014,437,376 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2012/09/10 05:46:56 | 005,655,552 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mb
[2012/09/10 05:46:46 | 000,019,116 | —- | M] () – C:\WINDOWS\MSTMON_S.INI
[2012/09/10 05:46:40 | 000,003,725 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2012/09/10 05:45:39 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/09/09 22:25:40 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\uSeRiNiT_rkill_5.exe
[2012/09/09 22:25:04 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\WiNlOgOn_rkill_4.exe
[2012/09/09 22:23:50 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_3.scr
[2012/09/09 22:23:26 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_2.com
[2012/09/09 22:22:09 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_1.exe
[2012/09/09 09:04:04 | 000,000,926 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-2000478354-839522115-1004Core.job
[2012/09/09 08:47:02 | 004,742,953 | —- | M] () – C:\Documents and Settings\Peter\Desktop\ComboFix.exe
[2012/09/09 08:34:08 | 000,000,548 | —- | M] () – C:\Documents and Settings\Peter\Desktop\MP4 Converted.lnk
[2012/09/08 23:05:44 | 000,000,606 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Window Washer.lnk
[2012/09/08 15:33:32 | 000,000,512 | —- | M] () – C:\Documents and Settings\Peter\Desktop\MBR.dat
[2012/09/08 14:00:04 | 002,193,184 | —- | M] () – C:\Documents and Settings\Peter\Desktop\tdsskiller.zip
[2012/09/08 13:52:15 | 000,000,054 | —- | M] () – C:\Documents and Settings\Peter\defogger_reenable
[2012/09/08 13:50:03 | 000,050,477 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Defogger.exe
[2012/09/08 08:47:36 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Peter\Desktop\aswMBR.exe
[2012/09/05 17:57:32 | 000,002,447 | —- | M] () – C:\Documents and Settings\Peter\Desktop\HiJackThis.lnk
[2012/09/05 16:38:36 | 000,097,762 | —- | M] () – C:\Documents and Settings\Peter\Desktop\tumblr_ljn81n3gbW1qg0vxuo1_500.jpg
[2012/09/05 14:52:53 | 000,000,640 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Burn4Free.lnk
[2012/09/05 06:25:18 | 000,002,284 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Google Chrome.lnk
[2012/09/05 06:25:18 | 000,002,262 | —- | M] () – C:\Documents and Settings\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/09/02 16:53:48 | 000,093,672 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2012/09/02 16:53:32 | 000,246,760 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/09/02 16:53:32 | 000,174,056 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/09/02 16:53:32 | 000,143,872 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2012/09/02 16:53:31 | 000,174,056 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2012/09/02 16:53:29 | 000,821,736 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npDeployJava1.dll
[2012/09/02 16:53:29 | 000,746,984 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2012/08/30 02:59:31 | 000,435,688 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/08/30 02:59:31 | 000,068,584 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/08/29 11:55:12 | 083,023,306 | —- | M] () – C:\Documents and Settings\All Users\Application Data\nud0repor.pad
[2012/08/22 16:22:00 | 000,209,269 | —- | M] () – C:\torrent.exe
[2012/08/20 09:19:20 | 000,000,224 | —- | M] () – C:\WINDOWS\TOPO.INI
[2012/08/20 09:17:23 | 002,755,398 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Kinsmans.BMP
[2012/08/17 05:30:40 | 000,565,504 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/08/16 22:35:44 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/08/16 21:47:11 | 000,007,117 | —- | M] () – C:\Documents and Settings\Peter\My Documents\www.rochesterschools.com_Personnel_Postings_Secondary_Math_Teacher.pdf
[2012/08/15 06:18:02 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/08/15 06:18:01 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/08/14 07:11:17 | 000,074,955 | —- | M] () – C:\Documents and Settings\Peter\My Documents\burning-pot-2103.html
[3 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/09/09 12:32:27 | 000,000,548 | —- | C] () – C:\Documents and Settings\Peter\Desktop\MP4 Converted.lnk
[2012/09/09 08:46:43 | 004,742,953 | —- | C] () – C:\Documents and Settings\Peter\Desktop\ComboFix.exe
[2012/09/08 23:05:44 | 000,000,606 | —- | C] () – C:\Documents and Settings\Peter\Desktop\Window Washer.lnk
[2012/09/08 13:59:56 | 002,193,184 | —- | C] () – C:\Documents and Settings\Peter\Desktop\tdsskiller.zip
[2012/09/08 13:52:04 | 000,000,054 | —- | C] () – C:\Documents and Settings\Peter\defogger_reenable
[2012/09/08 13:49:59 | 000,050,477 | —- | C] () – C:\Documents and Settings\Peter\Desktop\Defogger.exe
[2012/09/08 09:06:22 | 000,000,512 | —- | C] () – C:\Documents and Settings\Peter\Desktop\MBR.dat
[2012/09/05 17:56:48 | 000,002,447 | —- | C] () – C:\Documents and Settings\Peter\Desktop\HiJackThis.lnk
[2012/09/05 16:29:27 | 000,097,762 | —- | C] () – C:\Documents and Settings\Peter\Desktop\tumblr_ljn81n3gbW1qg0vxuo1_500.jpg
[2012/08/29 11:32:06 | 083,023,306 | —- | C] () – C:\Documents and Settings\All Users\Application Data\nud0repor.pad
[2012/08/22 16:22:00 | 000,209,269 | —- | C] () – C:\torrent.exe
[2012/08/20 09:17:23 | 002,755,398 | —- | C] () – C:\Documents and Settings\Peter\Desktop\Kinsmans.BMP
[2012/08/16 21:47:10 | 000,007,117 | —- | C] () – C:\Documents and Settings\Peter\My Documents\www.rochesterschools.com_Personnel_Postings_Secondary_Math_Teacher.pdf
[2012/08/14 07:11:17 | 000,074,955 | —- | C] () – C:\Documents and Settings\Peter\My Documents\burning-pot-2103.html
[2011/11/22 15:07:34 | 000,000,275 | —- | C] () – C:\Documents and Settings\Peter\Local Settings\Application Data\HamsterVideoConverterSettings.cfg
[2010/12/01 22:06:37 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2005/09/20 06:50:23 | 000,001,759 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2004/09/20 09:23:08 | 000,000,000 | —- | C] () – C:\Documents and Settings\Peter\Application Data\dm.ini
[2004/06/27 14:22:27 | 000,030,720 | —- | C] () – C:\Documents and Settings\Peter\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== LOP Check ==========

[2010/12/01 22:06:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2012/04/13 08:27:15 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/11/15 19:25:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Fighters
[2010/12/01 20:52:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2012/06/25 18:50:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2004/05/04 15:31:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2010/12/01 22:51:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2012/04/13 06:14:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2005/05/09 09:45:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2012/04/13 06:10:56 | 000,000,000 | -HSD | M] – C:\Documents and Settings\All Users\Application Data\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2006/04/19 18:48:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Advanced Browser
[2012/09/05 16:37:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Avant Browser
[2011/11/25 02:27:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Azureus
[2010/12/01 22:06:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Canneverbe Limited
[2012/07/15 10:06:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\DVDVideoSoft
[2012/08/25 10:15:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Enigma Browser
[2011/11/15 19:23:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\FCSB000063443
[2011/11/15 19:25:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Fighters
[2011/12/01 08:47:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\FVDToolbar
[2011/11/30 08:15:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\HamsterSoft
[2012/04/13 06:06:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\OpenCandy
[2004/09/21 23:38:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Opera
[2012/06/24 09:56:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Oracle
[2012/06/13 12:18:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Softland
[2004/09/15 22:04:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Thunderbird
[2012/04/13 06:12:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\TuneUp Software
[2006/04/26 22:38:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\UVC
[2010/12/01 22:04:44 | 000,000,298 | —- | M] () – C:\WINDOWS\Tasks\expressburnShakeIcon.job
[2012/09/10 08:48:02 | 000,000,234 | —- | M] () – C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2012/08/22 16:22:00 | 000,209,269 | —- | M] () – C:\torrent.exe

< MD5 for: AGP440.SYS >
[2004/12/31 21:18:15 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/04/14 06:51:44 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004/12/31 21:18:15 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008/04/14 06:51:44 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/14 01:06:40 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\agp440.sys
[2008/04/14 01:06:40 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 02:07:41 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2003/03/31 08:00:00 | 010,158,890 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2004/12/31 21:18:15 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/04/14 06:51:44 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004/12/31 21:18:15 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008/04/14 06:51:44 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2003/03/31 08:00:00 | 000,086,912 | —- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA – C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
[2008/04/14 01:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\atapi.sys
[2008/04/14 01:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 01:59:42 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 06:41:54 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\eventlog.dll
[2008/04/14 06:41:54 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 03:56:42 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/14 06:42:02 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\netlogon.dll
[2008/04/14 06:42:02 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2009/02/06 14:46:09 | 000,408,064 | —- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 – C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009/02/06 14:46:09 | 000,408,064 | —- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 – C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[2004/08/04 03:56:44 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 03:56:44 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/14 06:42:06 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\scecli.dll
[2008/04/14 06:42:06 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2004/04/13 00:59:06 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2004/04/13 00:59:06 | 000,602,112 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2004/04/13 00:59:06 | 000,397,312 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %systemroot%\system32\drivers\*.sys /90 >
[2012/07/04 10:05:18 | 000,139,784 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\rdpwd.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf:SummaryInformation
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CEF69E3D

< End of report >











###############################################################################












OTL Extras logfile created on: 9/10/2012 8:39:01 AM - Run 1
OTL by OldTimer - Version 3.2.61.3 Folder = C:\Documents and Settings\Peter\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.49 Mb Total Physical Memory | 367.97 Mb Available Physical Memory | 71.94% Memory free
1.22 Gb Paging File | 1.02 Gb Available in Paging File | 84.02% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57.26 Gb Total Space | 9.40 Gb Free Space | 16.42% Space Free | Partition Type: NTFS
Drive E: | 967.22 Mb Total Space | 741.67 Mb Free Space | 76.68% Space Free | Partition Type: FAT
Drive F: | 298.09 Gb Total Space | 76.86 Gb Free Space | 25.78% Space Free | Partition Type: NTFS
Drive H: | 30.21 Gb Total Space | 1.04 Gb Free Space | 3.43% Space Free | Partition Type: FAT32
Drive J: | 30.22 Gb Total Space | 22.24 Gb Free Space | 73.61% Space Free | Partition Type: FAT32

Computer Name: PH | User Name: Peter | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
http [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"56442:TCP" = 56442:TCP:*:Enabled:Pando Media Booster
"56442:UDP" = 56442:UDP:*:Enabled:Pando Media Booster

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"56442:TCP" = 56442:TCP:*:Enabled:Pando Media Booster
"56442:UDP" = 56442:UDP:*:Enabled:Pando Media Booster

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster – ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\FrostWire 5\FrostWire.exe" = C:\Program Files\FrostWire 5\FrostWire.exe:*:Enabled:FrostWire – (FrostWire)
"C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe" = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater – ()
"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe" = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare – ()
"C:\Program Files\Microsoft Games\Age of Empires II\age2_x1\age2_x1.icd" = C:\Program Files\Microsoft Games\Age of Empires II\age2_x1\age2_x1.icd:*:Enabled:Age of Empires II Expansion – (Microsoft Corporation)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster – ()


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}" = Notifier
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{073F22CE-9A5B-4A40-A604-C7270AC6BF34}" = ESSSONIC
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{154508C0-07C5-4659-A7A0-E49968750D21}" = HLPPDOCK
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java™ 6 Update 30
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353}" = OTtBPSDK
"{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}" = Google Earth
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{432C3720-37BF-4BD7-8E49-F38E090246D0}" = CR2
"{446DBFFA-4088-48E3-8932-74316BA4CAE4}" = iTunes
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54C8FE84-89C4-40E8-976C-439EB0729BD6}" = CardRd81
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{80E4B2D6-BFF2-402C-96C4-3942DF24CABB}_is1" = FVD Suite 2.6.9
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{87843A41-7808-4F2E-B13F-25C1E67CF2FD}" = ESShelp
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{91CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}" = ESScore
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{ABEB838C-A1A7-4C5D-B7E1-8B4314600816}" = MSN Messenger 7.0
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.4)
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}" = KSU
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1973749-F5E7-40EB-B528-F2B78685B9FF}" = essvcpt
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{E0A96F36-D546-4A2A-BDAA-2A2A578B2C0D}" = Bonjour
"{E82A57BC-E9B8-42F9-BDC7-4950BD73EA32}_is1" = Pazera Free FLV to AVI Converter 1.4
"{E9F81423-211E-46B6-9AE0-38568BC5CF6F}" = Alcohol 120% (Trial Version)
"{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}" = kgcbase
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F6FCC591-A21B-47C7-BCB3-F535FBA210E2}" = SLOW-PCfighter
"{F71760CD-0F8B-4DCC-B7B7-6B223CC3843C}" = OTtBP
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"{FDF9943A-3D5C-46B3-9679-586BD237DDEE}" = SKIN0001
"Active@ Data CD/DVD Burner v 2.0" = Active@ Data CD/DVD Burner v 2.0
"Adobe Atmosphere Player" = Adobe Atmosphere Player for Acrobat and Adobe Reader
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AdobeESD" = Adobe Download Manager 1.2 (Remove Only)
"Age of Empires 2.0" = Microsoft Age of Empires II
"Age of Empires Gold 1.0" = Microsoft Age of Empires Gold
"Age of Empires II: The Conquerors Expansion 1.0" = Microsoft Age of Empires II: The Conquerors Expansion
"ArcSoft Camera Suite" = ArcSoft Camera Suite
"AvantBrowser" = Avant Browser (remove only)
"Belarc Advisor 2.0" = Belarc Advisor 7.1
"Burn4Free CD & DVD_is1" = Burn4Free CD & DVD [removed]
"Burn4Free DVD Burning_is1" = Burn4Free DVD Burning [removed]
"CXT1059" = Broadxent V.92 PCI DI3631-1
"doPDF 7 printer_is1" = doPDF 7.3 printer
"Enigma Browser" = Enigma Browser (remove only)
"ExpressBurn" = Express Burn Disc Burning Software
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 5.0.15.706
"FrostWire 5" = FrostWire 5.3.7
"Hamster Free Video Converter_is1" = HamsterFreeVideoConverter
"HijackThis" = HijackThis 1.99.1
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{E0A96F36-D546-4A2A-BDAA-2A2A578B2C0D}" = Bonjour
"IrfanView" = IrfanView (remove only)
"KONICA MINOLTA magicolor 2400W" = KONICA MINOLTA magicolor 2400W
"KONICA MINOLTA PagePro 1350W" = KONICA MINOLTA PagePro 1350W
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MOV Converter 3" = MOV Converter 3
"Mozilla (1.7.8)" = Mozilla (1.7.8)
"Mozilla Firefox 10.0.2 (x86 en-US)" = Mozilla Firefox 10.0.2 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSN Music Assistant" = MSN Music Assistant
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Display Driver" = NVIDIA Display Driver
"NVIDIAnForce" = NVIDIA Windows 2000/XP nForce Drivers
"Opera" = Opera
"RealPlayer 6.0" = RealPlayer
"RiseOfNationsExpansion 1.0" = Rise of Nations
"Search Toolbar" = Search Toolbar
"TeamSpeak 2 RC2_is1" = TeamSpeak 2 RC2
"TOPO!" = TOPO!
"vfd-ob" = VideoFileDownload
"VLC media player" = VLC media player 0.9.8a
"WIC" = Windows Imaging Component
"Window Washer" = Window Washer
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR 4.01 (32-bit)
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"WordWeb" = WordWeb
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Anti-Spy" = Yahoo! Anti-Spy
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Customizations" = Yahoo! extras
"Yahoo! Internet Mail" = Yahoo! Internet Mail
"Yahoo! Mail AutoComplete" = Yahoo! Address AutoComplete
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Messenger Explorer Bar" = Yahoo! Messenger Explorer Bar
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 9/8/2012 3:05:55 PM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application wweb32.exe, version 4.0.0.0, faulting module
unknown, version 0.0.0.0, fault address 0x080e0801.

Error - 9/8/2012 3:05:56 PM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application wweb32.exe, version 4.0.0.0, faulting module
unknown, version 0.0.0.0, fault address 0x080e0801.

Error - 9/8/2012 3:05:57 PM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application wweb32.exe, version 4.0.0.0, faulting module
unknown, version 0.0.0.0, fault address 0xcccccc00.

Error - 9/8/2012 3:05:57 PM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application wweb32.exe, version 4.0.0.0, faulting module
unknown, version 0.0.0.0, fault address 0x3b74468b.

Error - 9/8/2012 3:05:58 PM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application wweb32.exe, version 4.0.0.0, faulting module
unknown, version 0.0.0.0, fault address 0x5b184889.

Error - 9/8/2012 3:05:58 PM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application wweb32.exe, version 4.0.0.0, faulting module
unknown, version 0.0.0.0, fault address 0x80202040.

Error - 9/8/2012 3:05:59 PM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application wweb32.exe, version 4.0.0.0, faulting module
unknown, version 0.0.0.0, fault address 0x39000002.

Error - 9/8/2012 3:05:59 PM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application wweb32.exe, version 4.0.0.0, faulting module
unknown, version 0.0.0.0, fault address 0xeb01c883.

Error - 9/8/2012 3:06:00 PM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application wweb32.exe, version 4.0.0.0, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.

Error - 9/9/2012 8:15:56 PM | Computer Name = PH | Source = Application Hang | ID = 1002
Description = Hanging application EasyShare.exe, version 5.3.33.27, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 9/9/2012 10:49:29 AM | Computer Name = PH | Source = Service Control Manager | ID = 7022
Description = The Bonjour Service service hung on starting.

Error - 9/9/2012 8:02:57 PM | Computer Name = PH | Source = Service Control Manager | ID = 7000
Description = The GoldrushUSB service failed to start due to the following error:
%%1058

Error - 9/9/2012 8:02:57 PM | Computer Name = PH | Source = Service Control Manager | ID = 7000
Description = The SVKP service failed to start due to the following error: %%2

Error - 9/9/2012 8:03:00 PM | Computer Name = PH | Source = nvidesm | ID = 262153
Description = The device, \Device\Scsi\nvidesm1, did not respond within the timeout
period.

Error - 9/9/2012 8:03:00 PM | Computer Name = PH | Source = nvidesm | ID = 262153
Description = The device, \Device\Scsi\nvidesm1, did not respond within the timeout
period.

Error - 9/9/2012 8:04:23 PM | Computer Name = PH | Source = Service Control Manager | ID = 7022
Description = The Bonjour Service service hung on starting.

Error - 9/10/2012 5:45:41 AM | Computer Name = PH | Source = nvidesm | ID = 262153
Description = The device, \Device\Scsi\nvidesm1, did not respond within the timeout
period.

Error - 9/10/2012 5:45:54 AM | Computer Name = PH | Source = Service Control Manager | ID = 7000
Description = The GoldrushUSB service failed to start due to the following error:
%%1058

Error - 9/10/2012 5:45:54 AM | Computer Name = PH | Source = Service Control Manager | ID = 7000
Description = The SVKP service failed to start due to the following error: %%2

Error - 9/10/2012 5:47:20 AM | Computer Name = PH | Source = Service Control Manager | ID = 7022
Description = The Bonjour Service service hung on starting.


< End of report >

Hello JonTom,

It LQQKs like we are making progress

Logs to follow:
OTL log [aka 09112012_172147.log]
and
mbam-log-2012-09-11 (18-24-15).txt
###############################################################################



All processes killed
========== OTL ==========
No active process named explorer.exe was found!
Service MsaSvc stopped successfully!
Service MsaSvc deleted successfully!
File C:\WINDOWS\system32\msasvc.exe not found.
Service SVKP stopped successfully!
Service SVKP deleted successfully!
File C:\WINDOWS\system32\SVKP.sys not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA0454C5-FD30-428E-8DB9-3FF87A612F64}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BA0454C5-FD30-428E-8DB9-3FF87A612F64}\ deleted successfully.
C:\Program Files\OpenApp\bho_project.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{4528BBE0-4E08-11D5-AD55-00010333D0AD}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4528BBE0-4E08-11D5-AD55-00010333D0AD}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{4528BBE0-4E08-11D5-AD55-00010333D0AD}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4528BBE0-4E08-11D5-AD55-00010333D0AD}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\free\ deleted successfully.
Starting removal of ActiveX control {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}
C:\WINDOWS\Downloaded Program Files\QTPlugin.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\ not found.
Starting removal of ActiveX control {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
C:\Program Files\GUM6F.tmp deleted successfully.
C:\Program Files\GUM72.tmp\GoogleCrashHandler.exe deleted successfully.
C:\Program Files\GUM72.tmp\GoogleCrashHandler64.exe deleted successfully.
C:\Program Files\GUM72.tmp\GoogleUpdate.exe deleted successfully.
C:\Program Files\GUM72.tmp\GoogleUpdateBroker.exe deleted successfully.
C:\Program Files\GUM72.tmp\GoogleUpdateHelper.msi deleted successfully.
C:\Program Files\GUM72.tmp\GoogleUpdateOnDemand.exe deleted successfully.
C:\Program Files\GUM72.tmp\GoogleUpdateSetup.exe deleted successfully.
C:\Program Files\GUM72.tmp\goopdate.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_am.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_ar.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_bg.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_bn.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_ca.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_cs.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_da.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_de.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_el.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_en-GB.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_en.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_es-419.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_es.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_et.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_fa.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_fi.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_fil.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_fr.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_gu.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_hi.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_hr.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_hu.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_id.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_is.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_it.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_iw.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_ja.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_kn.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_ko.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_lt.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_lv.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_ml.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_mr.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_ms.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_nl.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_no.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_pl.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_pt-BR.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_pt-PT.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_ro.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_ru.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_sk.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_sl.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_sr.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_sv.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_sw.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_ta.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_te.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_th.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_tr.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_uk.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_ur.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_vi.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_zh-CN.dll deleted successfully.
C:\Program Files\GUM72.tmp\goopdateres_zh-TW.dll deleted successfully.
C:\Program Files\GUM72.tmp\npGoogleUpdate3.dll deleted successfully.
C:\Program Files\GUM72.tmp\psmachine.dll deleted successfully.
C:\Program Files\GUM72.tmp\psuser.dll deleted successfully.
C:\Program Files\GUM72.tmp folder deleted successfully.
C:\Program Files\GUT73.tmp deleted successfully.
C:\WINDOWS\005775_.tmp deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:CEF69E3D deleted successfully.
========== FILES ==========
C:\Program Files\OpenApp\chromeaddon folder moved successfully.
C:\Program Files\OpenApp folder moved successfully.
C:\torrent.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Kids
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 42928728 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Non-Admin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: Peter
->Temp folder emptied: 165043 bytes
->Temporary Internet Files folder emptied: 386023 bytes
->Java cache emptied: 13586 bytes
->FireFox cache emptied: 513958805 bytes
->Google Chrome cache emptied: 194866336 bytes
->Flash cache emptied: 217607 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 452 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 175480960 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1584285 bytes

Total Files Cleaned = 887.00 mb


[EMPTYFLASH]

User: All Users

User: Default User

User: Kids

User: LocalService

User: NetworkService

User: Non-Admin

User: Peter
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.61.3 log created on 09112012_172147

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\Peter\Local Settings\Temp\Temporary Internet Files\Content.IE5\2K2L6JFU\piFuBkxUPRZsL6iGvxeUDaCuvyqGQsCoaPsMbSg4Dro1eR3hmY8mIi4yYxt4lmF0uv8GcxuIX4E
XlOk7WZPhUdcWq.N_Q2kCZ_TG3vgqVcDPDrNxbppKPwnmviUq0EqDPb_cDpyTh_960ePxH.YUyUQjDKX9
EaLLn9BeWv9mIDWAE[1].jpg not found!

PendingFileRenameOperations files…

Registry entries deleted on Reboot…









###############################################################################











Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Database version: v2012.09.11.08

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Peter :: PH [administrator]

9/11/2012 6:24:15 PM
mbam-log-2012-09-11 (18-24-15).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 227806
Time elapsed: 15 minute(s), 25 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{de4e75d3-60aa-4f02-a0e4-c8a40576574c} (PUP.FCTPlugin) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{de4e75d3-60aa-4f02-a0e4-c8a40576574c} (PUP.FCTPlugin) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Google\Chrome\Extensions\kincjchfokkeneeofpeefomkikfkiedl (PUP.FCTPlugin) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 1
C:\Program Files\TSearch (Adware.TSearch) -> Quarantined and deleted successfully.

Files Detected: 3
C:\Documents and Settings\Peter\My Documents\Downloads\burn4free_setup.exe (PUP.BundleInstaller.BI) -> Quarantined and deleted successfully.
C:\Documents and Settings\Peter\Local Settings\TempDIR\BetterInstaller.exe (PUP.BundleInstaller.Somoto) -> Quarantined and deleted successfully.
C:\Program Files\TSearch\results (Adware.TSearch) -> Quarantined and deleted successfully.

(end)