Solved computer taken over by by virus

broni · 2010/07/16

Excellent job

Let me re-read our topic to see what's next.

broni · 2010/07/16

How is computer doing at the moment?

Delete your GMER file, download fresh one and post new log.

Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
Alternative downloads:
- http://majorgeeks.com/GMER_d5198.html
- http://www.softpedia.com/get/Interne...ers/GMER.shtml
Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
Do NOT use the computer while GMER is running!
When scan is completed, click Save button, and save the results as gmer.log
Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

RickyD2 · 2010/07/16

Computer seems fine but you have sure had me wading in strange new waters.

Here is GMER Log -

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-07-16 15:46:21
Windows 5.1.2600 Service Pack 3
Running: lzrdko4u.exe; Driver: C:\DOCUME~1\RICHAR~1.HOM\LOCALS~1\Temp\ugtdifod.sys

---- System - GMER 1.0.15 ----

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0xEFB55B9C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0xEFB559C0]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0xEFB55AFA]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Fastfat \Fat aswSP.SYS (avast! self protection module/ALWIL Software)

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- EOF - GMER 1.0.15 ----

broni · 2010/07/16

I'm glad to hear good news
GMER log looks perfect

you have sure had me wading in strange new waters
Click to expand...

Hahaha....

Download OTL to your Desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* Under the Custom Scan box paste this in:

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\*. /mp /s
/md5start
/md5stop
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

* Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

RickyD2 · 2010/07/16

OTL logfile created on: 7/16/2010 4:07:11 PM - Run 1
OTL by OldTimer - Version 3.2.9.0 Folder = C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 85.00 Mb Available Physical Memory | 17.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 38.27 Gb Total Space | 13.87 Gb Free Space | 36.23% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME-KVJPCI4PIU
Current User Name: Richard Doenges
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/07/16 15:55:48 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\OTL.exe
PRC - [2010/06/28 15:57:18 | 002,837,864 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/06/28 15:57:16 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2009/04/26 14:29:24 | 000,090,352 | ---- | M] (PC Pitstop LLC) -- C:\Program Files\PCPitstop\PCPitstopScheduleService.exe
PRC - [2009/04/08 13:44:32 | 018,480,224 | ---- | M] (Firetrust Ltd) -- C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
PRC - [2009/01/14 17:53:02 | 000,226,656 | ---- | M] (Microsoft Corp.) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2008/04/14 05:42:30 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Outlook Express\msimn.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/11/03 19:20:12 | 000,866,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2006/03/30 09:15:44 | 000,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2003/01/28 13:42:04 | 000,262,144 | ---- | M] (Executive Software International, Inc.) -- C:\Program Files\Executive Software\Diskeeper Home Edition\DKService.exe
PRC - [2002/07/15 16:36:54 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
PRC - [2001/08/17 22:36:54 | 000,086,016 | ---- | M] (PCtel, Inc.) -- C:\WINDOWS\system32\pctspk.exe

========== Modules (SafeList) ==========

MOD - [2010/07/16 15:55:48 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\OTL.exe
MOD - [2008/04/14 05:40:22 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - [2010/06/28 15:57:16 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/06/28 15:57:16 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/06/28 15:57:16 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/04/28 07:44:02 | 000,704,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2010/03/29 08:51:54 | 000,068,000 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2009/04/26 14:29:24 | 000,090,352 | ---- | M] (PC Pitstop LLC) [Auto | Running] -- C:\Program Files\PCPitstop\PCPitstopScheduleService.exe -- (PCPitstop Scheduling)
SRV - [2009/01/14 17:53:02 | 000,226,656 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV - [2006/03/30 09:15:44 | 000,096,341 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2003/03/09 15:31:02 | 000,065,795 | R--- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2003/01/28 13:42:04 | 000,262,144 | ---- | M] (Executive Software International, Inc.) [Auto | Running] -- C:\Program Files\Executive Software\Diskeeper Home Edition\DKService.exe -- (Diskeeper)
SRV - [2002/07/15 16:36:54 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))
SRV - [2001/08/17 22:36:54 | 000,086,016 | ---- | M] (PCtel, Inc.) [Auto | Running] -- C:\WINDOWS\system32\pctspk.exe -- (Pctspk)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2010/06/28 15:37:52 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/06/28 15:37:30 | 000,165,456 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/06/28 15:33:14 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/06/28 15:32:46 | 000,100,176 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/06/28 15:32:34 | 000,017,744 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/06/28 15:32:16 | 000,028,880 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2010/04/28 07:44:02 | 000,054,760 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)
DRV - [2010/04/23 19:14:58 | 000,095,024 | ---- | M] (Sunbelt Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\SBREDrv.sys -- (SBRE)
DRV - [2008/02/27 13:49:00 | 000,003,840 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\BANTExt.sys -- (BANTExt)
DRV - [2007/11/13 16:06:50 | 000,441,760 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\timntr.sys -- (timounter)
DRV - [2007/11/13 16:06:50 | 000,044,384 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)
DRV - [2005/02/23 14:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)
DRV - [2004/10/07 19:16:04 | 000,035,840 | ---- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K)
DRV - [2004/08/03 23:29:26 | 000,701,440 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2002/01/24 11:23:40 | 000,013,545 | ---- | M] (SCM Microsystems Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\STLTRK2K.sys -- (Stltrk2k)
DRV - [2001/08/17 13:28:16 | 000,397,502 | ---- | M] (PCtel, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vpctcom.sys -- (Vpctcom)
DRV - [2001/08/17 13:28:16 | 000,064,605 | ---- | M] (PCtel, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vvoice.sys -- (Vvoice)
DRV - [2001/08/17 13:28:14 | 000,604,253 | ---- | M] (PCTEL, INC.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vmodem.sys -- (Vmodem)
DRV - [2001/08/17 13:28:14 | 000,112,574 | ---- | M] (PCTEL, INC.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptserlp.sys -- (Ptserlp)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

O1 HOSTS File: ([2010/07/16 15:16:52 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE (Dale Nurden)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Start Menu\Programs\Startup\MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe (Firetrust Ltd)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSharedDocuments = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoThumbnailCache = 0
O9 - Extra Button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - Reg Error: Key error. File not found
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6087.cab (Windows Live Safety Center Base Module)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 76.85.229.110 76.85.229.111
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/03/16 21:31:28 | 000,000,024 | -HS- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: MIDI1 - C:\WINDOWS\System32\Syncor11.dll (SoundMAX)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.ac3acm - C:\WINDOWS\System32\AC3ACM.acm (fccHandler)
Drivers32: msacm.alf2cd - C:\WINDOWS\System32\alf2cd.acm (NCT Company)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.scg726 - C:\WINDOWS\System32\Scg726.acm (SHARP Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.dvsd - C:\WINDOWS\System32\mcdvd_32.dll (MainConcept)
Drivers32: vidc.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mp42 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mp43 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mpg4 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.WMV3 - C:\WINDOWS\System32\wmv9vcm.dll (Microsoft Corporation)
Drivers32: vidc.xvid - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (56590081070202880)

========== Files/Folders - Created Within 90 Days ==========

[2010/07/16 15:55:45 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\OTL.exe
[2010/07/16 15:42:48 | 000,000,000 | -HSD | C] -- C:\Recycled
[2010/07/16 15:15:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/07/16 14:24:16 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/07/15 19:52:03 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/07/15 19:52:01 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/07/15 19:10:52 | 000,000,000 | ---D | C] -- C:\FOUND.002
[2010/07/12 20:40:33 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/07/12 20:40:33 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/07/12 20:40:33 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/07/12 20:40:10 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/07/11 15:20:36 | 000,000,000 | ---D | C] -- C:\Program Files\Uniblue
[2010/07/10 19:31:44 | 000,000,000 | R-SD | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\My Stationery
[2010/07/10 19:18:11 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2010/07/10 19:17:00 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Sync Framework
[2010/07/10 19:15:59 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SQL Server Compact Edition
[2010/07/10 19:14:59 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft
[2010/07/10 19:14:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Documents\microsoft
[2010/07/10 19:14:39 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live SkyDrive
[2010/07/10 19:14:12 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2010/07/10 19:04:59 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live
[2010/07/10 16:29:20 | 000,017,744 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/07/10 16:29:18 | 000,165,456 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010/07/10 16:29:11 | 000,023,376 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/07/10 16:29:04 | 000,046,672 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/07/10 16:28:57 | 000,100,176 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/07/10 16:28:57 | 000,094,544 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010/07/10 16:28:56 | 000,028,880 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/07/10 16:24:52 | 000,038,848 | ---- | C] (ALWIL Software) -- C:\WINDOWS\avastSS.scr
[2010/07/10 16:24:22 | 000,165,032 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010/07/10 16:22:55 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010/07/10 16:22:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Alwil Software
[2010/07/09 22:58:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Local Settings\Application Data\Threat Expert
[2010/07/09 22:39:20 | 000,000,000 | ---D | C] -- C:\FOUND.001
[2010/07/09 15:08:00 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Doctor
[2010/07/09 14:18:08 | 000,000,000 | ---D | C] -- C:\0ff30b331f6ef8766e8e82859b84f973
[2010/07/09 12:10:56 | 000,000,000 | ---D | C] -- C:\FOUND.000
[2010/06/30 17:25:08 | 001,013,584 | ---- | C] (Kaspersky Lab) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\TDSSKiller.exe
[2010/06/16 00:12:18 | 000,000,000 | ---D | C] -- C:\Program Files\IE New Window Maximizer
[2010/05/27 15:02:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Jennifer Harman's family
[2010/05/27 14:58:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Miscellaneous stuff
[2010/05/24 16:02:16 | 000,000,000 | ---D | C] -- C:\Program Files\SIW
[2010/05/24 10:49:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\ForceField Shared Files
[2010/05/19 16:32:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Local Settings\Application Data\DYMO
[2010/05/19 16:28:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\DYMO
[2010/05/19 15:17:08 | 000,418,304 | ---- | C] (DYMO Corp.) -- C:\WINDOWS\System32\DYMOSmartPaste.dll
[2010/05/17 12:16:05 | 000,000,000 | ---D | C] -- C:\Program Files\CheckPoint
[2010/05/17 12:09:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\Internet Logs
[2010/05/17 08:50:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
[2010/05/16 13:23:01 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/05/14 23:13:41 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/05/14 19:36:38 | 000,000,000 | ---D | C] -- C:\7a9f938b3d43a523dbb663
[2010/05/14 18:34:00 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\HiJackThis.exe
[2010/05/14 16:20:39 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Recent
[2010/05/14 15:36:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\ElevatedDiagnostics
[2010/05/14 15:21:21 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\windowspowershell
[2010/05/14 12:13:46 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live Safety Center
[2010/05/14 10:48:50 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/05/14 10:44:12 | 001,321,120 | ---- | C] (Avanquest ) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\pccleaner.exe
[2010/05/10 17:45:30 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/05/10 16:20:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Applications
[2010/04/29 12:42:14 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2010/04/26 16:57:19 | 000,000,000 | ---D | C] -- C:\2167da7775d242252848
[2010/04/23 19:14:58 | 000,095,024 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/04/23 19:07:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Local Settings\Application Data\Sunbelt Software
[2010/04/23 14:08:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\avg9
[1 C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\*.tmp files -> C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/07/16 15:55:48 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\OTL.exe
[2010/07/16 15:45:40 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\lzrdko4u.exe
[2010/07/16 15:44:08 | 000,000,442 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{9913872E-C5A8-4D8F-83A3-237CEECEEC63}.job
[2010/07/16 15:19:48 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/07/16 15:18:42 | 000,013,738 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/07/16 15:17:34 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/07/16 15:17:16 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/07/16 15:16:22 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/07/16 14:10:00 | 013,369,344 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\ntuser.dat
[2010/07/16 14:10:00 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\ntuser.ini
[2010/07/16 12:05:02 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/07/16 11:45:44 | 003,738,072 | R--- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\ComboFix.exe
[2010/07/16 11:45:02 | 000,000,526 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\Shortcut to CFScript.lnk
[2010/07/15 19:52:06 | 000,000,600 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/15 18:51:42 | 000,000,525 | ---- | M] () -- C:\hpfr3420.xml
[2010/07/15 14:10:02 | 000,000,495 | -H-- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\hpothb07.tif
[2010/07/15 14:10:02 | 000,000,367 | -H-- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\hpothb07.dat
[2010/07/15 12:40:18 | 535,707,648 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2010/07/12 21:14:00 | 000,449,043 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\RegSeeker.zip
[2010/07/11 13:36:42 | 000,509,392 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/07/11 13:36:42 | 000,433,326 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/07/11 13:36:42 | 000,067,980 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/07/11 13:31:14 | 000,124,520 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/07/10 19:15:54 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/07/10 19:14:28 | 000,019,760 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/07/10 16:29:38 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\avast! Free Antivirus.lnk
[2010/07/10 16:29:00 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/07/10 12:16:14 | 000,002,221 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\FixCleaner.lnk
[2010/07/10 00:17:30 | 000,000,623 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/07/10 00:17:30 | 000,000,306 | RHS- | M] () -- C:\boot.ini
[2010/07/05 15:43:22 | 000,000,199 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Document.rtf
[2010/07/02 22:28:32 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/07/02 20:35:04 | 000,001,633 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Adobe Reader 9.lnk
[2010/07/02 19:29:40 | 000,001,429 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Microsoft\Internet Explorer\Quick Launch\Notepad.lnk
[2010/06/30 17:25:08 | 001,013,584 | ---- | M] (Kaspersky Lab) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\TDSSKiller.exe
[2010/06/28 15:57:34 | 000,038,848 | ---- | M] (ALWIL Software) -- C:\WINDOWS\avastSS.scr
[2010/06/28 15:57:12 | 000,165,032 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010/06/28 15:37:52 | 000,046,672 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/06/28 15:37:30 | 000,165,456 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010/06/28 15:33:14 | 000,023,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/06/28 15:32:46 | 000,100,176 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/06/28 15:32:42 | 000,094,544 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010/06/28 15:32:34 | 000,017,744 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/06/28 15:32:16 | 000,028,880 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/06/15 12:50:00 | 000,033,749 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Cheryl.jpg
[2010/05/27 15:08:54 | 000,000,202 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\Shortcut to Dymo LabelWriter Turbo.lnk
[2010/05/25 12:42:58 | 000,019,456 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\RODALE BOOKS.doc
[2010/05/25 12:32:52 | 000,002,473 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\Microsoft Word.lnk
[2010/05/24 16:02:22 | 000,000,514 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\SIW.lnk
[2010/05/24 15:15:34 | 000,167,798 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\ESET Online Scanner.mht
[2010/05/22 14:23:52 | 000,024,064 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Letter to Canon 5-24-2010.doc
[2010/05/22 14:12:34 | 000,002,491 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word.lnk
[2010/05/22 12:12:46 | 000,092,879 | ---- | M] () -- C:\Spophia.jpg
[2010/05/19 16:34:34 | 000,000,036 | ---- | M] () -- C:\WINDOWS\iltwain.ini
[2010/05/19 16:04:14 | 000,000,056 | ---- | M] () -- C:\WINDOWS\Addrfixr.ini
[2010/05/19 14:57:22 | 000,001,390 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\Calculator.lnk
[2010/05/18 23:23:32 | 000,558,670 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\YouTube - The Beatles, in Hey Jude.mht
[2010/05/14 18:33:20 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\HiJackThis.exe
[2010/05/14 10:49:16 | 000,001,452 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\CCleaner.lnk
[2010/05/14 10:44:06 | 001,321,120 | ---- | M] (Avanquest ) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\pccleaner.exe
[2010/05/13 00:19:58 | 000,002,794 | ---- | M] () -- C:\WINDOWS\Solitaire.ini
[2010/05/10 22:51:26 | 000,000,719 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/29 13:44:30 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/26 15:58:14 | 000,256,512 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2010/04/23 19:14:58 | 000,095,024 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/04/22 11:50:34 | 002,908,213 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Parker&Kloey Easter2010.JPG
[1 C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\*.tmp files -> C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/16 15:45:36 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\lzrdko4u.exe
[2010/07/16 11:45:00 | 000,000,526 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\Shortcut to CFScript.lnk
[2010/07/15 19:52:05 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/15 18:38:00 | 003,738,072 | R--- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\ComboFix.exe
[2010/07/12 20:40:33 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/07/12 20:40:33 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/07/12 20:40:33 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/07/12 20:40:33 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/07/12 20:40:33 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/07/11 15:51:12 | 000,449,043 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\RegSeeker.zip
[2010/07/10 19:15:52 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010/07/10 19:13:36 | 000,000,330 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/07/10 16:29:36 | 000,001,604 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\avast! Free Antivirus.lnk
[2010/07/05 15:43:19 | 000,000,199 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Document.rtf
[2010/05/27 15:08:53 | 000,000,202 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\Shortcut to Dymo LabelWriter Turbo.lnk
[2010/05/25 12:42:55 | 000,019,456 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\RODALE BOOKS.doc
[2010/05/24 16:02:20 | 000,000,514 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\SIW.lnk
[2010/05/24 15:15:29 | 000,167,798 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\ESET Online Scanner.mht
[2010/05/22 14:21:47 | 000,024,064 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Letter to Canon 5-24-2010.doc
[2010/05/22 12:14:48 | 000,092,879 | ---- | C] () -- C:\Spophia.jpg
[2010/05/18 23:23:29 | 000,558,670 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\YouTube - The Beatles, in Hey Jude.mht
[2010/05/14 12:10:09 | 000,000,442 | -H-- | C] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{9913872E-C5A8-4D8F-83A3-237CEECEEC63}.job
[2010/05/14 10:49:12 | 000,001,452 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\CCleaner.lnk
[2010/04/22 11:51:45 | 002,908,213 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Parker&Kloey Easter2010.JPG
[2009/03/26 23:27:13 | 000,003,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\BANTExt.sys
[2008/09/07 15:32:50 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\DYMOCFG.DLL
[2008/04/28 12:50:27 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008/04/28 12:50:27 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008/01/28 15:47:44 | 000,000,124 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2007/12/20 16:12:57 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\hndlt.ini
[2007/11/29 16:30:28 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2007/11/29 14:33:50 | 000,796,048 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2007/11/28 15:52:32 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2007/11/23 16:35:41 | 000,000,094 | ---- | C] () -- C:\WINDOWS\MusicRip.ini
[2007/08/08 12:02:13 | 002,463,976 | ---- | C] () -- C:\WINDOWS\System32\NPSWF32.dll
[2007/02/14 12:45:44 | 000,000,063 | ---- | C] () -- C:\WINDOWS\mdm.ini
[2007/02/13 15:34:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2006/11/13 10:07:22 | 000,000,044 | ---- | C] () -- C:\WINDOWS\liveup.ini
[2006/08/24 23:31:22 | 000,002,794 | ---- | C] () -- C:\WINDOWS\Solitaire.ini
[2006/01/17 23:07:40 | 000,000,056 | ---- | C] () -- C:\WINDOWS\Addrfixr.ini
[2006/01/17 23:07:40 | 000,000,036 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2006/01/17 23:00:14 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/01/15 16:52:43 | 000,000,026 | ---- | C] () -- C:\WINDOWS\DfrgUIEx.INI
[2006/01/15 15:21:34 | 000,561,152 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[2006/01/15 13:29:17 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\msssc.dll
[2004/08/04 01:56:42 | 000,755,200 | ---- | C] () -- C:\WINDOWS\System32\ir50_32.dll
[2004/08/04 01:56:42 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\ir41_qcx.dll
[2004/08/04 01:56:42 | 000,200,192 | ---- | C] () -- C:\WINDOWS\System32\ir50_qc.dll
[2004/08/04 01:56:42 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\ir50_qcx.dll
[2004/08/04 01:56:42 | 000,120,320 | ---- | C] () -- C:\WINDOWS\System32\ir41_qc.dll
[2002/12/10 00:00:00 | 001,708,032 | ---- | C] () -- C:\WINDOWS\System32\MSO97V.DLL
[2002/12/10 00:00:00 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
[2002/12/10 00:00:00 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\MSORFS.DLL
[2002/12/10 00:00:00 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL
[1998/08/16 05:00:00 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\sysres.dll
[1998/05/14 00:00:00 | 000,116,736 | ---- | C] () -- C:\WINDOWS\System32\PCDLIB32.DLL

========== LOP Check ==========

[2006/06/04 14:32:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Viewpoint
[2006/11/15 19:14:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\WinZip
[2006/12/18 23:08:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\INAC
[2007/06/11 11:57:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
[2007/11/13 16:07:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Acronis
[2009/10/28 11:29:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\PCPitstop
[2009/10/28 16:17:00 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
[2010/04/23 14:08:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\avg9
[2010/05/10 16:20:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Applications
[2010/05/19 16:28:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\DYMO
[2010/07/10 16:22:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Alwil Software
[2006/01/15 16:08:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\MailWasherPro
[2006/01/15 16:50:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Leadertech
[2006/01/17 16:17:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Image Zone Express
[2006/04/14 11:44:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Allume Systems
[2006/06/26 14:12:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Simple Star
[2006/06/26 22:31:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Road Runner
[2006/07/28 15:34:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\GlobalSCAPE
[2006/12/18 23:08:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\INAC
[2007/07/02 12:20:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\CyberMatrix
[2007/07/02 12:26:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\WordWeb
[2007/07/25 11:51:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Uniblue
[2007/12/08 15:15:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\wsInspector
[2008/04/28 12:56:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\AVSMedia
[2008/07/25 23:20:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/05/17 15:40:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\VersionTracker Pro
[2009/10/08 11:48:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\CheckPoint
[2010/03/22 16:49:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\FixCleaner
[2010/05/14 15:36:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\ElevatedDiagnostics
[2010/07/16 15:19:48 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/07/16 15:44:08 | 000,000,442 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{9913872E-C5A8-4D8F-83A3-237CEECEEC63}.job
[2007/01/20 23:30:34 | 000,000,362 | ---- | M] () -- C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1137559368.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[1999/04/23 22:22:00 | 000,222,390 | RHS- | M] () -- C:\IO.SYS
[1999/04/23 22:22:00 | 000,000,009 | RHS- | M] () -- C:\MSDOS.SYS
[1999/04/23 22:22:00 | 000,093,890 | -HS- | M] () -- C:\COMMAND.COM
[1999/04/23 22:22:00 | 000,068,871 | RHS- | M] () -- C:\DRVSPACE.BIN
[1993/04/21 00:12:00 | 000,025,377 | ---- | M] () -- C:\MSCDEX.EXE
[2001/03/16 21:31:28 | 000,000,041 | -HS- | M] () -- C:\CONFIG.SYS
[2001/03/16 21:31:28 | 000,000,024 | -HS- | M] () -- C:\AUTOEXEC.BAT
[2006/01/05 15:23:42 | 000,000,102 | -HS- | M] () -- C:\BOOTLOG.PRV
[2006/01/06 01:23:30 | 000,000,102 | -HS- | M] () -- C:\BOOTLOG.TXT
[2010/07/10 00:17:30 | 000,000,306 | RHS- | M] () -- C:\boot.ini
[2009/10/08 11:46:56 | 000,001,207 | ---- | M] () -- C:\INSTALL.LOG
[2006/01/05 15:34:26 | 000,000,512 | -HS- | M] () -- C:\bootsect.dos
[2010/07/15 18:51:42 | 000,531,186 | ---- | M] () -- C:\hpfr3425.log
[2010/07/15 18:51:42 | 000,000,525 | ---- | M] () -- C:\hpfr3420.xml
[2010/07/16 15:16:14 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys
[2010/07/16 15:23:00 | 000,013,916 | ---- | M] () -- C:\ComboFix.txt
[2006/08/02 14:47:04 | 000,001,786 | ---- | M] () -- C:\serial.txt
[2007/03/25 00:11:34 | 000,027,433 | ---- | M] () -- C:\2007-03-25_001122.png
[2007/11/25 01:46:50 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2006/07/26 20:45:04 | 000,000,150 | ---- | M] () -- C:\YServer.txt
[2006/08/02 14:47:04 | 000,000,354 | ---- | M] () -- C:\key.reg
[2006/08/02 11:03:58 | 000,000,617 | ---- | M] () -- C:\sm.dat
[2007/09/08 21:47:42 | 000,005,868 | ---- | M] () -- C:\logfile
[2006/09/11 15:12:58 | 002,171,971 | ---- | M] () -- C:\Ashleys Car.jpg
[2006/02/03 10:20:36 | 001,951,432 | ---- | M] (Microsoft Corporation) -- C:\ppviewer.exe
[2006/02/03 10:23:54 | 048,909,288 | ---- | M] (Microsoft Corporation) -- C:\msprod2.exe
[2006/02/03 10:30:24 | 002,855,552 | ---- | M] (Microsoft Corporation) -- C:\ppview97.exe
[2007/02/03 11:12:42 | 000,098,672 | ---- | M] () -- C:\memtest.bin
[2008/07/28 22:29:22 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2006/02/05 14:29:20 | 000,000,085 | ---- | M] () -- C:\FixBmalE.log
[2006/09/11 15:13:14 | 001,802,530 | ---- | M] () -- C:\Ashleys Car #2.jpg
[2006/09/11 15:13:28 | 001,297,580 | ---- | M] () -- C:\Ashleys Car #3.jpg
[2006/09/11 15:13:48 | 001,176,883 | ---- | M] () -- C:\Ashleys Car #4.jpg
[2006/09/11 15:14:06 | 001,864,816 | ---- | M] () -- C:\Ashleys Car with Poopers.jpg
[2007/01/27 11:35:10 | 000,514,872 | ---- | M] (Microsoft Corporation) -- C:\WindowsXP-KB928388-x86-ENU.exe
[2007/09/08 13:25:52 | 000,328,423 | ---- | M] () -- C:\!cid_910899F05B5711DC9BD0904C58F39026@snj-us-pcwp-701.kodak[1]
[2005/02/16 11:06:16 | 000,218,112 | ---- | M] (Soeperman Enterprises Ltd.) -- C:\HijackThis.exe
[2007/09/12 14:37:22 | 000,604,700 | ---- | M] () -- C:\Fw_ Fw_ SHE REALLY WAS A TRAITOR!!---Less we forget this].eml
[2007/09/17 19:30:50 | 000,083,942 | ---- | M] () -- C:\Shasta Adair wants to share Halloween photos with you.eml
[2007/11/19 15:30:40 | 000,231,390 | ---- | M] () -- C:\RootkitRevealer.zip
[2007/11/19 15:18:44 | 008,646,776 | ---- | M] (Microsoft Corporation) -- C:\Windows-KB890830-V1.35.exe
[2006/11/01 13:07:06 | 000,334,720 | ---- | M] (Sysinternals - www.sysinternals.com) -- C:\RootkitRevealer.exe
[2007/11/21 18:41:30 | 000,063,507 | ---- | M] () -- C:\memtest33.zip
[2007/11/23 16:39:44 | 000,000,020 | -HS- | M] () -- C:\ArcDeviceInfo
[2006/08/05 23:51:10 | 000,000,456 | ---- | M] () -- C:\install_registry_richard_auto_login.reg
[2002/07/09 16:39:22 | 000,013,520 | ---- | M] (Microsoft Corporation) -- C:\LW300.drv
[2005/03/24 10:26:26 | 000,014,386 | ---- | M] () -- C:\lw300.gpd
[2005/03/24 10:26:08 | 000,014,386 | ---- | M] () -- C:\lw310.gpd
[2005/03/24 10:25:34 | 000,014,386 | ---- | M] () -- C:\lw315.gpd
[2005/03/24 10:15:42 | 000,022,494 | ---- | M] () -- C:\lw320.gpd
[2004/08/03 23:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr
[2005/03/24 10:15:20 | 000,022,494 | ---- | M] () -- C:\lw330.gpd
[2005/03/24 10:12:26 | 000,022,501 | ---- | M] () -- C:\lw330t.gpd
[2002/06/30 18:39:24 | 000,011,776 | ---- | M] (DYMO Corp.) -- C:\LW.dll
[2002/07/10 01:08:48 | 000,016,112 | ---- | M] (Microsoft Corporation) -- C:\LW.drv
[2000/02/01 20:22:36 | 000,000,039 | ---- | M] () -- C:\lw.ini
[2002/07/01 04:13:08 | 000,014,842 | ---- | M] () -- C:\lwel40.GPD
[2002/07/01 04:14:44 | 000,023,295 | ---- | M] () -- C:\lwel60.GPD
[2002/07/01 04:14:50 | 000,023,295 | ---- | M] () -- C:\lwelt.GPD
[2002/07/01 04:14:56 | 000,014,992 | ---- | M] () -- C:\lwxl.gpd
[2002/07/02 00:54:22 | 000,022,949 | ---- | M] () -- C:\lwxlp.gpd
[2002/07/02 00:54:38 | 000,022,950 | ---- | M] () -- C:\lwxlt.gpd
[2001/03/13 20:44:54 | 000,000,000 | ---- | M] () -- C:\print9x.cat
[2000/06/08 13:00:00 | 000,197,792 | ---- | M] (Microsoft Corporation) -- C:\unidrv.dll
[2000/06/08 05:00:00 | 000,019,116 | ---- | M] () -- C:\unidrv.hlp
[2000/06/08 06:00:00 | 000,028,672 | ---- | M] (Microsoft Corporation) -- C:\USBMON.DLL
[2005/03/15 12:30:58 | 000,000,874 | ---- | M] () -- C:\Usbprint.inf
[2000/06/08 06:00:00 | 000,022,640 | ---- | M] (Microsoft Corporation) -- C:\USBPRINT.SYS
[2000/05/19 07:33:46 | 000,025,198 | ---- | M] () -- C:\xl.GPD
[2000/05/19 07:33:46 | 000,049,216 | ---- | M] () -- C:\xlp.GPD
[2000/05/19 07:33:46 | 000,049,671 | ---- | M] () -- C:\xlt.GPD
[2000/06/08 13:00:00 | 000,118,144 | ---- | M] (Microsoft Corporation) -- C:\iconlib.dll
[2005/03/11 11:46:00 | 000,012,288 | ---- | M] (DYMO Corp.) -- C:\LW400.dll
[2005/03/21 11:25:40 | 000,006,656 | ---- | M] (DYMO) -- C:\LW400_UI.dll
[2005/03/17 14:40:48 | 000,032,768 | ---- | M] (DYMO Corp.) -- C:\lw400lm9.DLL
[2005/03/17 14:39:10 | 000,007,680 | ---- | M] (DYMO Corp.) -- C:\lw400mon.dll
[2004/11/02 14:15:04 | 000,000,070 | ---- | M] () -- C:\duo_d1.ini
[2005/01/27 10:49:50 | 000,000,069 | ---- | M] () -- C:\LW400.INI
[2005/03/21 08:15:56 | 000,015,056 | ---- | M] (Microsoft Corporation) -- C:\duo_d1.drv
[2005/03/17 14:08:38 | 000,010,368 | ---- | M] (Microsoft Corporation) -- C:\LW400.drv
[2004/11/23 21:48:40 | 000,013,645 | ---- | M] () -- C:\duo_d1.gpd
[2004/11/23 21:39:38 | 000,000,093 | ---- | M] () -- C:\duolw.gpd
[2004/11/02 14:08:06 | 000,000,087 | ---- | M] () -- C:\lw400.gpd
[2005/03/17 14:04:58 | 000,024,048 | ---- | M] () -- C:\lw400c.gpd
[2004/11/02 14:07:44 | 000,000,096 | ---- | M] () -- C:\lw400t.gpd
[2005/01/27 09:06:38 | 000,000,339 | ---- | M] () -- C:\lw400tt.gpd
[2005/03/14 13:01:50 | 000,016,759 | ---- | M] () -- C:\DUOD1DRV.HLP
[2005/03/21 07:29:54 | 000,015,360 | ---- | M] (DYMO) -- C:\duo_d1.dll
[2005/03/17 13:34:08 | 000,008,192 | ---- | M] (Microsoft Corporation) -- C:\duo_d1m9.DLL
[2005/03/18 07:45:06 | 000,007,680 | ---- | M] () -- C:\duo_d1mon.dll
[2005/03/21 11:25:20 | 000,006,656 | ---- | M] (DYMO) -- C:\DUO_D1UI.dll
[2010/04/23 11:01:16 | 000,086,684 | ---- | M] () -- C:\aaw7boot.log
[2010/04/08 11:47:46 | 000,000,236 | ---- | M] () -- C:\Boot.bak
[2009/04/22 23:26:02 | 000,106,548 | -H-- | M] () -- C:\ZbThumbnail.info
[2010/07/16 14:17:06 | 000,000,385 | ---- | M] () -- C:\rkill.log
[2010/07/15 20:37:00 | 000,034,090 | ---- | M] () -- C:\TDSSKiller.2.3.2.2_15.07.2010_20.36.20_log.txt
[2010/07/15 20:40:30 | 000,034,090 | ---- | M] () -- C:\TDSSKiller.2.3.2.2_15.07.2010_20.39.56_log.txt
[2010/03/02 13:38:12 | 163,121,891 | ---- | M] () -- C:\fix.ZIP
[2010/04/25 14:05:50 | 000,000,408 | ---- | M] () -- C:\CD3rdPartyWrapper.log
[2010/05/22 12:12:46 | 000,092,879 | ---- | M] () -- C:\Spophia.jpg

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2008/07/06 06:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2007/11/24 14:27:46 | 000,524,288 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2007/11/24 14:27:46 | 019,922,944 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2007/11/24 14:27:46 | 008,388,608 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
[2007/11/24 14:13:58 | 000,045,056 | ---- | M] () -- C:\WINDOWS\system32\config\security.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/14 05:42:10 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/14 05:42:12 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/14 05:42:12 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 -- C:\WINDOWS\system32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

< >

< >
< End of report >

RickyD2 · 2010/07/16

OTL Extras logfile created on: 7/16/2010 4:07:11 PM - Run 1
OTL by OldTimer - Version 3.2.9.0 Folder = C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 85.00 Mb Available Physical Memory | 17.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 38.27 Gb Total Space | 13.87 Gb Free Space | 36.23% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME-KVJPCI4PIU
Current User Name: Richard Doenges
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00170409-78E1-11D2-B60F-006097C998E7}" = Microsoft Word 2000
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{0DA76892-D849-422B-80D0-E4FC26009AB9}" = FixCleaner
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1BD07DF4-FB06-41BA-B896-B2DA59000C96}" = Windows Live Toolbar
"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 20
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B719A70-F14A-4f5c-90B5-346B24B7FFF1}" = Windows 7 Upgrade Advisor
"{5C74694C-A687-E3EB-FF18-B018D4A76ECD}" = Adobe Media Player
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6DCB031C-6BCE-4AEE-AAF8-5F14148D0803}" = Diskeeper Home Edition
"{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}" = HP Photo and Imaging 2.0 - All-in-One Drivers
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9867A917-5D17-40DE-83BA-BEA5293194B1}" = HP Photo and Imaging 2.0 - All-in-One
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A53AB160-8DC1-11D6-B494-008048C29C40}" = USB CF
"{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures
"{AB67580-257C-45FF-B8F4-C8C30682091A}_is1" = SIW version 2010.04.28
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B376402D-58EA-45EA-BD50-DD924EB67A70}" = HP Memories Disc
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BEB03A1A-1EB6-48EB-9985-8B97315EE5C0}" = RemoteCapture 2.7.0
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C900EF06-2E76-49C7-8DB0-41F629B21DC5}" = hp psc 1200 series
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BC}" = WinZip 14.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D92FF8EB-BD77-40AE-B68B-A6BFC6F8661D}" = Windows Live Family Safety
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
"{EF0DD8B7-471C-463B-A298-6066C2FABAF5}" = File Viewer Utility 1.2
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"avast5" = avast! Free Antivirus
"Avery Wizard 2.1 MSW2000" = Avery® Wizard 2.1 forMicrosoft® Word 2000
"Belarc Advisor" = Belarc Advisor 7.2
"Branding" =
"CAL" = Canon Camera Access Library
"CameraWindowDVC5" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"CameraWindowMC" = Canon Camera Window MC 6 for ZoomBrowser EX
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"CCleaner" = CCleaner
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"CSCLIB" = Canon Camera Support Core Library
"EOS Utility" = Canon Utilities EOS Utility
"fotkipub" = Fotki XP Publishing Wizard
"Free YouTube to Mp3 Converter_is1" = Free YouTube to Mp3 Converter version 2.5
"Gadwin PrintScreen" = Gadwin PrintScreen
"HP PSC 1200 Series" = HP Photo and Imaging 2.0 - hp psc 1200 series
"hp psc 1200 series_Driver" = hp psc 1200 series
"ie8" = Windows Internet Explorer 8
"InstallShield_{BEB03A1A-1EB6-48EB-9985-8B97315EE5C0}" = Canon Utilities RemoteCapture 2.7
"InstallShield_{EF0DD8B7-471C-463B-A298-6066C2FABAF5}" = Canon Utilities File Viewer Utility 1.2
"MailWasher Pro_is1" = MailWasher Pro
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"NetPal" = Cookie Pal
"NTI CD-Maker 2000 Standard" = NTI CD-Maker 2000 Standard
"PC Pitstop Optimize3_is1" = PC Pitstop Optimize3 3.0
"PCHealth" =
"PhotoRecord" = Canon PhotoRecord
"PhotoStitch" = Canon Utilities PhotoStitch
"PPTView97" = Microsoft PowerPoint Viewer 97
"PROSet" = Intel(R) PRO Ethernet Adapter and Software
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RemoteCaptureTask" = Canon RemoteCapture Task for ZoomBrowser EX
"TClockEx_is1" = TClockEx
"Uninstall_is1" = Uninstall 1.0.0.0
"ViewpointMediaPlayer" = Viewpoint Media Player
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"Works" = Microsoft Works 4.5
"Works99Setup" = Microsoft Works Setup Launcher
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/15/2010 2:08:49 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1001
Description = Fault bucket 1595976195.

Error - 7/15/2010 7:39:21 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x715b9e59.

Error - 7/15/2010 7:46:19 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x715b9e59.

Error - 7/15/2010 7:46:38 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1001
Description = Fault bucket 1595976195.

Error - 7/16/2010 3:25:51 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x715b9e59.

Error - 7/16/2010 3:26:17 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x715b9e59.

Error - 7/16/2010 3:31:46 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x715b9e59.

Error - 7/16/2010 3:32:18 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1001
Description = Fault bucket 1595976195.

Error - 7/16/2010 4:17:38 PM | Computer Name = HOME-KVJPCI4PIU | Source = WinDefendRtp | ID = 3003
Description = %%827 Real-Time Protection checkpoint has encountered an error and
failed to start. User: HOME-KVJPCI4PIU\Richard Doenges Checkpoint ID: 1 Error Code:
0x80070005 Error description: Access is denied.

Error - 7/16/2010 4:17:38 PM | Computer Name = HOME-KVJPCI4PIU | Source = WinDefendRtp | ID = 3003
Description = %%827 Real-Time Protection checkpoint has encountered an error and
failed to start. User: HOME-KVJPCI4PIU\Richard Doenges Checkpoint ID: 1 Error Code:
0x8000ffff Error description: Catastrophic failure

[ System Events ]
Error - 7/15/2010 7:43:02 PM | Computer Name = HOME-KVJPCI4PIU | Source = Service Control Manager | ID = 7031
Description = The Windows Media Player Network Sharing Service service terminated
unexpectedly. It has done this 1 time(s). The following corrective action will
be taken in 30000 milliseconds: Restart the service.

Error - 7/15/2010 8:03:56 PM | Computer Name = HOME-KVJPCI4PIU | Source = Service Control Manager | ID = 7031
Description = The Windows Media Player Network Sharing Service service terminated
unexpectedly. It has done this 1 time(s). The following corrective action will
be taken in 30000 milliseconds: Restart the service.

Error - 7/16/2010 3:11:49 PM | Computer Name = HOME-KVJPCI4PIU | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 7/16/2010 3:13:03 PM | Computer Name = HOME-KVJPCI4PIU | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Aavmker4 aswSP aswTdi BANTExt Fips intelppm

Error - 7/16/2010 3:42:54 PM | Computer Name = HOME-KVJPCI4PIU | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 7/16/2010 3:52:57 PM | Computer Name = HOME-KVJPCI4PIU | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 7/16/2010 4:03:26 PM | Computer Name = HOME-KVJPCI4PIU | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 7/16/2010 4:06:45 PM | Computer Name = HOME-KVJPCI4PIU | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 7/16/2010 4:08:50 PM | Computer Name = HOME-KVJPCI4PIU | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 7/16/2010 4:15:38 PM | Computer Name = HOME-KVJPCI4PIU | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

< End of report >

broni · 2010/07/16

Your computer would benefit from installing another 512MB of RAM.

==========================================================

Update your Java version here: http://www.java.com/en/download/installed.jsp
Uninstall all previous Java versions, through Add\Remove (Programs & Features in Vista/7).

============================================================

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O9 - Extra Button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - Reg Error: Key error. File not found
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab  (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
[2010/04/23 14:08:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\avg9
[2010/04/26 15:58:14 | 000,256,512 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2006/06/04 14:32:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Viewpoint
[2010/04/23 14:08:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\avg9


:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.

Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

RickyD2 · 2010/07/16

I have no more space on motherboard for more RAM.

OTL rebooted itself when it was done and no log was presented. It also deleted itself from desktop when it was finished.

Note the reboot command at the bottom of the data I pasted in the bottom box of OTL.

What's next?

broni · 2010/07/16

Download fresh copy of OTL, run "Quick Scan" (without any code) and post new log.

RickyD2 · 2010/07/16

OTL logfile created on: 7/16/2010 6:30:25 PM - Run 1
OTL by OldTimer - Version 3.2.9.0 Folder = C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 155.00 Mb Available Physical Memory | 30.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 38.27 Gb Total Space | 14.09 Gb Free Space | 36.82% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME-KVJPCI4PIU
Current User Name: Richard Doenges
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/07/16 18:29:24 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\OTL.exe
PRC - [2010/06/28 15:57:16 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2009/04/26 14:29:24 | 000,090,352 | ---- | M] (PC Pitstop LLC) -- C:\Program Files\PCPitstop\PCPitstopScheduleService.exe
PRC - [2009/04/08 13:44:32 | 018,480,224 | ---- | M] (Firetrust Ltd) -- C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
PRC - [2009/01/14 17:53:02 | 000,226,656 | ---- | M] (Microsoft Corp.) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2008/04/14 05:42:30 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Outlook Express\msimn.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/11/03 19:20:12 | 000,866,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2006/03/30 09:15:44 | 000,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2003/01/28 13:42:04 | 000,262,144 | ---- | M] (Executive Software International, Inc.) -- C:\Program Files\Executive Software\Diskeeper Home Edition\DKService.exe
PRC - [2002/07/15 16:36:54 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
PRC - [2001/08/17 22:36:54 | 000,086,016 | ---- | M] (PCtel, Inc.) -- C:\WINDOWS\system32\pctspk.exe

========== Modules (SafeList) ==========

MOD - [2010/07/16 18:29:24 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\OTL.exe
MOD - [2008/04/14 05:40:22 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - [2010/06/28 15:57:16 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/06/28 15:57:16 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/06/28 15:57:16 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/04/28 07:44:02 | 000,704,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2010/03/29 08:51:54 | 000,068,000 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2009/04/26 14:29:24 | 000,090,352 | ---- | M] (PC Pitstop LLC) [Auto | Running] -- C:\Program Files\PCPitstop\PCPitstopScheduleService.exe -- (PCPitstop Scheduling)
SRV - [2009/01/14 17:53:02 | 000,226,656 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV - [2006/03/30 09:15:44 | 000,096,341 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2003/03/09 15:31:02 | 000,065,795 | R--- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2003/01/28 13:42:04 | 000,262,144 | ---- | M] (Executive Software International, Inc.) [Auto | Running] -- C:\Program Files\Executive Software\Diskeeper Home Edition\DKService.exe -- (Diskeeper)
SRV - [2002/07/15 16:36:54 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))
SRV - [2001/08/17 22:36:54 | 000,086,016 | ---- | M] (PCtel, Inc.) [Auto | Running] -- C:\WINDOWS\system32\pctspk.exe -- (Pctspk)

========== Driver Services (SafeList) ==========

DRV - [2010/06/28 15:37:52 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/06/28 15:37:30 | 000,165,456 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/06/28 15:33:14 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/06/28 15:32:46 | 000,100,176 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/06/28 15:32:34 | 000,017,744 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/06/28 15:32:16 | 000,028,880 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2010/04/28 07:44:02 | 000,054,760 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)
DRV - [2010/04/23 19:14:58 | 000,095,024 | ---- | M] (Sunbelt Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\SBREDrv.sys -- (SBRE)
DRV - [2008/02/27 13:49:00 | 000,003,840 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\BANTExt.sys -- (BANTExt)
DRV - [2007/11/13 16:06:50 | 000,441,760 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\timntr.sys -- (timounter)
DRV - [2007/11/13 16:06:50 | 000,044,384 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)
DRV - [2005/02/23 14:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)
DRV - [2004/10/07 19:16:04 | 000,035,840 | ---- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K)
DRV - [2004/08/03 23:29:26 | 000,701,440 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2002/01/24 11:23:40 | 000,013,545 | ---- | M] (SCM Microsystems Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\STLTRK2K.sys -- (Stltrk2k)
DRV - [2001/08/17 13:28:16 | 000,397,502 | ---- | M] (PCtel, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vpctcom.sys -- (Vpctcom)
DRV - [2001/08/17 13:28:16 | 000,064,605 | ---- | M] (PCtel, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vvoice.sys -- (Vvoice)
DRV - [2001/08/17 13:28:14 | 000,604,253 | ---- | M] (PCTEL, INC.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vmodem.sys -- (Vmodem)
DRV - [2001/08/17 13:28:14 | 000,112,574 | ---- | M] (PCTEL, INC.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptserlp.sys -- (Ptserlp)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

O1 HOSTS File: ([2010/07/16 16:43:54 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE (Dale Nurden)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Start Menu\Programs\Startup\MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe (Firetrust Ltd)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSharedDocuments = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoThumbnailCache = 0
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6087.cab (Windows Live Safety Center Base Module)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 76.85.229.110 76.85.229.111
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/03/16 21:31:28 | 000,000,024 | -HS- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/07/16 18:29:22 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\OTL.exe
[2010/07/16 16:43:40 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/07/16 16:40:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/07/16 16:39:42 | 000,153,376 | ---- | C] (Oracle) -- C:\WINDOWS\System32\javaws.exe
[2010/07/16 16:39:42 | 000,145,184 | ---- | C] (Oracle) -- C:\WINDOWS\System32\javaw.exe
[2010/07/16 16:39:42 | 000,073,728 | ---- | C] (Oracle) -- C:\WINDOWS\System32\javacpl.cpl
[2010/07/16 16:39:41 | 000,145,184 | ---- | C] (Oracle) -- C:\WINDOWS\System32\java.exe
[2010/07/16 15:42:48 | 000,000,000 | -HSD | C] -- C:\Recycled
[2010/07/16 15:15:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/07/15 19:52:03 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/07/15 19:52:01 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/07/15 19:10:52 | 000,000,000 | ---D | C] -- C:\FOUND.002
[2010/07/11 15:20:36 | 000,000,000 | ---D | C] -- C:\Program Files\Uniblue
[2010/07/10 19:31:44 | 000,000,000 | R-SD | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\My Stationery
[2010/07/10 19:18:11 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2010/07/10 19:17:00 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Sync Framework
[2010/07/10 19:15:59 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SQL Server Compact Edition
[2010/07/10 19:14:59 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft
[2010/07/10 19:14:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Documents\microsoft
[2010/07/10 19:14:39 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live SkyDrive
[2010/07/10 19:14:12 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2010/07/10 19:04:59 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live
[2010/07/10 16:29:20 | 000,017,744 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/07/10 16:29:18 | 000,165,456 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010/07/10 16:29:11 | 000,023,376 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/07/10 16:29:04 | 000,046,672 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/07/10 16:28:57 | 000,100,176 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/07/10 16:28:57 | 000,094,544 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010/07/10 16:28:56 | 000,028,880 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/07/10 16:24:52 | 000,038,848 | ---- | C] (ALWIL Software) -- C:\WINDOWS\avastSS.scr
[2010/07/10 16:24:22 | 000,165,032 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010/07/10 16:22:55 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010/07/10 16:22:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Alwil Software
[2010/07/09 22:58:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Local Settings\Application Data\Threat Expert
[2010/07/09 22:39:20 | 000,000,000 | ---D | C] -- C:\FOUND.001
[2010/07/09 15:08:00 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Doctor
[2010/07/09 14:18:08 | 000,000,000 | ---D | C] -- C:\0ff30b331f6ef8766e8e82859b84f973
[2010/07/09 12:10:56 | 000,000,000 | ---D | C] -- C:\FOUND.000
[2010/06/30 17:25:08 | 001,013,584 | ---- | C] (Kaspersky Lab) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\TDSSKiller.exe
[2010/06/16 00:12:18 | 000,000,000 | ---D | C] -- C:\Program Files\IE New Window Maximizer
[2010/05/27 15:02:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Jennifer Harman's family
[2010/05/27 14:58:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Miscellaneous stuff
[2010/05/24 16:02:16 | 000,000,000 | ---D | C] -- C:\Program Files\SIW
[2010/05/24 10:49:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\ForceField Shared Files
[2010/05/19 16:32:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Local Settings\Application Data\DYMO
[2010/05/19 16:28:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\DYMO
[2010/05/19 15:17:08 | 000,418,304 | ---- | C] (DYMO Corp.) -- C:\WINDOWS\System32\DYMOSmartPaste.dll
[2010/05/17 12:16:05 | 000,000,000 | ---D | C] -- C:\Program Files\CheckPoint
[2010/05/17 12:09:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\Internet Logs
[2010/05/17 08:50:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
[2010/05/16 13:23:01 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/05/14 23:13:41 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/05/14 19:36:38 | 000,000,000 | ---D | C] -- C:\7a9f938b3d43a523dbb663
[2010/05/14 18:34:00 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\HiJackThis.exe
[2010/05/14 16:20:39 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Recent
[2010/05/14 15:36:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\ElevatedDiagnostics
[2010/05/14 15:21:21 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\windowspowershell
[2010/05/14 12:13:46 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live Safety Center
[2010/05/14 10:48:50 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/05/14 10:44:12 | 001,321,120 | ---- | C] (Avanquest ) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\pccleaner.exe
[2010/05/10 17:45:30 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/05/10 16:20:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Applications
[2010/04/29 12:42:14 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2010/04/26 16:57:19 | 000,000,000 | ---D | C] -- C:\2167da7775d242252848
[2010/04/23 19:14:58 | 000,095,024 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/04/23 19:07:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Local Settings\Application Data\Sunbelt Software
[1 C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\*.tmp files -> C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/07/16 18:29:24 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\OTL.exe
[2010/07/16 18:28:20 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/07/16 18:26:32 | 000,013,738 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/07/16 18:25:42 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/07/16 18:24:50 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/07/16 16:46:42 | 000,019,760 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/07/16 16:44:54 | 000,124,520 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/07/16 16:44:12 | 013,369,344 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\ntuser.dat
[2010/07/16 16:44:12 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\ntuser.ini
[2010/07/16 16:39:34 | 000,153,376 | ---- | M] (Oracle) -- C:\WINDOWS\System32\javaws.exe
[2010/07/16 16:39:34 | 000,145,184 | ---- | M] (Oracle) -- C:\WINDOWS\System32\javaw.exe
[2010/07/16 16:39:34 | 000,145,184 | ---- | M] (Oracle) -- C:\WINDOWS\System32\java.exe
[2010/07/16 16:39:34 | 000,073,728 | ---- | M] (Oracle) -- C:\WINDOWS\System32\javacpl.cpl
[2010/07/16 15:44:08 | 000,000,442 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{9913872E-C5A8-4D8F-83A3-237CEECEEC63}.job
[2010/07/16 15:17:34 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/07/16 12:05:02 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/07/15 19:52:06 | 000,000,600 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/15 18:51:42 | 000,000,525 | ---- | M] () -- C:\hpfr3420.xml
[2010/07/15 14:10:02 | 000,000,495 | -H-- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\hpothb07.tif
[2010/07/15 14:10:02 | 000,000,367 | -H-- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\hpothb07.dat
[2010/07/15 12:40:18 | 535,707,648 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2010/07/12 21:14:00 | 000,449,043 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\RegSeeker.zip
[2010/07/11 13:36:42 | 000,509,392 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/07/11 13:36:42 | 000,433,326 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/07/11 13:36:42 | 000,067,980 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/07/10 19:15:54 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/07/10 16:29:38 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\avast! Free Antivirus.lnk
[2010/07/10 16:29:00 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/07/10 12:16:14 | 000,002,221 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\FixCleaner.lnk
[2010/07/10 00:17:30 | 000,000,623 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/07/10 00:17:30 | 000,000,306 | RHS- | M] () -- C:\boot.ini
[2010/07/05 15:43:22 | 000,000,199 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Document.rtf
[2010/07/02 22:28:32 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/07/02 20:35:04 | 000,001,633 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Adobe Reader 9.lnk
[2010/07/02 19:29:40 | 000,001,429 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Microsoft\Internet Explorer\Quick Launch\Notepad.lnk
[2010/06/30 17:25:08 | 001,013,584 | ---- | M] (Kaspersky Lab) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\TDSSKiller.exe
[2010/06/28 15:57:34 | 000,038,848 | ---- | M] (ALWIL Software) -- C:\WINDOWS\avastSS.scr
[2010/06/28 15:57:12 | 000,165,032 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010/06/28 15:37:52 | 000,046,672 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/06/28 15:37:30 | 000,165,456 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010/06/28 15:33:14 | 000,023,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/06/28 15:32:46 | 000,100,176 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/06/28 15:32:42 | 000,094,544 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010/06/28 15:32:34 | 000,017,744 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/06/28 15:32:16 | 000,028,880 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/06/15 12:50:00 | 000,033,749 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Cheryl.jpg
[2010/05/27 15:08:54 | 000,000,202 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\Shortcut to Dymo LabelWriter Turbo.lnk
[2010/05/25 12:42:58 | 000,019,456 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\RODALE BOOKS.doc
[2010/05/25 12:32:52 | 000,002,473 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\Microsoft Word.lnk
[2010/05/24 16:02:22 | 000,000,514 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\SIW.lnk
[2010/05/24 15:15:34 | 000,167,798 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\ESET Online Scanner.mht
[2010/05/22 14:23:52 | 000,024,064 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Letter to Canon 5-24-2010.doc
[2010/05/22 14:12:34 | 000,002,491 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word.lnk
[2010/05/22 12:12:46 | 000,092,879 | ---- | M] () -- C:\Spophia.jpg
[2010/05/19 16:34:34 | 000,000,036 | ---- | M] () -- C:\WINDOWS\iltwain.ini
[2010/05/19 16:04:14 | 000,000,056 | ---- | M] () -- C:\WINDOWS\Addrfixr.ini
[2010/05/19 14:57:22 | 000,001,390 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\Calculator.lnk
[2010/05/18 23:23:32 | 000,558,670 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\YouTube - The Beatles, in Hey Jude.mht
[2010/05/14 18:33:20 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\HiJackThis.exe
[2010/05/14 10:49:16 | 000,001,452 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\CCleaner.lnk
[2010/05/14 10:44:06 | 001,321,120 | ---- | M] (Avanquest ) -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\pccleaner.exe
[2010/05/13 00:19:58 | 000,002,794 | ---- | M] () -- C:\WINDOWS\Solitaire.ini
[2010/05/10 22:51:26 | 000,000,719 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/29 13:44:30 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/23 19:14:58 | 000,095,024 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/04/22 11:50:34 | 002,908,213 | ---- | M] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Parker&Kloey Easter2010.JPG
[1 C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\*.tmp files -> C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/15 19:52:05 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/12 20:40:33 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/07/11 15:51:12 | 000,449,043 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\RegSeeker.zip
[2010/07/10 19:15:52 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010/07/10 19:13:36 | 000,000,330 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/07/10 16:29:36 | 000,001,604 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\avast! Free Antivirus.lnk
[2010/07/05 15:43:19 | 000,000,199 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Document.rtf
[2010/05/27 15:08:53 | 000,000,202 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\Shortcut to Dymo LabelWriter Turbo.lnk
[2010/05/25 12:42:55 | 000,019,456 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\RODALE BOOKS.doc
[2010/05/24 16:02:20 | 000,000,514 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\SIW.lnk
[2010/05/24 15:15:29 | 000,167,798 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\ESET Online Scanner.mht
[2010/05/22 14:21:47 | 000,024,064 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Letter to Canon 5-24-2010.doc
[2010/05/22 12:14:48 | 000,092,879 | ---- | C] () -- C:\Spophia.jpg
[2010/05/18 23:23:29 | 000,558,670 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\YouTube - The Beatles, in Hey Jude.mht
[2010/05/14 12:10:09 | 000,000,442 | -H-- | C] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{9913872E-C5A8-4D8F-83A3-237CEECEEC63}.job
[2010/05/14 10:49:12 | 000,001,452 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop\CCleaner.lnk
[2010/04/22 11:51:45 | 002,908,213 | ---- | C] () -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\My Documents\Parker&Kloey Easter2010.JPG
[2009/03/26 23:27:13 | 000,003,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\BANTExt.sys
[2008/09/07 15:32:50 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\DYMOCFG.DLL
[2008/04/28 12:50:27 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008/04/28 12:50:27 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008/01/28 15:47:44 | 000,000,124 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2007/12/20 16:12:57 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\hndlt.ini
[2007/11/29 16:30:28 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2007/11/29 14:33:50 | 000,796,048 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2007/11/28 15:52:32 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2007/11/23 16:35:41 | 000,000,094 | ---- | C] () -- C:\WINDOWS\MusicRip.ini
[2007/08/08 12:02:13 | 002,463,976 | ---- | C] () -- C:\WINDOWS\System32\NPSWF32.dll
[2007/02/14 12:45:44 | 000,000,063 | ---- | C] () -- C:\WINDOWS\mdm.ini
[2007/02/13 15:34:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2006/11/13 10:07:22 | 000,000,044 | ---- | C] () -- C:\WINDOWS\liveup.ini
[2006/08/24 23:31:22 | 000,002,794 | ---- | C] () -- C:\WINDOWS\Solitaire.ini
[2006/01/17 23:07:40 | 000,000,056 | ---- | C] () -- C:\WINDOWS\Addrfixr.ini
[2006/01/17 23:07:40 | 000,000,036 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2006/01/17 23:00:14 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/01/15 16:52:43 | 000,000,026 | ---- | C] () -- C:\WINDOWS\DfrgUIEx.INI
[2006/01/15 15:21:34 | 000,561,152 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[2006/01/15 13:29:17 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\msssc.dll
[2002/12/10 00:00:00 | 001,708,032 | ---- | C] () -- C:\WINDOWS\System32\MSO97V.DLL
[2002/12/10 00:00:00 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
[2002/12/10 00:00:00 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\MSORFS.DLL
[2002/12/10 00:00:00 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL
[1998/08/16 05:00:00 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\sysres.dll
[1998/05/14 00:00:00 | 000,116,736 | ---- | C] () -- C:\WINDOWS\System32\PCDLIB32.DLL

========== LOP Check ==========

[2006/11/15 19:14:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\WinZip
[2006/12/18 23:08:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\INAC
[2007/06/11 11:57:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
[2007/11/13 16:07:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Acronis
[2009/10/28 11:29:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\PCPitstop
[2009/10/28 16:17:00 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
[2010/05/10 16:20:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Applications
[2010/05/19 16:28:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\DYMO
[2010/07/10 16:22:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Alwil Software
[2006/01/15 16:08:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\MailWasherPro
[2006/01/15 16:50:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Leadertech
[2006/01/17 16:17:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Image Zone Express
[2006/04/14 11:44:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Allume Systems
[2006/06/26 14:12:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Simple Star
[2006/06/26 22:31:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Road Runner
[2006/07/28 15:34:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\GlobalSCAPE
[2006/12/18 23:08:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\INAC
[2007/07/02 12:20:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\CyberMatrix
[2007/07/02 12:26:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\WordWeb
[2007/07/25 11:51:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\Uniblue
[2007/12/08 15:15:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\wsInspector
[2008/04/28 12:56:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\AVSMedia
[2008/07/25 23:20:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/05/17 15:40:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\VersionTracker Pro
[2009/10/08 11:48:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\CheckPoint
[2010/03/22 16:49:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\FixCleaner
[2010/05/14 15:36:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Application Data\ElevatedDiagnostics
[2010/07/16 18:28:20 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/07/16 15:44:08 | 000,000,442 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{9913872E-C5A8-4D8F-83A3-237CEECEEC63}.job
[2007/01/20 23:30:34 | 000,000,362 | ---- | M] () -- C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1137559368.job

========== Purity Check ==========

< End of report >

RickyD2 · 2010/07/16

OTL Extras logfile created on: 7/16/2010 6:30:25 PM - Run 1
OTL by OldTimer - Version 3.2.9.0 Folder = C:\Documents and Settings\Richard Doenges.HOME-KVJPCI4PIU\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 155.00 Mb Available Physical Memory | 30.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 38.27 Gb Total Space | 14.09 Gb Free Space | 36.82% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME-KVJPCI4PIU
Current User Name: Richard Doenges
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
"FirewallOverride" = 0
"AntiVirusOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00170409-78E1-11D2-B60F-006097C998E7}" = Microsoft Word 2000
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{0DA76892-D849-422B-80D0-E4FC26009AB9}" = FixCleaner
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1BD07DF4-FB06-41BA-B896-B2DA59000C96}" = Windows Live Toolbar
"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B719A70-F14A-4f5c-90B5-346B24B7FFF1}" = Windows 7 Upgrade Advisor
"{5C74694C-A687-E3EB-FF18-B018D4A76ECD}" = Adobe Media Player
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6DCB031C-6BCE-4AEE-AAF8-5F14148D0803}" = Diskeeper Home Edition
"{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}" = HP Photo and Imaging 2.0 - All-in-One Drivers
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9867A917-5D17-40DE-83BA-BEA5293194B1}" = HP Photo and Imaging 2.0 - All-in-One
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A53AB160-8DC1-11D6-B494-008048C29C40}" = USB CF
"{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures
"{AB67580-257C-45FF-B8F4-C8C30682091A}_is1" = SIW version 2010.04.28
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B376402D-58EA-45EA-BD50-DD924EB67A70}" = HP Memories Disc
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BEB03A1A-1EB6-48EB-9985-8B97315EE5C0}" = RemoteCapture 2.7.0
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C900EF06-2E76-49C7-8DB0-41F629B21DC5}" = hp psc 1200 series
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BC}" = WinZip 14.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D92FF8EB-BD77-40AE-B68B-A6BFC6F8661D}" = Windows Live Family Safety
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
"{EF0DD8B7-471C-463B-A298-6066C2FABAF5}" = File Viewer Utility 1.2
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"avast5" = avast! Free Antivirus
"Avery Wizard 2.1 MSW2000" = Avery® Wizard 2.1 forMicrosoft® Word 2000
"Belarc Advisor" = Belarc Advisor 7.2
"Branding" =
"CAL" = Canon Camera Access Library
"CameraWindowDVC5" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"CameraWindowMC" = Canon Camera Window MC 6 for ZoomBrowser EX
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"CCleaner" = CCleaner
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"CSCLIB" = Canon Camera Support Core Library
"EOS Utility" = Canon Utilities EOS Utility
"fotkipub" = Fotki XP Publishing Wizard
"Free YouTube to Mp3 Converter_is1" = Free YouTube to Mp3 Converter version 2.5
"Gadwin PrintScreen" = Gadwin PrintScreen
"HP PSC 1200 Series" = HP Photo and Imaging 2.0 - hp psc 1200 series
"hp psc 1200 series_Driver" = hp psc 1200 series
"ie8" = Windows Internet Explorer 8
"InstallShield_{BEB03A1A-1EB6-48EB-9985-8B97315EE5C0}" = Canon Utilities RemoteCapture 2.7
"InstallShield_{EF0DD8B7-471C-463B-A298-6066C2FABAF5}" = Canon Utilities File Viewer Utility 1.2
"MailWasher Pro_is1" = MailWasher Pro
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"NetPal" = Cookie Pal
"NTI CD-Maker 2000 Standard" = NTI CD-Maker 2000 Standard
"PC Pitstop Optimize3_is1" = PC Pitstop Optimize3 3.0
"PCHealth" =
"PhotoRecord" = Canon PhotoRecord
"PhotoStitch" = Canon Utilities PhotoStitch
"PPTView97" = Microsoft PowerPoint Viewer 97
"PROSet" = Intel(R) PRO Ethernet Adapter and Software
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RemoteCaptureTask" = Canon RemoteCapture Task for ZoomBrowser EX
"TClockEx_is1" = TClockEx
"Uninstall_is1" = Uninstall 1.0.0.0
"ViewpointMediaPlayer" = Viewpoint Media Player
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"Works" = Microsoft Works 4.5
"Works99Setup" = Microsoft Works Setup Launcher
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/15/2010 2:08:49 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1001
Description = Fault bucket 1595976195.

Error - 7/15/2010 7:39:21 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x715b9e59.

Error - 7/15/2010 7:46:19 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x715b9e59.

Error - 7/15/2010 7:46:38 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1001
Description = Fault bucket 1595976195.

Error - 7/16/2010 3:25:51 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x715b9e59.

Error - 7/16/2010 3:26:17 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x715b9e59.

Error - 7/16/2010 3:31:46 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x715b9e59.

Error - 7/16/2010 3:32:18 PM | Computer Name = HOME-KVJPCI4PIU | Source = Application Error | ID = 1001
Description = Fault bucket 1595976195.

Error - 7/16/2010 4:17:38 PM | Computer Name = HOME-KVJPCI4PIU | Source = WinDefendRtp | ID = 3003
Description = %%827 Real-Time Protection checkpoint has encountered an error and
failed to start. User: HOME-KVJPCI4PIU\Richard Doenges Checkpoint ID: 1 Error Code:
0x80070005 Error description: Access is denied.

Error - 7/16/2010 4:17:38 PM | Computer Name = HOME-KVJPCI4PIU | Source = WinDefendRtp | ID = 3003
Description = %%827 Real-Time Protection checkpoint has encountered an error and
failed to start. User: HOME-KVJPCI4PIU\Richard Doenges Checkpoint ID: 1 Error Code:
0x8000ffff Error description: Catastrophic failure

[ System Events ]
Error - 7/16/2010 4:08:50 PM | Computer Name = HOME-KVJPCI4PIU | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 7/16/2010 4:15:38 PM | Computer Name = HOME-KVJPCI4PIU | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 7/16/2010 5:43:40 PM | Computer Name = HOME-KVJPCI4PIU | Source = Service Control Manager | ID = 7031
Description = The Windows Defender service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 15000 milliseconds:
Restart the service.

Error - 7/16/2010 5:43:40 PM | Computer Name = HOME-KVJPCI4PIU | Source = Service Control Manager | ID = 7034
Description = The Diskeeper service terminated unexpectedly. It has done this 1
time(s).

Error - 7/16/2010 5:43:41 PM | Computer Name = HOME-KVJPCI4PIU | Source = Service Control Manager | ID = 7034
Description = The PCPitstop Scheduling service terminated unexpectedly. It has
done this 1 time(s).

Error - 7/16/2010 5:43:41 PM | Computer Name = HOME-KVJPCI4PIU | Source = Service Control Manager | ID = 7034
Description = The PCTEL Speaker Phone service terminated unexpectedly. It has done
this 1 time(s).

Error - 7/16/2010 5:43:41 PM | Computer Name = HOME-KVJPCI4PIU | Source = Service Control Manager | ID = 7034
Description = The SoundMAX Agent Service service terminated unexpectedly. It has
done this 1 time(s).

Error - 7/16/2010 5:43:41 PM | Computer Name = HOME-KVJPCI4PIU | Source = Service Control Manager | ID = 7034
Description = The SeaPort service terminated unexpectedly. It has done this 1 time(s).

Error - 7/16/2010 5:43:41 PM | Computer Name = HOME-KVJPCI4PIU | Source = Service Control Manager | ID = 7034
Description = The Canon Camera Access Library 8 service terminated unexpectedly.
It has done this 1 time(s).

Error - 7/16/2010 5:43:42 PM | Computer Name = HOME-KVJPCI4PIU | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

< End of report >

broni · 2010/07/16

Looks good
My script worked correctly.

Last scan.....

1. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

2. Go to Kaspersky website and perform an online antivirus scan.

1. Disable your active antivirus program.
2. Read through the requirements and privacy statement and click on Accept button.
3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
4. When the downloads have finished, click on Settings.
5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

Spyware, Adware, Dialers, and other potentially dangerous programs
[*] Archives
[*] Mail databases

6. Click on My Computer under Scan.
7. Once the scan is complete, it will display the results. Click on View Scan Report.
8. You will see a list of infected items there. Click on Save Report As....
9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

RickyD2 · 2010/07/16

No infected items were found by Kaspersky.

broni · 2010/07/16

Nice

OTL Clean-Up
Clean up with OTL:

* Double-click OTL.exe to start the program.
* Close all other programs apart from OTL as this step will require a reboot
* On the OTL main screen, press the CLEANUP button
* Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

===============================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point.

Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore ".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista and 7:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C: ")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

2. Restart computer.

3. Turn System Restore on.

4. Make sure, Windows Updates are current.

[SIZE= "4"]5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately![/SIZE]

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run defrag at your convenience.

8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

9. Please, let me know, how is your computer doing.

RickyD2 · 2010/07/16

Well, Broni, I guess you can mark this thread as resolved. Thank you very much for all your expert help and patience.

broni · 2010/07/16

You're very welcome
I assume, you'll sleep well tonight?

RickyD2 · 2010/07/16

Better than for a while, this is true. Thanks again.

broni · 2010/07/16

Sure thing

Log in or Sign up

Solved computer taken over by by virus

broni Moderator Malware Analyst

broni Moderator Malware Analyst

RickyD2 Inactive Thread Starter

broni Moderator Malware Analyst

RickyD2 Inactive Thread Starter

RickyD2 Inactive Thread Starter

broni Moderator Malware Analyst

RickyD2 Inactive Thread Starter

broni Moderator Malware Analyst

RickyD2 Inactive Thread Starter

RickyD2 Inactive Thread Starter

broni Moderator Malware Analyst

RickyD2 Inactive Thread Starter

broni Moderator Malware Analyst

RickyD2 Inactive Thread Starter

broni Moderator Malware Analyst

RickyD2 Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved computer taken over by by virus

broni Moderator Malware Analyst

broni Moderator Malware Analyst

RickyD2 Inactive Thread Starter

broni Moderator Malware Analyst

RickyD2 Inactive Thread Starter

RickyD2 Inactive Thread Starter

broni Moderator Malware Analyst

RickyD2 Inactive Thread Starter

broni Moderator Malware Analyst

RickyD2 Inactive Thread Starter

RickyD2 Inactive Thread Starter

broni Moderator Malware Analyst

RickyD2 Inactive Thread Starter

broni Moderator Malware Analyst

RickyD2 Inactive Thread Starter

broni Moderator Malware Analyst

RickyD2 Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches