1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved re: Auntie's Extremely Slooooow Machine

Discussion in 'Malware and Virus Removal Archive' started by Blue Star, 2010/07/17.

Page 2 of 3
  1. 2010/07/24
    Blue Star

    Blue Star Well-Known Member Thread Starter

    Joined:
    2010/03/25
    Messages:
    454
    Likes Received:
    2
    when I rebooted after java install, old wallpaper I had changed reappeared and old desktop icons reappeared that had been deleted or stored in another folder. Also, I cannot run OTL...it was deleted. I dl OTL again and I get the message that it cannot run from a temp file and to dl it to desktop. Problem is, it is dl to desktop.
     
    Blue Star,
    #21
  2. 2010/07/24
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2
    • Double-click SystemLook.exe to run it.
    • Vista users:: Right click on SystemLook.exe, click Run As Administrator
    • Copy the content of the following box into the main textfield:
      Code:
      :filefind
otl*
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt
     
    broni,
    #22


  3. to hide this advert.

  4. 2010/07/25
    Blue Star

    Blue Star Well-Known Member Thread Starter

    Joined:
    2010/03/25
    Messages:
    454
    Likes Received:
    2
    holy parallel universe, batman!...

    no really, I rebooted the machine twice and the world was restored to as it was before the java install... here's the latest OTL

    OTL logfile created on: 7/24/2010 11:52:47 PM - Run 2
    OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Owner\Desktop
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    247.00 Mb Total Physical Memory | 24.00 Mb Available Physical Memory | 10.00% Memory free
    606.00 Mb Paging File | 262.00 Mb Available in Paging File | 43.00% Paging File free
    Paging file location(s): C:\pagefile.sys 372 744 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 69.66 Gb Total Space | 57.05 Gb Free Space | 81.89% Space Free | Partition Type: NTFS
    Drive D: | 4.88 Gb Total Space | 1.30 Gb Free Space | 26.69% Space Free | Partition Type: FAT32
    E: Drive not present or media not loaded
    F: Drive not present or media not loaded
    G: Drive not present or media not loaded
    H: Drive not present or media not loaded
    I: Drive not present or media not loaded

    Computer Name: YOUR-SZ6X6SEFXO
    Current User Name: Owner
    Logged in as Administrator.

    Current Boot Mode: Normal
    Scan Mode: Current user
    Company Name Whitelist: On
    Skip Microsoft Files: On
    File Age = 90 Days
    Output = Standard
    Quick Scan

    ========== Processes (SafeList) ==========

    PRC - [2010/07/22 20:23:55 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
    PRC - [2010/06/28 16:57:18 | 002,837,864 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    PRC - [2010/06/28 16:57:15 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2003/02/21 07:07:06 | 000,068,704 | ---- | M] () -- C:\Program Files\Softex\OmniPass\omniServ.exe
    PRC - [2003/02/21 06:50:10 | 000,053,248 | ---- | M] () -- C:\Program Files\Softex\OmniPass\OPXPApp.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/07/22 20:23:55 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
    MOD - [2008/04/13 20:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
    SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
    SRV - [2010/06/28 16:57:15 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
    SRV - [2010/06/28 16:57:15 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
    SRV - [2010/06/28 16:57:15 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
    SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
    SRV - [2003/02/21 07:07:06 | 000,068,704 | ---- | M] () [Auto | Running] -- C:\Program Files\Softex\OmniPass\omniServ.exe -- (omniserv)


    ========== Driver Services (SafeList) ==========

    DRV - [2010/06/28 16:37:52 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
    DRV - [2010/06/28 16:37:30 | 000,165,456 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
    DRV - [2010/06/28 16:33:13 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
    DRV - [2010/06/28 16:32:45 | 000,100,176 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
    DRV - [2010/06/28 16:32:33 | 000,017,744 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV - [2010/06/28 16:32:16 | 000,028,880 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
    DRV - [2009/01/26 18:13:41 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
    DRV - [2009/01/26 18:13:39 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
    DRV - [2004/10/01 11:24:02 | 002,279,424 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
    DRV - [2004/08/04 01:31:32 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
    DRV - [2004/08/04 01:29:54 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
    DRV - [2004/08/04 01:29:51 | 000,166,912 | ---- | M] (S3 Graphics, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s3gnbm.sys -- (S3Psddr)
    DRV - [2003/03/08 01:13:22 | 000,624,369 | ---- | M] (LT) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ltmdmnt.sys -- (ltmodem5)
    DRV - [2003/02/26 22:19:50 | 000,260,736 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315)
    DRV - [2003/02/22 22:55:26 | 000,141,824 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\fasttx2k.sys -- (fasttx2k)
    DRV - [2003/02/22 01:17:06 | 000,020,012 | ---- | M] (PC-Doctor, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pcdrsrvc.sys -- (PCDRSRVC)
    DRV - [2003/01/10 17:13:04 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
    DRV - [2002/12/27 14:41:00 | 000,026,880 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\viaagp1.sys -- (viaagp1)
    DRV - [2002/12/25 01:09:48 | 000,030,848 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\SISAGPX.sys -- (SISAGP)
    DRV - [2002/09/06 21:24:00 | 000,013,568 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\nv_agp.sys -- (nv_agp)
    DRV - [2002/07/30 00:43:50 | 000,023,808 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2)
    DRV - [1999/12/02 16:55:32 | 000,066,048 | ---- | M] (Marimba, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\mrtrate.dll -- (mrtRate)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost


    [2010/04/27 17:58:26 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
    [2009/09/21 12:24:16 | 000,001,329 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml

    O1 HOSTS File: ([2010/07/22 22:44:29 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
    O1 - Hosts: 127.0.0.1 localhost
    O1 - Hosts: ::1 localhost
    O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
    O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
    O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
    O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()
    O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll (Microsoft Corporation)
    O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
    O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
    O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
    O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
    O3 - HKCU\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
    O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
    O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
    O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
    O4 - HKCU..\Run: [Acme.PCHButton] C:\Program Files\Instant Support\Presario\XPHNARS3EN\plugin\bin\PCHButton.exe (Motive Communications, Inc.)
    O4 - HKCU..\Run: [NVIEW] C:\WINDOWS\System32\nview.dll (NVIDIA Corporation)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_21.dll (Oracle)
    O9 - Extra Button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
    O9 - Extra Button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
    O9 - Extra Button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll (Microsoft Corporation)
    O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
    O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
    O15 - HKCU\..Trusted Domains: securesite.com ([]https in Trusted sites)
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1272037067906 (WUWebControl Class)
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1272037382218 (MUWebControl Class)
    O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
    O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
    O20 - Winlogon\Notify\OPXPGina: DllName - C:\Program Files\Softex\OmniPass\opxpgina.dll - C:\Program Files\Softex\OmniPass\OPXPGina.dll ()
    O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2003/04/10 05:49:37 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O32 - AutoRun File - [2001/07/28 07:07:38 | 000,000,000 | RHS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    ========== Files/Folders - Created Within 90 Days ==========

    [2010/07/22 22:44:29 | 000,000,000 | -HSD | C] -- C:\RECYCLER
    [2010/07/22 22:43:34 | 000,000,000 | ---D | C] -- C:\_OTL
    [2010/07/22 22:37:01 | 000,423,656 | ---- | C] (Oracle) -- C:\WINDOWS\System32\deployJava1.dll
    [2010/07/22 22:37:01 | 000,153,376 | ---- | C] (Oracle) -- C:\WINDOWS\System32\javaws.exe
    [2010/07/22 22:37:01 | 000,145,184 | ---- | C] (Oracle) -- C:\WINDOWS\System32\javaw.exe
    [2010/07/22 22:37:01 | 000,073,728 | ---- | C] (Oracle) -- C:\WINDOWS\System32\javacpl.cpl
    [2010/07/22 22:37:00 | 000,145,184 | ---- | C] (Oracle) -- C:\WINDOWS\System32\java.exe
    [2010/07/22 20:23:45 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
    [2010/07/17 14:41:15 | 006,153,376 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup-1.46.exe
    [2010/07/01 20:08:15 | 000,038,848 | ---- | C] (ALWIL Software) -- C:\WINDOWS\avastSS.scr
    [2010/06/30 18:00:49 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ActiveSync
    [2010/06/30 17:53:24 | 000,000,000 | R--D | C] -- C:\MSOCache
    [2010/06/30 09:01:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\New Folder
    [2010/06/01 22:04:15 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Owner\IECompatCache
    [2010/05/20 08:04:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
    [2010/05/19 22:22:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\scripting
    [2010/05/19 22:21:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\l2schemas
    [2010/05/19 22:21:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en
    [2010/05/07 20:55:33 | 000,017,744 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
    [2010/05/04 21:13:08 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Owner\PrivacIE
    [2010/05/04 21:10:28 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Owner\IETldCache
    [2010/05/04 20:57:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Yahoo
    [2010/05/04 17:37:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
    [2010/05/04 17:34:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
    [2010/05/04 17:34:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Yahoo!
    [2010/05/04 17:29:24 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
    [2010/05/04 10:26:01 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstall$
    [2010/04/26 11:10:06 | 000,000,000 | ---D | C] -- C:\Program Files\SiteRanker
    [2010/04/26 11:09:33 | 000,000,000 | ---D | C] -- C:\Program Files\Crawler

    ========== Files - Modified Within 90 Days ==========

    [2010/07/25 00:23:04 | 000,000,340 | ---- | M] () -- C:\WINDOWS\tasks\PCHealth Scheduler for Upload Library.job
    [2010/07/24 23:52:31 | 000,000,248 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.dat
    [2010/07/24 23:43:02 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
    [2010/07/24 23:42:40 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/07/24 23:42:38 | 259,047,424 | -HS- | M] () -- C:\hiberfil.sys
    [2010/07/22 22:59:36 | 003,407,872 | -H-- | M] () -- C:\Documents and Settings\Owner\NTUSER.DAT
    [2010/07/22 22:59:36 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\Owner\ntuser.ini
    [2010/07/22 22:44:29 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
    [2010/07/22 20:23:55 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
    [2010/07/22 20:00:50 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2010/07/19 19:18:21 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
    [2010/07/17 14:41:16 | 006,153,376 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup-1.46.exe
    [2010/07/05 14:54:09 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\dds.scr
    [2010/07/04 01:01:48 | 000,368,310 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2010/07/04 01:01:48 | 000,047,128 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2010/07/04 01:01:46 | 000,417,900 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
    [2010/07/02 21:04:51 | 000,050,688 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\HORIZON POOLS.doc
    [2010/07/02 21:04:51 | 000,050,688 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\HORIZON POOLS.doc
    [2010/07/02 03:12:11 | 000,000,718 | ---- | M] () -- C:\WINDOWS\win.ini
    [2010/07/01 20:08:34 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
    [2010/07/01 19:44:58 | 000,148,400 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2010/06/30 18:04:09 | 000,000,376 | ---- | M] () -- C:\WINDOWS\ODBC.INI
    [2010/06/28 16:57:33 | 000,038,848 | ---- | M] (ALWIL Software) -- C:\WINDOWS\avastSS.scr
    [2010/06/28 16:57:12 | 000,165,032 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
    [2010/06/28 16:37:52 | 000,046,672 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
    [2010/06/28 16:37:30 | 000,165,456 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
    [2010/06/28 16:33:13 | 000,023,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
    [2010/06/28 16:32:45 | 000,100,176 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
    [2010/06/28 16:32:42 | 000,094,544 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
    [2010/06/28 16:32:33 | 000,017,744 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
    [2010/06/28 16:32:16 | 000,028,880 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
    [2010/06/22 04:36:38 | 000,153,376 | ---- | M] (Oracle) -- C:\WINDOWS\System32\javaws.exe
    [2010/06/22 04:36:37 | 000,145,184 | ---- | M] (Oracle) -- C:\WINDOWS\System32\javaw.exe
    [2010/06/22 04:36:36 | 000,145,184 | ---- | M] (Oracle) -- C:\WINDOWS\System32\java.exe
    [2010/06/22 04:36:29 | 000,423,656 | ---- | M] (Oracle) -- C:\WINDOWS\System32\deployJava1.dll
    [2010/06/22 02:24:28 | 000,073,728 | ---- | M] (Oracle) -- C:\WINDOWS\System32\javacpl.cpl
    [2010/06/20 15:10:41 | 000,050,962 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\Chase%20Deposit%20slip[1].pdf
    [2010/06/18 05:12:59 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
    [2010/06/18 05:12:59 | 000,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for
    [2010/06/17 15:34:19 | 000,002,027 | ---- | M] () -- C:\WINDOWS\System32\QuickTime.qtp
    [2010/06/09 03:12:58 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2010/06/06 23:10:35 | 000,001,498 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\SPIDER SOLITAIRE.lnk
    [2010/06/02 00:41:35 | 006,427,280 | -H-- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db
    [2010/05/30 19:16:07 | 000,003,382 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\Justine.doc
    [2010/05/20 08:10:22 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
    [2010/05/19 22:10:06 | 000,250,048 | RHS- | M] () -- C:\ntldr
    [2010/05/04 21:57:07 | 000,032,392 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    [2010/05/04 21:11:03 | 000,000,823 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2010/05/04 10:59:28 | 000,000,283 | RHS- | M] () -- C:\boot.ini
    [2010/05/04 10:45:39 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2010/04/30 10:36:21 | 000,005,640 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\Olney Letter.doc
    [2010/04/30 09:00:35 | 000,005,037 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\The%20National%20Lottery[1].rtf
    [2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

    ========== Files Created - No Company Name ==========

    [2010/07/05 14:54:03 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\dds.scr
    [2010/07/03 13:21:21 | 000,050,688 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\HORIZON POOLS.doc
    [2010/07/02 13:13:04 | 000,050,688 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\HORIZON POOLS.doc
    [2010/06/20 15:10:40 | 000,050,962 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\Chase%20Deposit%20slip[1].pdf
    [2010/06/18 05:12:59 | 000,054,156 | -H-- | C] () -- C:\WINDOWS\QTFont.qfn
    [2010/06/18 05:12:59 | 000,001,409 | ---- | C] () -- C:\WINDOWS\QTFont.for
    [2010/05/05 12:55:53 | 000,010,457 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmptour.hta
    [2010/05/05 12:55:53 | 000,001,771 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmptour.css
    [2010/05/05 12:55:53 | 000,000,855 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpocm.inf
    [2010/05/05 12:55:53 | 000,000,420 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmploc.js
    [2010/05/05 12:55:52 | 000,613,334 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmplayer.chm
    [2010/05/05 12:55:52 | 000,067,374 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmplayer.adm
    [2010/05/05 12:55:52 | 000,023,195 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmplay.chm
    [2010/05/05 12:55:51 | 000,172,196 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud9.wav
    [2010/05/05 12:55:50 | 000,343,204 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud7.wav
    [2010/05/05 12:55:50 | 000,343,204 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud6.wav
    [2010/05/05 12:55:50 | 000,172,196 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud8.wav
    [2010/05/05 12:55:50 | 000,086,196 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud5.wav
    [2010/05/05 12:55:49 | 000,354,468 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud1.wav
    [2010/05/05 12:55:49 | 000,172,196 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud3.wav
    [2010/05/05 12:55:49 | 000,086,180 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud4.wav
    [2010/05/05 12:55:49 | 000,086,180 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud2.wav
    [2010/05/05 12:55:49 | 000,029,070 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmp.inf
    [2010/05/05 12:55:43 | 000,006,769 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmfsdk.inf
    [2010/05/05 12:55:42 | 000,017,272 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmdm.inf
    [2010/05/05 12:55:42 | 000,008,677 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm7.gif
    [2010/05/05 12:55:42 | 000,007,892 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm9.gif
    [2010/05/05 12:55:42 | 000,007,636 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm2.gif
    [2010/05/05 12:55:42 | 000,007,369 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm4.gif
    [2010/05/05 12:55:42 | 000,006,241 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm3.gif
    [2010/05/05 12:55:42 | 000,006,060 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm6.gif
    [2010/05/05 12:55:42 | 000,005,789 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm1.gif
    [2010/05/05 12:55:42 | 000,004,193 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm8.gif
    [2010/05/05 12:55:42 | 000,002,477 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm5.gif
    [2010/05/05 12:55:32 | 000,300,969 | ---- | C] () -- C:\WINDOWS\System32\dllcache\viz.wmv
    [2010/05/05 12:55:32 | 000,017,489 | ---- | C] () -- C:\WINDOWS\System32\dllcache\videobg.gif
    [2010/05/05 12:55:32 | 000,005,290 | ---- | C] () -- C:\WINDOWS\System32\dllcache\vidsamp.gif
    [2010/05/05 12:55:22 | 000,023,829 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tourbg.gif
    [2010/05/05 12:55:22 | 000,003,187 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tour.js
    [2010/05/05 12:55:22 | 000,002,469 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tplay.gif
    [2010/05/05 12:55:22 | 000,002,450 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tpause.gif
    [2010/05/05 12:55:22 | 000,002,375 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tplayh.gif
    [2010/05/05 12:55:22 | 000,002,371 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tpauseh.gif
    [2010/05/05 12:55:20 | 000,001,398 | ---- | C] () -- C:\WINDOWS\System32\dllcache\taon.gif
    [2010/05/05 12:55:20 | 000,001,380 | ---- | C] () -- C:\WINDOWS\System32\dllcache\taonh.gif
    [2010/05/05 12:55:20 | 000,001,380 | ---- | C] () -- C:\WINDOWS\System32\dllcache\taoff.gif
    [2010/05/05 12:55:20 | 000,001,367 | ---- | C] () -- C:\WINDOWS\System32\dllcache\taoffh.gif
    [2010/05/05 12:55:07 | 000,001,148 | ---- | C] () -- C:\WINDOWS\System32\dllcache\snd.htm
    [2010/05/05 12:55:05 | 000,000,908 | ---- | C] () -- C:\WINDOWS\System32\dllcache\skins.inf
    [2010/05/05 12:54:53 | 000,572,557 | ---- | C] () -- C:\WINDOWS\System32\dllcache\rtuner.wmv
    [2010/05/05 12:54:51 | 000,066,725 | ---- | C] () -- C:\WINDOWS\System32\dllcache\revert.wmz
    [2010/05/05 12:54:38 | 000,077,307 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plyr_err.chm
    [2010/05/05 12:54:38 | 000,001,477 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst6.wpl
    [2010/05/05 12:54:38 | 000,001,477 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst5.wpl
    [2010/05/05 12:54:38 | 000,001,474 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst3.wpl
    [2010/05/05 12:54:38 | 000,001,451 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst12.wpl
    [2010/05/05 12:54:38 | 000,001,448 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst4.wpl
    [2010/05/05 12:54:38 | 000,001,250 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst1.wpl
    [2010/05/05 12:54:38 | 000,001,049 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst2.wpl
    [2010/05/05 12:54:38 | 000,001,046 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst7.wpl
    [2010/05/05 12:54:38 | 000,001,036 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst8.wpl
    [2010/05/05 12:54:38 | 000,000,789 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst11.wpl
    [2010/05/05 12:54:38 | 000,000,787 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst10.wpl
    [2010/05/05 12:54:38 | 000,000,784 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst9.wpl
    [2010/05/05 12:54:38 | 000,000,783 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst13.wpl
    [2010/05/05 12:54:38 | 000,000,775 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst14.wpl
    [2010/05/05 12:54:38 | 000,000,733 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst15.wpl
    [2010/05/05 12:54:11 | 000,375,519 | ---- | C] () -- C:\WINDOWS\System32\dllcache\nuskin.wmv
    [2010/05/05 12:54:00 | 000,022,060 | ---- | C] () -- C:\WINDOWS\System32\dllcache\npds.zip
    [2010/05/05 12:54:00 | 000,000,403 | ---- | C] () -- C:\WINDOWS\System32\dllcache\npdrmv2.zip
    [2010/05/05 12:53:22 | 000,844,314 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msdxm.ocx
    [2010/05/05 12:53:22 | 000,004,126 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msdxmlc.dll
    [2010/05/05 12:53:08 | 000,097,117 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mplayer2.hlp
    [2010/05/05 12:53:08 | 000,018,286 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mplayer2.inf
    [2010/05/05 12:53:08 | 000,002,778 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mplogoh.gif
    [2010/05/05 12:53:08 | 000,002,545 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mplogo.gif
    [2010/05/05 12:53:08 | 000,001,885 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mplayer2.cnt
    [2010/05/05 12:52:46 | 000,457,607 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mdlib.wmv
    [2010/05/05 12:52:11 | 000,001,261 | ---- | C] () -- C:\WINDOWS\System32\pid.inf
    [2010/05/05 12:51:52 | 000,005,971 | ---- | C] () -- C:\WINDOWS\System32\dllcache\events.js
    [2010/05/05 12:51:49 | 000,498,742 | ---- | C] () -- C:\WINDOWS\System32\dllcache\dxmasf.dll
    [2010/05/05 12:51:30 | 000,381,425 | ---- | C] () -- C:\WINDOWS\System32\dllcache\copycd.wmv
    [2010/05/05 12:51:30 | 000,009,585 | ---- | C] () -- C:\WINDOWS\System32\dllcache\controls.css
    [2010/05/05 12:51:30 | 000,008,298 | ---- | C] () -- C:\WINDOWS\System32\dllcache\contents.htm
    [2010/05/05 12:51:30 | 000,006,878 | ---- | C] () -- C:\WINDOWS\System32\dllcache\controls.js
    [2010/05/05 12:51:29 | 000,184,959 | ---- | C] () -- C:\WINDOWS\System32\dllcache\compact.wmz
    [2010/05/05 12:51:28 | 000,000,773 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cnth.gif
    [2010/05/05 12:51:28 | 000,000,773 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cnt.gif
    [2010/05/05 12:51:28 | 000,000,772 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cntd.gif
    [2010/05/05 12:51:28 | 000,000,760 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cloapph.gif
    [2010/05/05 12:51:28 | 000,000,717 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cloapp.gif
    [2010/05/05 12:51:19 | 000,000,999 | ---- | C] () -- C:\WINDOWS\System32\dllcache\bktrh.gif
    [2010/05/04 16:50:39 | 000,000,823 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2010/04/30 09:00:34 | 000,005,037 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\The%20National%20Lottery[1].rtf
    [2008/10/14 14:15:28 | 000,006,048 | ---- | C] () -- C:\WINDOWS\System32\MCC16.dll
    [2007/10/07 15:22:46 | 000,000,031 | -H-- | C] () -- C:\WINDOWS\uccspecc.sys
    [2007/09/08 20:58:21 | 000,000,064 | ---- | C] () -- C:\WINDOWS\QBWCD.INI
    [2006/09/10 15:06:00 | 000,040,448 | ---- | C] () -- C:\WINDOWS\System32\BJAXSecurityManager.dll
    [2006/09/10 15:05:47 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\BJInstaller.dll
    [2006/07/25 17:30:09 | 000,000,031 | ---- | C] () -- C:\WINDOWS\tyvplay.INI
    [2006/07/08 13:33:48 | 000,000,042 | ---- | C] () -- C:\WINDOWS\viaplay3.ini
    [2006/07/08 13:33:29 | 000,000,530 | ---- | C] () -- C:\WINDOWS\Viaplay.ini
    [2006/07/08 13:33:29 | 000,000,425 | ---- | C] () -- C:\WINDOWS\8272TYGS.INI
    [2006/07/08 13:33:28 | 000,000,262 | ---- | C] () -- C:\WINDOWS\VMARK.INI
    [2006/05/17 11:04:03 | 000,002,468 | ---- | C] () -- C:\WINDOWS\MBROWSER.INI
    [2005/05/20 05:04:09 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
    [2004/11/18 11:55:22 | 000,000,179 | ---- | C] () -- C:\WINDOWS\upst.ini
    [2004/09/21 23:40:26 | 000,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
    [2004/09/21 23:40:26 | 000,000,027 | ---- | C] () -- C:\WINDOWS\upth.ini
    [2003/12/20 02:02:16 | 000,000,026 | ---- | C] () -- C:\WINDOWS\UP9ASP.INI
    [2003/12/01 10:57:16 | 000,004,094 | ---- | C] () -- C:\WINDOWS\System32\rtcsses.dll
    [2003/12/01 10:57:16 | 000,004,094 | ---- | C] () -- C:\WINDOWS\System32\dimces.dll
    [2003/11/08 03:54:41 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
    [2003/10/24 10:03:43 | 000,000,046 | ---- | C] () -- C:\WINDOWS\QTW.INI
    [2003/10/16 22:03:58 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
    [2003/10/05 13:11:01 | 000,000,034 | ---- | C] () -- C:\WINDOWS\wininit.ini
    [2003/10/05 13:10:40 | 000,000,018 | ---- | C] () -- C:\WINDOWS\msoffice.ini
    [2003/08/17 12:53:24 | 000,000,050 | ---- | C] () -- C:\WINDOWS\qwimp.ini
    [2003/04/10 07:33:14 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\PcdrKernelModeServices.dll
    [2003/04/10 07:33:14 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\ProgressTrace.dll
    [2003/04/10 07:10:20 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\PCDrJNI_1_1.dll
    [2003/04/10 07:08:02 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\syscontr.dll
    [2003/04/10 07:08:01 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll
    [2003/04/10 07:07:51 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2003/04/10 07:00:09 | 000,000,052 | ---- | C] () -- C:\WINDOWS\intuprof.ini
    [2003/04/10 06:59:52 | 000,000,626 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
    [2003/04/10 06:53:45 | 000,000,051 | ---- | C] () -- C:\WINDOWS\System32\mshrml.ini
    [2003/04/10 06:36:30 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
    [2003/04/10 06:16:02 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
    [2003/04/10 06:06:11 | 000,299,073 | ---- | C] () -- C:\WINDOWS\System32\PythonCOM22.dll
    [2003/04/10 06:06:11 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\PyWinTypes22.dll
    [2003/04/10 06:05:46 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll
    [2003/04/10 05:53:32 | 000,000,802 | ---- | C] () -- C:\WINDOWS\orun32.ini
    [2003/04/10 05:37:43 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
    [2003/04/10 03:08:18 | 000,000,438 | ---- | C] () -- C:\WINDOWS\System32\1_ssetup.ini
    [2003/04/10 03:08:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\sunistlog.ini
    [2003/03/19 19:50:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
    [2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
    [2002/05/24 11:00:00 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lockout.dll
    [2002/05/24 11:00:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\lockres.dll
    [2000/06/30 00:57:28 | 000,125,472 | ---- | C] () -- C:\WINDOWS\System32\hpf9xdr0.drv

    ========== LOP Check ==========

    [2010/04/13 20:48:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
    [2009/06/16 11:20:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Defender Pro
    [2006/05/25 22:16:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
    [2007/07/03 19:21:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Aim
    [2006/09/10 17:23:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\BellSouth
    [2003/08/17 15:47:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Games
    [2007/12/29 09:52:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Hoyle Blackjack
    [2008/03/26 23:12:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Hoyle Card Games
    [2008/02/03 02:15:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Hoyle FaceCreator
    [2009/11/10 14:54:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\interMute
    [2003/04/10 06:58:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\InterTrust
    [2005/01/06 15:52:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\InterVideo
    [2008/02/21 15:56:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Leadertech
    [2003/04/10 07:08:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\SampleView
    [2003/07/05 16:43:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Template
    [2007/07/02 23:02:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\WeatherBug
    [2008/10/12 18:31:19 | 000,000,272 | ---- | M] () -- C:\WINDOWS\Tasks\easy Internet sign-up.job
    [2010/07/25 00:23:04 | 000,000,340 | ---- | M] () -- C:\WINDOWS\Tasks\PCHealth Scheduler for Upload Library.job

    ========== Purity Check ==========


    < End of report >
     
    Blue Star,
    #23
  5. 2010/07/25
    Blue Star

    Blue Star Well-Known Member Thread Starter

    Joined:
    2010/03/25
    Messages:
    454
    Likes Received:
    2
    do I still run systemlook? thx...
     
    Blue Star,
    #24
  6. 2010/07/25
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    No. You're fine :)

    Last scans...

    1. Download Security Check from HERE, and save it to your Desktop.

    * Double-click SecurityCheck.exe
    * Follow the onscreen instructions inside of the black box.
    * A Notepad document should open automatically called checkup.txt; please post the contents of that document.

    2. Download Temp File Cleaner (TFC)
    Double click on TFC.exe to run the program.
    Click on Start button to begin cleaning process.
    TFC will close all running programs, and it may ask you to restart computer.


    3. Go to Kaspersky website and perform an online antivirus scan.

    1. Disable your active antivirus program.
    2. Read through the requirements and privacy statement and click on Accept button.
    3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    4. When the downloads have finished, click on Settings.
    5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

    • Spyware, Adware, Dialers, and other potentially dangerous programs
      [*] Archives
      [*] Mail databases
    6. Click on My Computer under Scan.
    7. Once the scan is complete, it will display the results. Click on View Scan Report.
    8. You will see a list of infected items there. Click on Save Report As....
    9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.
     
    broni,
    #25
  7. 2010/07/25
    Blue Star

    Blue Star Well-Known Member Thread Starter

    Joined:
    2010/03/25
    Messages:
    454
    Likes Received:
    2
    security check..........

    Results of screen317's Security Check version 0.99.4
    Windows XP Service Pack 3
    Internet Explorer 8
    ``````````````````````````````
    Antivirus/Firewall Check:
    Windows Firewall Enabled!
    avast! Free Antivirus
    ESET Online Scanner v3
    ```````````````````````````````
    Anti-malware/Other Utilities Check:
    Malwarebytes' Anti-Malware
    HijackThis 2.0.2
    Java(TM) 6 Update 21
    Out of date Java installed!
    Adobe Flash Player
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent
    Alwil Software Avast5 AvastSvc.exe
    ALWILS~1 Avast5 avastUI.exe
    ````````````````````````````````
    DNS Vulnerability Check:
    GREAT! (Not vulnerable to DNS cache poisoning)

    ``````````End of Log````````````
     
    Blue Star,
    #26
  8. 2010/07/25
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Still waiting :)
     
    broni,
    #27
  9. 2010/07/25
    Blue Star

    Blue Star Well-Known Member Thread Starter

    Joined:
    2010/03/25
    Messages:
    454
    Likes Received:
    2
    When I attempt to run kaspersky, I get java error messages with a prompt to continue anyway. When I do run the scan it hangs up about 3-4 hours after it began.

    Kaspersky warns me about having another AV running, but I have already disabled the avast.

    hmmm... what to do?
     
    Blue Star,
    #28
  10. 2010/07/25
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Stop Kaspersky....

    Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • IMOPRTANT! UN-check Remove found threats
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Push Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
     
    broni,
    #29
  11. 2010/07/25
    Blue Star

    Blue Star Well-Known Member Thread Starter

    Joined:
    2010/03/25
    Messages:
    454
    Likes Received:
    2
    firewall and avast are disabled..................
     
    Blue Star,
    #30
  12. 2010/07/25
    Blue Star

    Blue Star Well-Known Member Thread Starter

    Joined:
    2010/03/25
    Messages:
    454
    Likes Received:
    2
    ok....will do
     
    Blue Star,
    #31
  13. 2010/07/25
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Don't disable firewall. It's not a good idea.
    Did you read my previous post?
     
    broni,
    #32
  14. 2010/07/25
    Blue Star

    Blue Star Well-Known Member Thread Starter

    Joined:
    2010/03/25
    Messages:
    454
    Likes Received:
    2
    would this go a bit easier if I uninstall Office and HP diagnostics?
     
    Blue Star,
    #33
  15. 2010/07/25
    Blue Star

    Blue Star Well-Known Member Thread Starter

    Joined:
    2010/03/25
    Messages:
    454
    Likes Received:
    2
    yes... read it running eset now....firewall back up
     
    Blue Star,
    #34
  16. 2010/07/25
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Cool :)
     
    broni,
    #35
  17. 2010/07/25
    Blue Star

    Blue Star Well-Known Member Thread Starter

    Joined:
    2010/03/25
    Messages:
    454
    Likes Received:
    2
    we're at 60 min/32% for eset.......
     
    Blue Star,
    #36
  18. 2010/07/25
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    No worries. Leave it overnight.
    We're almost done :)
     
    broni,
    #37
  19. 2010/07/26
    Blue Star

    Blue Star Well-Known Member Thread Starter

    Joined:
    2010/03/25
    Messages:
    454
    Likes Received:
    2
    4 quarantined items, but nowhere to save to text....what now, please.

    eset results window is still open....
     
    Blue Star,
    #38
  20. 2010/07/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    If they're quarantined, you're safe and we're done :)

    OTL Clean-Up
    Clean up with OTL:

    * Double-click OTL.exe to start the program.
    * Close all other programs apart from OTL as this step will require a reboot
    * On the OTL main screen, press the CLEANUP button
    * Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    ===============================================================

    Your computer is clean :)

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point.

    Turn off System Restore:

    - Windows XP:
    1. Click Start.
    2. Right-click the My Computer icon, and then click Properties.
    3. Click the System Restore tab.
    4. Check "Turn off System Restore ".
    5. Click Apply.
    6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
    7. Click OK.
    - Windows Vista and 7:
    1. Click Start.
    2. Right-click the Computer icon, and then click Properties.
    3. Click on System Protection under the Tasks column on the left side
    4. Click on Continue on the "User Account Control" window that pops up
    5. Under the System Protection tab, find Available Disks
    6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C: ")
    7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
    8. Click OK

    2. Restart computer.

    3. Turn System Restore on.

    4. Make sure, Windows Updates are current.

    [SIZE= "4"]5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately![/SIZE]

    6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    7. Run defrag at your convenience.

    8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    9. Please, let me know, how is your computer doing.
     
    broni,
    #39
  21. 2010/07/29
    Blue Star

    Blue Star Well-Known Member Thread Starter

    Joined:
    2010/03/25
    Messages:
    454
    Likes Received:
    2
    Doing the final steps now, I had to travel for business the past couple of days, so sorry. Thank you a million swedish fish for all your selfless help!!! I truly appreciate your time! :D
     
    Blue Star,
    #40
Page 2 of 3

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...