Solved AVG Resident Shield Detected Virus

Thanks for your help broni. Here is the 2nd report

ComboFix 10-09-08.01 - Pam 09/09/2010 1:03.9.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.2.1033.18.767.401 [GMT -4:00]
Running from: c:\documents and settings\Pam\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Pam\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
* Created a new restore point

FILE ::
"c:\windows\Rgukua.exe "
"c:\windows\Rgukub.exe "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Rgukua.exe
c:\windows\Rgukub.exe
c:\windows\system32\linkinfo(2).dll

.
((((((((((((((((((((((((( Files Created from 2010-08-09 to 2010-09-09 )))))))))))))))))))))))))))))))
.

2010-09-08 09:35 . 2010-09-08 09:35 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2010-09-08 09:35 . 2010-09-08 09:35 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\Google
2010-09-07 14:44 . 2010-09-07 14:44 -------- d-----w- c:\documents and settings\Pam\Application Data\AVG9
2010-09-07 01:47 . 2010-09-08 08:10 0 ----a-w- c:\windows\Xsedegucob.bin
2010-09-07 01:47 . 2010-09-08 16:59 120 ----a-w- c:\windows\Driquwipiq.dat
2010-09-07 01:44 . 2010-09-07 01:44 -------- d-----w- C:\spoolerlogs
2010-09-07 01:43 . 2010-09-07 01:43 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-09-06 04:16 . 2010-09-06 04:16 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles
2010-09-03 16:56 . 2010-09-03 16:56 -------- d-----w- c:\documents and settings\Pam\Local Settings\Application Data\Sun
2010-09-03 16:49 . 2010-09-03 16:49 -------- d-----w- c:\documents and settings\Pam\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150000}
2010-09-03 16:22 . 2010-09-03 17:50 410984 ----a-w- c:\windows\system32\deploytk.dll
2010-09-01 13:48 . 2008-05-30 18:19 507400 ----a-w- c:\windows\system32\XAudio2_1.dll
2010-09-01 13:48 . 2008-05-30 18:17 65032 ----a-w- c:\windows\system32\XAPOFX1_0.dll
2010-09-01 13:48 . 2008-05-30 18:18 238088 ----a-w- c:\windows\system32\xactengine3_1.dll
2010-09-01 13:48 . 2008-05-30 18:17 25608 ----a-w- c:\windows\system32\X3DAudio1_4.dll
2010-09-01 13:48 . 2008-05-30 18:11 467984 ----a-w- c:\windows\system32\d3dx10_38.dll
2010-09-01 13:48 . 2008-05-30 18:11 1491992 ----a-w- c:\windows\system32\D3DCompiler_38.dll
2010-09-01 13:48 . 2008-05-30 18:11 3850760 ----a-w- c:\windows\system32\D3DX9_38.dll
2010-09-01 13:47 . 2010-09-01 13:48 -------- d-----w- c:\windows\Logs
2010-08-31 02:38 . 2010-08-31 02:38 -------- d-----w- c:\documents and settings\Pam\Application Data\funkitron
2010-08-29 23:38 . 2010-09-08 17:43 -------- d-----w- c:\documents and settings\Pam\Local Settings\Application Data\Temp
2010-08-29 17:10 . 2010-08-29 17:13 -------- d-----w- c:\windows\nview
2010-08-29 17:10 . 2005-04-01 20:16 176128 ----a-w- c:\windows\system32\nvudisp.exe
2010-08-29 17:09 . 2010-08-29 17:09 -------- d-----w- C:\NVIDIA
2010-08-29 16:47 . 2010-08-29 16:47 -------- d-----w- c:\program files\SystemRequirementsLab
2010-08-29 16:47 . 2010-08-29 16:47 -------- d-----w- c:\documents and settings\Pam\Application Data\SystemRequirementsLab
2010-08-29 16:47 . 2010-08-29 16:47 290816 ----a-w- c:\documents and settings\Pam\Application Data\SystemRequirementsLab\SRLProxy_nvd_4.dll
2010-08-29 16:47 . 2010-08-29 16:47 290816 ----a-w- c:\documents and settings\Pam\Application Data\SystemRequirementsLab\SRLProxy_nvd_3.dll
2010-08-29 16:47 . 2010-08-29 16:47 290816 ----a-w- c:\documents and settings\Pam\Application Data\SystemRequirementsLab\SRLProxy_nvd_2.dll
2010-08-29 16:47 . 2010-08-29 16:47 290816 ----a-w- c:\documents and settings\Pam\Application Data\SystemRequirementsLab\SRLProxy_nvd_1.dll
2010-08-29 04:43 . 2010-09-02 05:00 -------- d-----w- c:\program files\Electronic Arts
2010-08-29 04:35 . 2010-08-29 04:35 61440 ----a-w- c:\documents and settings\Pam\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-7cb02efe-n\decora-sse.dll
2010-08-29 04:35 . 2010-08-29 04:35 503808 ----a-w- c:\documents and settings\Pam\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-50380c86-n\msvcp71.dll
2010-08-29 04:35 . 2010-08-29 04:35 499712 ----a-w- c:\documents and settings\Pam\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-50380c86-n\jmc.dll
2010-08-29 04:35 . 2010-08-29 04:35 348160 ----a-w- c:\documents and settings\Pam\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-50380c86-n\msvcr71.dll
2010-08-29 04:35 . 2010-08-29 04:35 12800 ----a-w- c:\documents and settings\Pam\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-7cb02efe-n\decora-d3d.dll
2010-08-29 04:35 . 2010-09-02 17:13 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-08-29 03:25 . 2010-08-29 03:25 -------- d-sh--w- c:\documents and settings\Pam\IECompatCache
2010-08-29 03:15 . 2010-08-29 03:15 -------- d-sh--w- c:\documents and settings\Pam\PrivacIE
2010-08-29 03:14 . 2010-08-29 03:14 -------- d-sh--w- c:\documents and settings\Pam\IETldCache
2010-08-29 03:07 . 2010-08-29 03:07 -------- d-----w- c:\windows\ie8updates
2010-08-29 03:04 . 2010-08-29 03:05 -------- dc-h--w- c:\windows\ie8
2010-08-29 02:20 . 2010-05-06 10:41 599040 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-08-29 02:20 . 2010-05-06 10:41 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-08-29 02:20 . 2010-05-06 10:41 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-08-29 02:20 . 2010-05-06 10:41 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-08-29 02:20 . 2010-05-06 10:41 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-08-29 02:20 . 2010-05-06 10:41 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-08-29 02:20 . 2010-05-06 10:41 11076096 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-08-15 16:55 . 2010-08-15 16:55 -------- d-----w- c:\documents and settings\Pam\Application Data\Amaranth Games
2010-08-15 04:53 . 2010-08-15 04:53 -------- d-----w- c:\documents and settings\All Users\Application Data\EA
2010-08-15 04:43 . 2010-08-15 04:43 -------- d-----w- c:\documents and settings\Pam\Application Data\EA
2010-08-15 01:47 . 2010-09-08 17:27 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-08-15 01:46 . 2010-08-15 01:46 -------- d-----w- c:\program files\Common Files\Oberon Media
2010-08-15 01:46 . 2010-09-01 13:57 -------- d-----w- c:\program files\Oberon Media

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-09 04:52 . 2007-04-02 04:20 112944 ----a-w- c:\documents and settings\Pam\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-09-09 04:15 . 2009-06-16 19:44 -------- d-----w- c:\program files\Microsoft Home Publishing
2010-09-09 01:03 . 2009-01-08 04:04 -------- d-----w- c:\documents and settings\Pam\Application Data\Hoyle Card Games
2010-09-08 17:18 . 2010-03-17 21:28 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-09-08 09:11 . 2008-06-25 01:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-09-08 01:13 . 2007-04-06 23:01 -------- d-----w- c:\program files\PowerISO
2010-09-07 05:56 . 2009-01-09 03:44 -------- d-----w- c:\documents and settings\Pam\Application Data\Hoyle Puzzle and Board Games
2010-09-07 02:44 . 2008-08-30 09:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-06 04:46 . 2007-06-05 05:32 -------- d-----w- c:\program files\BFG
2010-09-06 04:05 . 2010-01-12 05:09 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2010-09-03 17:25 . 2007-04-28 01:41 -------- d-----w- c:\program files\Java
2010-09-01 17:10 . 2008-05-22 14:29 -------- d-----w- c:\program files\Common Files\EasyInfo
2010-09-01 14:01 . 2007-10-30 03:50 -------- d-----w- c:\documents and settings\Pam\Application Data\Pogo Games
2010-07-30 21:31 . 2008-08-26 06:24 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-30 21:31 . 2010-07-30 21:31 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-30 21:31 . 2008-08-26 06:24 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-07-30 21:27 . 2008-08-26 06:24 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-23 22:28 . 2010-07-23 22:28 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-07-23 22:28 . 2010-07-23 22:28 -------- d-----w- c:\program files\NOS
2010-07-23 21:22 . 2010-08-09 04:13 1496064 ----a-w- c:\documents and settings\Pam\Application Data\Mozilla\Firefox\Profiles\dbcuirvh.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-07-23 21:22 . 2010-08-09 04:13 43008 ----a-w- c:\documents and settings\Pam\Application Data\Mozilla\Firefox\Profiles\dbcuirvh.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-07-23 21:22 . 2010-08-09 04:13 338944 ----a-w- c:\documents and settings\Pam\Application Data\Mozilla\Firefox\Profiles\dbcuirvh.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-07-23 21:22 . 2010-08-09 04:13 346112 ----a-w- c:\documents and settings\Pam\Application Data\Mozilla\Firefox\Profiles\dbcuirvh.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-03 68856]
"Google Update "= "c:\documents and settings\Pam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-08-29 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxioDragToDisc "= "c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-10-30 1116920]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"AVG9_TRAY "= "c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-30 2065760]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2005-04-01 5562368]
"nwiz "= "nwiz.exe" [2005-04-01 1495040]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2005-04-01 86016]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2010-09-03 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator "= "Narrator.exe" [2004-08-04 53760]

c:\documents and settings\Pam\Start Menu\Programs\Startup\
Microsoft Greetings Reminders.lnk - c:\program files\Microsoft Home Publishing\MHPRMIND.EXE [1998-8-13 40960]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Microsoft Office.lnk - g:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-30 21:31 12536 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-04 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 21:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]
2001-09-24 11:59 73728 ----a-w- c:\program files\NavNT\vptray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
"c:\\Program Files\\MSN Messenger\\livecall.exe "=
"g:\\Program Files\\Hasbro Interactive\\Classic Games\\ClassicCard.exe "=
"c:\\Program Files\\BitTornado\\btdownloadgui.exe "=
"c:\\WINDOWS\\system32\\dplaysvr.exe "=
"g:\\Program Files\\Infogrames Interactive\\Scrabble Complete\\ScrabbleComplete.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"g:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe "=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/26/2008 2:24 AM 216400]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [8/26/2008 2:24 AM 243024]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [1/8/2010 1:51 AM 380928]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [7/30/2010 5:27 PM 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/30/2010 5:31 PM 308136]
R3 INIDVD;Initio USB DVD Filter Driver;c:\windows\system32\drivers\inidvd.sys [8/25/2008 10:02 PM 7936]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12/9/2007 7:35 PM 682232]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-09-09 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-04-02 02:05]

2010-09-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-688789844-1060284298-1003Core.job
- c:\documents and settings\Pam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-29 23:38]

2010-09-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-688789844-1060284298-1003UA.job
- c:\documents and settings\Pam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-29 23:38]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/ig?hl=en
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {{B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0} - g:\program files\PartyGaming\PartyBingo\RunBingo.exe
LSP: c:\program files\FoxyProxy\FoxyProxy Video Utility\FPServiceProvider.dll
Trusted Zone: corrie.net\www
Trusted Zone: corriespace.com\www
Trusted Zone: csvu.net\www
Trusted Zone: netfile.gc.ca\www
Trusted Zone: pogo.com
Trusted Zone: pogo.com\www
Handler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - g:\progra~1\QUICKT~1\ic2007pp.dll
FF - ProfilePath - c:\documents and settings\Pam\Application Data\Mozilla\Firefox\Profiles\dbcuirvh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/ig?hl=en&sourceid=navclient-ff&rlz=1R0MOZA_en&ie=UTF-8&source=iglk
FF - component: c:\documents and settings\Pam\Application Data\Mozilla\Firefox\Profiles\dbcuirvh.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\documents and settings\Pam\Local Settings\Application Data\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-09 01:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\INIDVD]
"ImagePath "=multi: "system32\DRIVERS\inidvd.sys\00 "

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\INIDVD]
"ImagePath "=multi: "system32\DRIVERS\inidvd.sys\00 "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1220945662-688789844-1060284298-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1220945662-688789844-1060284298-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"?? "=hex:95,76,56,e3,ca,06,c8,9d,31,c5,8b,8b,f2,41,3d,9b,01,fe,95,1d,3e,8a,d5,
40,2f,be,20,23,bf,c1,6b,84,6a,76,d1,a7,d9,da,74,ca,64,97,22,be,8b,0e,c3,e8,\
"?? "=hex:5e,70,69,e3,77,23,94,d1,9a,32,42,7a,ca,63,af,77
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(552)
c:\windows\system32\NavLogon.dll

- - - - - - - > 'lsass.exe'(608)
c:\program files\FoxyProxy\FoxyProxy Video Utility\FPServiceProvider.dll
.
Completion time: 2010-09-09 01:12:52
ComboFix-quarantined-files.txt 2010-09-09 05:12
ComboFix2.txt 2010-09-09 04:21

Pre-Run: 24,514,617,344 bytes free
Post-Run: 24,505,049,088 bytes free

- - End Of File - - E77E80625F4782F149D521F875C28986

 

Malwarebytes:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4578

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

9/9/2010 1:56:05 AM
mbam-log-2010-09-09 (01-56-05).txt

Scan type: Quick scan
Objects scanned: 129365
Time elapsed: 10 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


GMER log:

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2010-09-09 02:09:59
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.14 ----

Code \??\C:\ComboFix\catchme.sys pIofCallDriver

---- Kernel code sections - GMER 1.0.14 ----

? Combo-Fix.sys The system cannot find the file specified. !
? C:\DOCUME~1\Pam\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !
? C:\ComboFix\catchme.sys The system cannot find the path specified. !
? C:\WINDOWS\system32\Drivers\PROCEXP113.SYS The system cannot find the file specified. !

---- User code sections - GMER 1.0.14 ----

.text C:\Program Files\Mozilla Firefox\firefox.exe[2920] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[3548] USER32.dll!TrackPopupMenu 77D94F16 5 Bytes JMP 1044721D C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- Devices - GMER 1.0.14 ----

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Roxio)

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 g:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x14 0xAD 0x0F 0x22 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0E 0x43 0xFF 0x7A ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x49 0x34 0xCF 0xA0 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x8B 0xF4 0x6F 0x5F ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 g:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x14 0xAD 0x0F 0x22 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0E 0x43 0xFF 0x7A ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x49 0x34 0xCF 0xA0 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x8B 0xF4 0x6F 0x5F ...

---- EOF - GMER 1.0.14 ----


MBRCheck log:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x00000275

Kernel Drivers (total 130):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EC000 \WINDOWS\system32\hal.dll
0xF7A2F000 \WINDOWS\system32\KDCOM.DLL
0xF793F000 \WINDOWS\system32\BOOTVID.dll
0xF74E0000 ACPI.sys
0xF7A31000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF74CF000 pci.sys
0xF752F000 isapnp.sys
0xF7A33000 intelide.sys
0xF77AF000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF753F000 MountMgr.sys
0xF74B0000 ftdisk.sys
0xF7A35000 dmload.sys
0xF748A000 dmio.sys
0xF77B7000 PartMgr.sys
0xF754F000 VolSnap.sys
0xF7472000 atapi.sys
0xF755F000 disk.sys
0xF756F000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF7452000 fltMgr.sys
0xF7440000 sr.sys
0xF742A000 DRVMCDB.SYS
0xF757F000 PxHelp20.sys
0xF7413000 KSecDD.sys
0xF7386000 Ntfs.sys
0xF7359000 NDIS.sys
0xF758F000 Combo-Fix.sys
0xF733E000 Mup.sys
0xF759F000 agp440.sys
0xF778F000 \SystemRoot\system32\DRIVERS\processr.sys
0xF6D60000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF6D4C000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF789F000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF6D29000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF78A7000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF6D18000 \SystemRoot\system32\DRIVERS\el90xbc5.sys
0xF78AF000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF779F000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF78B7000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF78BF000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF75BF000 \SystemRoot\system32\DRIVERS\serial.sys
0xF7A27000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF6D04000 \SystemRoot\system32\DRIVERS\parport.sys
0xF75CF000 \SystemRoot\system32\drivers\Imapi.sys
0xF7A5F000 \SystemRoot\System32\Drivers\DLACDBHM.SYS
0xF75DF000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF75EF000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF6CE1000 \SystemRoot\system32\DRIVERS\ks.sys
0xF6CC9000 \SystemRoot\system32\drivers\ac97intc.sys
0xF6CA5000 \SystemRoot\system32\drivers\portcls.sys
0xF75FF000 \SystemRoot\system32\drivers\drmk.sys
0xF7BCE000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF760F000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF70CC000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6C8E000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF761F000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF762F000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF78C7000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF6C7D000 \SystemRoot\system32\DRIVERS\psched.sys
0xF763F000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF78CF000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF78D7000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF6C4C000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF764F000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7A61000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF6B78000 \SystemRoot\system32\DRIVERS\update.sys
0xF70B0000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF765F000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF766F000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7A67000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF78DF000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7A69000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7B77000 \SystemRoot\System32\Drivers\Null.SYS
0xF7A6B000 \SystemRoot\System32\Drivers\Beep.SYS
0xF78EF000 \SystemRoot\System32\Drivers\DLARTL_M.SYS
0xF78F7000 \SystemRoot\System32\drivers\vga.sys
0xF7A6D000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7A6F000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF78FF000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7907000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF79EB000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF5995000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF593D000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF5903000 \SystemRoot\System32\Drivers\avgtdix.sys
0xF58E2000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF768F000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF7A71000 \SystemRoot\system32\DRIVERS\inidvd.sys
0xF790F000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xF58BA000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF5898000 \SystemRoot\System32\drivers\afd.sys
0xF769F000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF586C000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF57FD000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF76AF000 \SystemRoot\System32\Drivers\Fips.SYS
0xF791F000 \SystemRoot\System32\Drivers\avgmfx86.sys
0xF57C9000 \SystemRoot\System32\Drivers\avgldx86.sys
0xF577E000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF76EF000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF5766000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7A85000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF7927000 \SystemRoot\System32\watchdog.sys
0xF6B58000 \SystemRoot\System32\drivers\Dxapi.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7C43000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xF6BFC000 \SystemRoot\System32\Drivers\DRVNDDM.SYS
0xF7C6D000 \SystemRoot\System32\DLA\DLADResM.SYS
0xF351E000 \SystemRoot\System32\DLA\DLAIFS_M.SYS
0xF7937000 \SystemRoot\System32\DLA\DLAOPIOM.SYS
0xF7A91000 \SystemRoot\System32\DLA\DLAPoolM.SYS
0xF77CF000 \SystemRoot\System32\DLA\DLABMFSM.SYS
0xF77D7000 \SystemRoot\System32\DLA\DLABOIOM.SYS
0xF34E0000 \SystemRoot\System32\DLA\DLAUDFAM.SYS
0xF34C9000 \SystemRoot\System32\DLA\DLAUDF_M.SYS
0xF3536000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xF30F4000 \SystemRoot\system32\drivers\wdmaud.sys
0xF3439000 \SystemRoot\system32\drivers\sysaudio.sys
0xF2FDA000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF7A3F000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xF2E32000 \??\C:\Program Files\NavNT\NAVAPEL.SYS
0xF2CDF000 \SystemRoot\system32\DRIVERS\srv.sys
0xF7917000 \??\C:\DOCUME~1\Pam\LOCALS~1\Temp\mbr.sys
0xF2866000 \SystemRoot\System32\Drivers\HTTP.sys
0xF7837000 \??\C:\ComboFix\catchme.sys
0xF7AE9000 \??\C:\WINDOWS\system32\Drivers\PROCEXP113.SYS
0xF788F000 \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys
0xF1D0D000 \SystemRoot\system32\drivers\kmixer.sys
0xF1CA3000 \SystemRoot\System32\DRIVERS\gmer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 36):
0 System Idle Process
4 System
472 C:\WINDOWS\system32\smss.exe
528 csrss.exe
552 C:\WINDOWS\system32\winlogon.exe
596 C:\WINDOWS\system32\services.exe
608 C:\WINDOWS\system32\lsass.exe
832 C:\WINDOWS\system32\svchost.exe
888 svchost.exe
956 C:\WINDOWS\system32\svchost.exe
1012 svchost.exe
1076 C:\Program Files\AVG\AVG9\avgchsvx.exe
1084 C:\Program Files\AVG\AVG9\avgrsx.exe
1128 svchost.exe
1256 C:\Program Files\AVG\AVG9\avgcsrvx.exe
1624 C:\WINDOWS\system32\spoolsv.exe
408 C:\Program Files\Application Updater\ApplicationUpdater.exe
432 C:\Program Files\AVG\AVG9\avgwdsvc.exe
724 C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
864 C:\Program Files\NavNT\defwatch.exe
932 C:\PROGRA~1\AVG\AVG9\avgtray.exe
1316 C:\Program Files\Microsoft Home Publishing\MHPRMIND.EXE
1828 C:\Program Files\Java\jre6\bin\jqs.exe
1916 C:\WINDOWS\system32\nvsvc32.exe
1444 C:\WINDOWS\system32\svchost.exe
1824 wdfmgr.exe
2088 C:\Program Files\AVG\AVG9\avgemc.exe
2180 C:\Program Files\AVG\AVG9\avgnsx.exe
2484 C:\Program Files\AVG\AVG9\avgcsrvx.exe
3604 C:\WINDOWS\system32\wscntfy.exe
3720 alg.exe
3300 C:\WINDOWS\explorer.exe
2920 C:\Program Files\Mozilla Firefox\firefox.exe
3548 C:\Program Files\Mozilla Firefox\plugin-container.exe
3500 C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
3068 C:\Documents and Settings\Pam\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\G: --> \\.\PhysicalDrive1 at offset 0x00000000`00043400 (FAT32)

PhysicalDrive0 Model Number: WDCWD400BB-75AUA1, Rev: 18.20D18
PhysicalDrive1 Model Number: OEI-USB2StorageVault HD, Rev: 1.19

Size Device Name MBR Status
--------------------------------------------
37 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
232 GB \\.\PhysicalDrive1 RE: Unknown MBR code
SHA1: BBF289AC40BA09F2CC1797655D4799D2AB148CB5


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

 

The computer is 90% better, thanks. There's been only 1 AVG res shield threat notice today.

OTL logfile created on: 9/9/2010 8:37:45 PM - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\Pam\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

767.00 Mb Total Physical Memory | 283.00 Mb Available Physical Memory | 37.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 65.00% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.26 Gb Total Space | 22.81 Gb Free Space | 61.21% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 650.05 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 618.95 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive G: | 232.83 Gb Total Space | 115.49 Gb Free Space | 49.60% Space Free | Partition Type: FAT32
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 489.88 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: HOME-OFFICE
Current User Name: Pam
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/09/09 20:36:47 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pam\Desktop\OTL.exe
PRC - [2010/07/30 17:31:29 | 002,065,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2010/07/30 17:31:25 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010/07/30 17:31:24 | 000,620,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010/07/30 17:31:08 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010/07/30 17:27:48 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe
PRC - [2010/07/30 17:27:45 | 000,723,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2010/07/30 17:27:42 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010/07/25 14:33:58 | 000,014,808 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
PRC - [2010/07/25 14:33:52 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/01/08 01:51:02 | 000,380,928 | ---- | M] (Spigot, Inc.) -- C:\Program Files\Application Updater\ApplicationUpdater.exe
PRC - [2007/06/13 06:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/10/30 09:00:00 | 001,116,920 | ---- | M] (Roxio) -- C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
PRC - [2001/09/24 07:59:00 | 000,032,768 | ---- | M] (Symantec Corporation) -- C:\Program Files\NavNT\defwatch.exe
PRC - [1998/08/13 00:00:00 | 000,040,960 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Home Publishing\MHPRMIND.EXE


========== Modules (SafeList) ==========

MOD - [2010/09/09 20:36:47 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pam\Desktop\OTL.exe
MOD - [2004/08/04 08:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
MOD - [2004/08/04 08:00:00 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - [2010/07/30 17:31:08 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2010/07/30 17:27:48 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2010/03/29 08:53:22 | 000,068,000 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2010/01/08 01:51:02 | 000,380,928 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2001/09/24 07:59:00 | 000,454,656 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\NavNT\rtvscan.exe -- (Norton AntiVirus Server)
SRV - [2001/09/24 07:59:00 | 000,032,768 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\NavNT\defwatch.exe -- (DefWatch)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Pam\LOCALS~1\Temp\mbr.sys -- (mbr)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2010/09/09 01:58:06 | 000,085,969 | ---- | M] (GMER) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gmer.sys -- (gmer)
DRV - [2010/07/30 17:31:27 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010/07/30 17:31:24 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2010/07/30 17:27:45 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2008/08/27 04:00:00 | 000,873,552 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080827.038\NAVEX15.SYS -- (NAVEX15)
DRV - [2008/08/27 04:00:00 | 000,089,104 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080827.038\NAVENG.SYS -- (NAVENG)
DRV - [2007/12/09 19:35:34 | 000,682,232 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2007/11/07 10:18:54 | 000,007,936 | R--- | M] (Initio Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\inidvd.sys -- (INIDVD)
DRV - [2007/02/09 12:34:16 | 000,051,768 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DRVNDDM.SYS -- (DRVNDDM)
DRV - [2007/02/08 20:05:30 | 000,028,120 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_M.SYS -- (DLARTL_M)
DRV - [2007/02/08 20:05:30 | 000,012,856 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2006/10/26 16:22:02 | 000,009,400 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLADResM.SYS -- (DLADResM)
DRV - [2006/10/26 16:21:34 | 000,094,648 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2006/10/26 16:21:34 | 000,035,096 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLABMFSM.SYS -- (DLABMFSM)
DRV - [2006/10/26 16:21:32 | 000,097,848 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2006/10/26 16:21:30 | 000,026,296 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2006/10/26 16:21:28 | 000,032,472 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2006/10/26 16:21:26 | 000,014,520 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2006/10/26 16:21:24 | 000,104,536 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2006/07/21 11:21:26 | 000,099,176 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS -- (DRVMCDB)
DRV - [2005/04/01 16:16:00 | 003,454,656 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2001/09/24 07:59:00 | 000,176,208 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\NavNT\navap.sys -- (NAVAP)
DRV - [2001/09/24 07:59:00 | 000,057,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Symantec\SYMEVENT.SYS -- (SymEvent)
DRV - [2001/09/24 07:59:00 | 000,009,232 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\NavNT\Navapel.sys -- (NAVAPEL)
DRV - [2001/08/17 08:20:04 | 000,096,256 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ac97intc.sys -- (ac97intc) Intel(r) 82801 Audio Driver Install Service (WDM)
DRV - [2001/08/17 08:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\el90xbc5.sys -- (EL90XBC)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ig?hl=en
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google "
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=867034 "
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "http://www.google.ca/ig?hl=en&sourceid=navclient-ff&rlz=1R0MOZA_en&ie=UTF-8&source=iglk "
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..network.proxy.http: "212.113.5.2 "
FF - prefs.js..network.proxy.http_port: 80
FF - prefs.js..network.proxy.ssl: "212.113.5.2 "
FF - prefs.js..network.proxy.ssl_port: 80

FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Documents and Settings\All Users\Application Data\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007/09/03 02:08:17 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/07/31 17:45:53 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{CE7704D7-CC9D-43AD-B5CB-05765B02369C}: C:\Documents and Settings\Pam2\Local Settings\Application Data\{CE7704D7-CC9D-43AD-B5CB-05765B02369C}
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/29 14:20:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/03 12:22:04 | 000,000,000 | ---D | M]

[2009/08/28 21:33:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\Mozilla\Extensions
[2010/09/04 02:16:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\Mozilla\Firefox\Profiles\dbcuirvh.default\extensions
[2010/08/09 00:13:55 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Documents and Settings\Pam\Application Data\Mozilla\Firefox\Profiles\dbcuirvh.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/07/23 18:27:59 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Documents and Settings\Pam\Application Data\Mozilla\Firefox\Profiles\dbcuirvh.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/09/06 03:10:04 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/09/02 13:13:10 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/03/03 23:18:40 | 000,151,552 | ---- | M] (PopCap Games) -- C:\Program Files\Mozilla Firefox\plugins\nppopcaploader.dll

O1 HOSTS File: ([2010/09/09 01:10:15 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [RoxioDragToDisc] C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe (Roxio)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -Mozilla\5.0 ( File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Pam\Start Menu\Programs\Startup\Microsoft Greetings Reminders.lnk = C:\Program Files\Microsoft Home Publishing\MHPRMIND.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: PartyBingo.com - {B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0} - g:\Program Files\PartyGaming\PartyBingo\RunBingo.exe File not found
O9 - Extra 'Tools' menuitem : PartyBingo.com - {B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0} - g:\Program Files\PartyGaming\PartyBingo\RunBingo.exe File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\FoxyProxy\FoxyProxy Video Utility\FPServiceProvider.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\FoxyProxy\FoxyProxy Video Utility\FPServiceProvider.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\FoxyProxy\FoxyProxy Video Utility\FPServiceProvider.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files\FoxyProxy\FoxyProxy Video Utility\FPServiceProvider.dll ()
O12 - Plugin for: .IE5 - Reg Error: Value error. File not found
O12 - Plugin for: .pdf - C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll (Adobe Systems Inc.)
O15 - HKCU\..Trusted Domains: corrie.net ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: corriespace.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: csvu.net ([www] * in Trusted sites)
O15 - HKCU\..Trusted Domains: netfile.gc.ca ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: pogo.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: pogo.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: pogo.com ([www] https in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {32505657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab (Reg Error: Key error.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1283357971216 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.71.255.198
O18 - Protocol\Handler\intu-qt2007 {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - G:\Program Files\QuickTax 2007\ic2007pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)
O18 - Protocol\Handler\intu-qt2008 {05E53CE9-66C8-4a9e-A99F-FDB7A8E7B596} - G:\Program Files\QuickTax 2008\ic2008pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)
O18 - Protocol\Handler\intu-qt2009 {03947252-2355-4e9b-B446-8CCC75C43370} - C:\Program Files\QuickTax 2009\ic2009pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll ()
O24 - Desktop WallPaper: C:\WINDOWS\ACD Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\ACD Wallpaper.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/04/01 22:09:54 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [1998/08/12 08:02:22 | 000,000,051 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [1998/08/19 07:37:08 | 000,108,544 | R--- | M] () - E:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2006/09/22 16:21:00 | 001,026,856 | R--- | M] (Microsoft Corporation) - F:\autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2006/09/22 16:21:00 | 000,000,144 | R--- | M] () - F:\Autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2008/03/17 16:03:47 | 000,001,134 | R--- | M] () - J:\AutoInstall.dat -- [ CDFS ]
O32 - AutoRun File - [2008/09/17 15:14:12 | 000,234,824 | R--- | M] (Hewlett-Packard Development Company, L.P.) - J:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2008/03/17 16:03:47 | 000,000,038 | R--- | M] () - J:\Autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codecx.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corp.)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.MP42 - C:\WINDOWS\System32\MPG4C32.DLL (Microsoft Corporation)
Drivers32: VIDC.MPG4 - C:\WINDOWS\System32\MPG4C32.DLL (Microsoft Corporation)
Drivers32: VIDC.WMV3 - C:\WINDOWS\System32\wmv9vcm.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16620634377289728)

========== Files/Folders - Created Within 90 Days ==========

[2010/09/09 20:36:45 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Pam\Desktop\OTL.exe
[2010/09/09 01:58:06 | 000,085,969 | ---- | C] (GMER) -- C:\WINDOWS\System32\drivers\gmer.sys
[2010/09/08 23:53:52 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/09/08 23:53:52 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/09/08 23:53:52 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/09/08 23:53:52 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/09/08 23:49:42 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/09/08 23:48:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pam\My Documents\Downloads
[2010/09/07 21:40:02 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Pam\Recent
[2010/09/07 10:44:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pam\Application Data\AVG9
[2010/09/07 02:21:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/09/06 22:04:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/09/06 21:44:18 | 000,000,000 | ---D | C] -- C:\spoolerlogs
[2010/09/06 00:16:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\nView_Profiles
[2010/09/03 21:45:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pam\Desktop\Java
[2010/09/03 12:56:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pam\Local Settings\Application Data\Sun
[2010/09/03 12:49:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pam\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150000}
[2010/09/01 09:47:57 | 000,000,000 | ---D | C] -- C:\WINDOWS\Logs
[2010/08/30 22:38:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pam\My Documents\Slingo Mystery Documents
[2010/08/30 22:38:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pam\Application Data\funkitron
[2010/08/29 19:38:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pam\Local Settings\Application Data\Temp
[2010/08/29 13:10:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\nview
[2010/08/29 13:10:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ReinstallBackups
[2010/08/29 13:09:43 | 000,000,000 | ---D | C] -- C:\NVIDIA
[2010/08/29 12:47:46 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab
[2010/08/29 12:47:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pam\Application Data\SystemRequirementsLab
[2010/08/29 00:43:56 | 000,000,000 | ---D | C] -- C:\Program Files\Electronic Arts
[2010/08/29 00:36:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010/08/28 23:25:26 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Pam\IECompatCache
[2010/08/28 23:15:56 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Pam\PrivacIE
[2010/08/28 23:14:31 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Pam\IETldCache
[2010/08/28 23:07:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2010/08/28 23:05:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\WBEM
[2010/08/28 23:04:03 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/08/28 23:04:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en-US
[2010/08/15 12:55:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pam\Application Data\Amaranth Games
[2010/08/15 00:53:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\EA
[2010/08/15 00:43:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pam\Application Data\EA
[2010/08/14 21:47:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/08/14 21:46:55 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Oberon Media
[2010/08/14 21:46:17 | 000,000,000 | ---D | C] -- C:\Program Files\Oberon Media
[2010/07/30 17:31:24 | 000,012,536 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2010/07/23 18:28:05 | 000,000,000 | ---D | C] -- C:\Program Files\NOS
[2010/07/23 18:28:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NOS
[2010/06/15 09:07:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pam\Desktop\Alex's Games
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/09/09 20:36:47 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pam\Desktop\OTL.exe
[2010/09/09 19:43:04 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-688789844-1060284298-1003UA.job
[2010/09/09 19:43:04 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-688789844-1060284298-1003Core.job
[2010/09/09 11:56:10 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/09/09 11:50:54 | 064,468,357 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/09/09 11:45:20 | 000,021,961 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/09/09 11:45:07 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/09/09 11:45:01 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/09/09 11:45:00 | 804,405,248 | -HS- | M] () -- C:\hiberfil.sys
[2010/09/09 03:17:40 | 006,553,600 | ---- | M] () -- C:\Documents and Settings\Pam\ntuser.dat
[2010/09/09 03:17:40 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Pam\ntuser.ini
[2010/09/09 02:19:36 | 000,000,250 | ---- | M] () -- C:\WINDOWS\gmer.ini
[2010/09/09 01:58:06 | 000,884,736 | ---- | M] () -- C:\WINDOWS\gmer.dll
[2010/09/09 01:58:06 | 000,085,969 | ---- | M] (GMER) -- C:\WINDOWS\System32\drivers\gmer.sys
[2010/09/09 01:58:06 | 000,000,080 | ---- | M] () -- C:\WINDOWS\gmer_uninstall.cmd
[2010/09/09 01:10:27 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/09/09 01:10:15 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/09/09 00:52:32 | 000,112,944 | ---- | M] () -- C:\Documents and Settings\Pam\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/09/08 23:48:49 | 003,840,723 | R--- | M] () -- C:\Documents and Settings\Pam\Desktop\ComboFix.exe
[2010/09/08 13:45:28 | 000,002,246 | ---- | M] () -- C:\Documents and Settings\Pam\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/09/08 13:45:27 | 000,002,268 | ---- | M] () -- C:\Documents and Settings\Pam\Desktop\Google Chrome.lnk
[2010/09/08 12:59:55 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Driquwipiq.dat
[2010/09/08 05:10:29 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/09/08 04:10:12 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Xsedegucob.bin
[2010/09/07 10:11:20 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Pam\Desktop\MBRCheck.exe
[2010/09/06 20:16:23 | 000,063,347 | ---- | M] () -- C:\Documents and Settings\Pam\My Documents\duh.gif
[2010/09/06 20:15:49 | 000,016,820 | ---- | M] () -- C:\Documents and Settings\Pam\My Documents\oh no male.gif
[2010/09/05 22:47:09 | 000,000,678 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/09/05 22:47:09 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010/09/04 14:07:33 | 000,002,293 | ---- | M] () -- C:\Documents and Settings\Pam\Application Data\Microsoft\Internet Explorer\Quick Launch\Paint Shop Pro 7 (2).lnk
[2010/08/28 23:14:40 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Pam\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/08/28 23:06:36 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/08/16 14:37:52 | 000,392,776 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/14 09:45:07 | 002,277,738 | -H-- | M] () -- C:\Documents and Settings\Pam\Local Settings\Application Data\IconCache.db
[2010/08/12 10:54:50 | 005,878,784 | ---- | M] () -- C:\Documents and Settings\Pam\Desktop\corrie updates.xls
[2010/07/30 17:31:27 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/07/30 17:31:24 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/07/30 17:31:24 | 000,012,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2010/07/30 17:27:45 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/07/27 21:41:37 | 000,118,784 | ---- | M] () -- C:\Documents and Settings\Pam\Desktop\Bingo stats.xls
[2010/07/12 21:48:25 | 000,038,912 | ---- | M] () -- C:\Documents and Settings\Pam\Desktop\Reunioni.xls
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/09 01:58:08 | 000,000,250 | ---- | C] () -- C:\WINDOWS\gmer.ini
[2010/09/09 01:58:06 | 000,884,736 | ---- | C] () -- C:\WINDOWS\gmer.dll
[2010/09/09 01:58:06 | 000,000,080 | ---- | C] () -- C:\WINDOWS\gmer_uninstall.cmd
[2010/09/09 01:58:05 | 000,811,008 | ---- | C] () -- C:\WINDOWS\gmer.exe
[2010/09/09 01:54:53 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Pam\Desktop\MBRCheck.exe
[2010/09/09 01:41:32 | 000,811,008 | ---- | C] () -- C:\Documents and Settings\Pam\Desktop\gmer.exe
[2010/09/08 23:53:52 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/09/08 23:53:52 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/09/08 23:53:52 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/09/08 23:53:52 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/09/08 23:53:52 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/09/08 23:48:48 | 003,840,723 | R--- | C] () -- C:\Documents and Settings\Pam\Desktop\ComboFix.exe
[2010/09/06 21:47:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Xsedegucob.bin
[2010/09/06 21:47:33 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Driquwipiq.dat
[2010/09/06 20:16:22 | 000,063,347 | ---- | C] () -- C:\Documents and Settings\Pam\My Documents\duh.gif
[2010/09/06 20:15:48 | 000,016,820 | ---- | C] () -- C:\Documents and Settings\Pam\My Documents\oh no male.gif
[2010/08/29 19:40:48 | 000,002,268 | ---- | C] () -- C:\Documents and Settings\Pam\Desktop\Google Chrome.lnk
[2010/08/29 19:40:48 | 000,002,246 | ---- | C] () -- C:\Documents and Settings\Pam\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/08/29 19:38:51 | 000,000,970 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-688789844-1060284298-1003UA.job
[2010/08/29 19:38:49 | 000,000,918 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-688789844-1060284298-1003Core.job
[2010/08/29 13:10:26 | 000,014,435 | ---- | C] () -- C:\WINDOWS\System32\nvdisp.nvu
[2010/07/09 18:45:22 | 000,038,912 | ---- | C] () -- C:\Documents and Settings\Pam\Desktop\Reunioni.xls
[2010/01/14 12:43:45 | 000,000,111 | ---- | C] () -- C:\WINDOWS\PINOCHLE.INI
[2009/03/31 22:47:41 | 000,000,513 | ---- | C] () -- C:\Documents and Settings\Pam\Local Settings\Application Data\Big Bang Mancala Preferences
[2009/01/10 02:39:55 | 000,000,421 | ---- | C] () -- C:\Documents and Settings\Pam\Local Settings\Application Data\Big Bang Tic-Tac-Toe
[2008/09/20 22:05:17 | 000,056,056 | ---- | C] () -- C:\WINDOWS\System32\DLAAPI_W.DLL
[2008/09/20 22:05:16 | 000,030,722 | ---- | C] () -- C:\WINDOWS\System32\ofhhuni.dll
[2008/09/20 22:05:16 | 000,030,722 | ---- | C] () -- C:\WINDOWS\System32\2iveged.dll
[2008/09/20 22:05:16 | 000,000,120 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2008/09/01 16:52:28 | 000,000,443 | ---- | C] () -- C:\WINDOWS\MVPHEART.INI
[2008/08/25 21:59:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\lgfwup.ini
[2008/08/12 21:02:41 | 000,002,552 | ---- | C] () -- C:\WINDOWS\WAVEMIX.INI
[2008/08/12 20:56:38 | 000,000,154 | ---- | C] () -- C:\WINDOWS\STUDIO2.INI
[2008/05/20 01:02:49 | 000,000,314 | ---- | C] () -- C:\WINDOWS\MVPEUCHR.INI
[2008/04/22 19:51:20 | 000,000,198 | ---- | C] () -- C:\WINDOWS\MVPSPADE.INI
[2008/04/22 19:37:45 | 000,000,111 | ---- | C] () -- C:\WINDOWS\MVPCRIB.INI
[2008/01/03 01:05:04 | 000,000,211 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2008/01/01 20:23:17 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2007/08/27 09:54:05 | 000,000,006 | ---- | C] () -- C:\Documents and Settings\Pam\Application Data\dm.ini
[2007/08/27 09:54:04 | 000,000,882 | ---- | C] () -- C:\Documents and Settings\Pam\Application Data\AdobeDLM.log
[2007/08/07 18:54:44 | 000,001,751 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/07/03 15:22:28 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2007/04/02 02:22:01 | 000,000,122 | ---- | C] () -- C:\WINDOWS\mdm.ini
[2007/04/02 02:21:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NSREX.INI
[2007/04/02 00:22:30 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI
[2007/04/01 22:51:50 | 000,237,056 | ---- | C] () -- C:\Documents and Settings\Pam\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/04/01 22:23:40 | 000,000,692 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/09/24 23:02:34 | 000,520,192 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Roxio.dll
[2006/09/24 23:02:34 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\CddbFileTaggerRoxio.dll
[2005/04/01 16:16:00 | 000,540,672 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2004/08/04 08:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2004/08/04 08:00:00 | 000,022,530 | ---- | C] () -- C:\WINDOWS\System32\asbdkpc.dll
[2001/09/24 07:59:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\NavLogon.dll
[2000/09/18 17:12:40 | 000,023,040 | ---- | C] () -- C:\WINDOWS\System32\CSSMS_IN.DLL
[1999/01/22 15:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL
[1997/11/10 15:18:48 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll

========== LOP Check ==========

[2010/09/08 13:18:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2010/08/15 00:53:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EA
[2007/04/16 01:57:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Electronic Arts
[2008/01/01 20:21:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2009/12/16 13:13:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Gold Casual Games
[2008/04/01 01:59:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\iWin
[2008/08/25 20:34:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2008/04/06 13:11:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Meridian93
[2010/09/06 00:05:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2008/04/03 02:13:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PlayFirst
[2007/12/26 01:15:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap
[2007/07/03 01:01:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sandlot Games
[2010/09/09 20:34:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2007/04/06 13:56:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\.BitTornado
[2010/08/15 12:55:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\Amaranth Games
[2010/09/07 10:44:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\AVG9
[2010/05/30 11:11:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\BSplayer Pro
[2010/08/15 00:43:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\EA
[2008/01/01 14:57:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\EPSON
[2009/07/23 10:42:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\FoxyProxy
[2010/08/30 22:38:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\funkitron
[2008/04/06 22:26:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\Gamelab
[2009/12/16 13:13:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\Gold Casual Games
[2009/03/21 22:07:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\Hoyle Blackjack
[2010/09/09 02:41:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\Hoyle Card Games
[2010/06/26 10:32:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\Hoyle FaceCreator
[2010/09/07 01:56:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\Hoyle Puzzle and Board Games
[2008/04/01 01:59:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\iWin
[2010/02/27 05:46:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\JLC's Software
[2008/08/25 17:57:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\Leadertech
[2008/03/29 18:57:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\Magic Academy
[2010/01/13 10:32:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\NCH Swift Sound
[2008/04/03 02:13:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\PlayFirst
[2010/09/01 10:01:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\Pogo Games
[2010/02/27 06:15:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\Search Settings
[2008/01/01 20:07:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\Shareaza
[2010/08/29 12:47:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pam\Application Data\SystemRequirementsLab

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2007/04/01 22:09:54 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2007/09/08 15:04:50 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/09/05 22:47:09 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr
[2010/09/09 01:12:53 | 000,018,090 | ---- | M] () -- C:\ComboFix.txt
[2007/04/01 22:09:54 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2009/07/04 16:24:48 | 000,000,055 | ---- | M] () -- C:\DVDPATH.TXT
[2010/09/09 11:45:00 | 804,405,248 | -HS- | M] () -- C:\hiberfil.sys
[2007/04/01 22:09:54 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2007/04/01 22:09:54 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/04 08:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2004/08/04 08:00:00 | 000,250,032 | RHS- | M] () -- C:\ntldr
[2010/09/09 11:44:58 | 1207,959,552 | -HS- | M] () -- C:\pagefile.sys
[2010/09/08 23:47:37 | 000,000,401 | ---- | M] () -- C:\rkill.log
[2008/12/19 00:51:43 | 000,000,232 | -H-- | M] () -- C:\sqmdata00.sqm
[2008/12/19 00:51:43 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2007/04/01 22:28:52 | 000,002,933 | -H-- | M] () -- C:\_NavCClt.Log

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2007/04/01 22:09:16 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2007/04/01 18:50:39 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2007/04/01 18:50:39 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2007/04/01 18:50:39 | 000,876,544 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2007/04/01 22:10:02 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/04/01 22:17:26 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Pam\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2007/09/26 21:26:04 | 000,000,528 | ---- | M] () -- C:\Documents and Settings\Pam\Application Data\Microsoft\Internet Explorer\Quick Launch\Nokanda2006 in Bingo Luau Three Cards Coffee, Tea and Me.url
[2007/04/01 22:17:25 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Pam\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/09/08 23:48:49 | 003,840,723 | R--- | M] () -- C:\Documents and Settings\Pam\Desktop\ComboFix.exe
[2008/04/17 21:13:02 | 000,811,008 | ---- | M] () -- C:\Documents and Settings\Pam\Desktop\gmer.exe
[2010/09/07 10:11:20 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Pam\Desktop\MBRCheck.exe
[2010/09/09 20:36:47 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pam\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/04/01 22:17:25 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Pam\Favorites\Desktop.ini
[2010/05/30 10:40:45 | 000,000,220 | ---- | M] () -- C:\Documents and Settings\Pam\Favorites\NCH Audio and Telephony Software.lnk
[2010/05/30 10:39:18 | 000,000,248 | ---- | M] () -- C:\Documents and Settings\Pam\Favorites\NCH Software Download.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/09/09 17:47:32 | 000,065,536 | ---- | M] () -- C:\Documents and Settings\Pam\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2004/08/04 08:00:00 | 000,208,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2004/08/04 08:00:00 | 000,028,672 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 01:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2004/08/04 01:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2004/08/04 01:06:34 | 000,082,944 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2004/08/04 01:06:34 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2004/08/04 01:06:34 | 001,667,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2004/08/04 08:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2004/08/04 08:00:00 | 000,018,052 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2004/08/04 08:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2004/08/04 01:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/08/04 01:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


========== Alternate Data Streams ==========

@Alternate Data Stream - 191 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B74B4664
@Alternate Data Stream - 189 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C4FA47B7
@Alternate Data Stream - 187 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7FC6987F
@Alternate Data Stream - 187 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2D0C22DC
@Alternate Data Stream - 185 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A73EAFFB
@Alternate Data Stream - 181 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:86F974EB
@Alternate Data Stream - 180 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:21032CDA
@Alternate Data Stream - 178 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP09AEE3D
@Alternate Data Stream - 178 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:ACBFC561
@Alternate Data Stream - 175 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:551E1CB4
@Alternate Data Stream - 174 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:588B60C7
@Alternate Data Stream - 170 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4EFDF5FB
@Alternate Data Stream - 162 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:298B27F3
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CF5C4195
< End of report >

 

OTL Extras logfile created on: 9/9/2010 8:37:45 PM - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\Pam\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

767.00 Mb Total Physical Memory | 283.00 Mb Available Physical Memory | 37.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 65.00% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.26 Gb Total Space | 22.81 Gb Free Space | 61.21% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 650.05 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 618.95 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive G: | 232.83 Gb Total Space | 115.49 Gb Free Space | 49.60% Space Free | Partition Type: FAT32
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 489.88 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: HOME-OFFICE
Current User Name: Pam
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "G:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with ACDSee] -- d:\Program Files\ACDSee32\ACDSee32.exe "%1" File not found
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- (Microsoft Corporation)
"G:\Program Files\Hasbro Interactive\Classic Games\ClassicCard.exe" = G:\Program Files\Hasbro Interactive\Classic Games\ClassicCard.exe:*:Enabled:ClassicCard -- ()
"C:\Program Files\BitTornado\btdownloadgui.exe" = C:\Program Files\BitTornado\btdownloadgui.exe:*:Enabled:btdownloadgui -- ()
"C:\WINDOWS\system32\dplaysvr.exe" = C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper -- (Microsoft Corporation)
"G:\Program Files\Infogrames Interactive\Scrabble Complete\ScrabbleComplete.exe" = G:\Program Files\Infogrames Interactive\Scrabble Complete\ScrabbleComplete.exe:*:Enabled:Scrabble Complete -- (Infogrames Interactive)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox -- (Mozilla Corporation)
"G:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe" = G:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe:*:Enabled:Zoo Tycoon 2 Executable -- (Microsoft Corporation)
"C:\Program Files\AVG\AVG9\avgemc.exe" = C:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00010409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Professional
"{02034A48-25C6-4BB4-8186-54917E5D49DA}" = SpongeBob SquarePants - Lights, Camera, Pants!
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{104A059B-CD20-4632-A8F6-D8C80E14782D}" = Magellan POI File Editor
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{22EC35BD-F8F2-45EB-8DCB-1C7FB65D0A71}" = QuickTax 2007
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 12
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3CCB26F5-E2A7-4C91-8340-9149D7B7C2BE}" = Virtual Earth 3D (Beta)
"{49672EC2-171B-47B4-8CE7-50D7806360D7}" = Windows Live Sign-in Assistant
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{571700F0-DB9D-4B3A-B03D-35A14BB5939F}" = Windows Live Messenger
"{5F05C28D-DEA9-4AD6-A73A-064175988EAB}" = Search Settings v1.2.3
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117739927}" = Slingo Mysteries
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C5766F2-81D9-4B5A-8AD5-A8BD6361EF0A}" = Hoyle Card Games
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{938B1CD7-7C60-491E-AA90-1F1888168240}" = Roxio MyDVD Basic v9
"{9799BD05-5F89-484C-008E-F50592F53440}" = Harry Potter and the Goblet of Fire™
"{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}" = Google Earth
"{9E665C6F-65E6-43E2-92BC-3EF3B795FF14}" = FoxyProxy Video Utility
"{A20A8B9F-12CD-4E5A-8CB1-65964C1937DB}" = National Geographic Plan It Green
"{AA0D2D5F-612B-45D3-8759-DA87206E5CC9}" = QuickTax 2008
"{AC76BA86-7AD7-1033-7B44-A70900000002}" = Adobe Reader 7.0.9
"{AD0DA83A-D62C-443B-8C3B-D7B2356FC229}" = Zoo Tycoon 2
"{B36649A3-D0DD-4706-B042-F5B384529C7A}" = Scrabble Complete
"{B98D958E-9E59-43B7-B47F-043D45D73EE6}" = SpongeBob SquarePants - The Movie
"{BD12EB47-DBDF-11D3-BEEA-00A0CC272509}" = Norton AntiVirus Corporate Edition
"{BE90CE58-41DE-4708-9291-A9D1D49B1033}" = SecurDisc Viewer
"{C066DCF1-6E5D-4197-A290-7F1F30538DB6}" = Lizardtech Express View Browser Plug-in
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{D6DE02C7-1F47-11D4-9515-00105AE4B89A}" = Paint Shop Pro 7 ESD
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E59219D4-23B8-11D3-A179-00C04F6C9FA4}" = Microsoft Word Supplemental Templates and Wizards
"{ECAAC00F-74C7-4F1C-A110-F526ED630044}" = SpongeBob SquarePants - Nighty Nightmare
"{ECB9C58E-C565-4683-9599-B72290BD3B25}" = QuickTax 2009
"{F94D3203-93C7-4146-80E9-89CCC47D5264}" = Microsoft Diagnostics and Recovery Toolset 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"AdobeESD" = Adobe Download Manager 2.2 (Remove Only)
"Audacity_is1" = Audacity 1.2.6
"AVG9Uninstall" = AVG Free 9.0
"Bingo Blowout" = Bingo Blowout
"BitTornado" = BitTornado 0.3.17
"Board Games" = Board Games
"BSPlayer1" = BSPlayer
"Card Games" = Card Games
"cayahooantispy" = CA Yahoo! Anti-Spy (remove only)
"ClassicCard" = Parker Brothers Classic Card Games
"Clue" = Clue
"DirectXMediaRuntime" = DirectX Media Runtime 5.1
"EPSON Printer and Utilities" = EPSON Printer Software
"EPSON Scanner" = EPSON Scan
"FileZilla" = FileZilla (remove only)
"Free Video to Mp3 Converter_is1" = Free Video to Mp3 Converter version 2.7
"Google Updater" = Google Updater
"HijackThis" = HijackThis 2.0.2
"Home Publishing" = Microsoft Greetings
"ie8" = Windows Internet Explorer 8
"InstallShield_{AD0DA83A-D62C-443B-8C3B-D7B2356FC229}" = Zoo Tycoon 2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"MSNINST" = MSN
"Mysterious City Cairo" = Mysterious City Cairo (remove only)
"Mysteryville" = Mysteryville (remove only)
"NVIDIA Drivers" = NVIDIA Drivers
"Oscar Spring Edtion 2001" = Oscar Spring Edtion 2001
"Picasa 3" = Picasa 3
"PopCap Browser Plugin" = PopCap Browser Plugin
"Sesame Street First Steps" = Sesame Street First Steps (remove only)
"SpongeBob SquarePants" = SpongeBob SquarePants® Operation Krabby Patty
"SystemRequirementsLab" = System Requirements Lab
"The Mysterious City Golden Prague" = The Mysterious City Golden Prague (remove only)
"Unlocker" = Unlocker 1.8.7
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format Runtime
"WinRAR archiver" = WinRAR archiver
"Zoo Tycoon 1.0" = Zoo Tycoon Expanded

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"Hoyle® Puzzle & Board 2009" = Hoyle® Puzzle & Board 2009
"QUICKMEDIACONVERTER" = Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9/8/2010 1:17:28 PM | Computer Name = HOME-OFFICE | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 9/8/2010 1:17:28 PM | Computer Name = HOME-OFFICE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 9/8/2010 1:17:44 PM | Computer Name = HOME-OFFICE | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.2180, faulting
module FPServiceProvider.dll, version 0.0.0.0, fault address 0x00001b40.

Error - 9/8/2010 7:45:56 PM | Computer Name = HOME-OFFICE | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 9/8/2010 7:45:56 PM | Computer Name = HOME-OFFICE | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 9/8/2010 7:45:56 PM | Computer Name = HOME-OFFICE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 9/8/2010 7:45:56 PM | Computer Name = HOME-OFFICE | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 9/8/2010 7:45:56 PM | Computer Name = HOME-OFFICE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 9/9/2010 3:00:24 PM | Computer Name = HOME-OFFICE | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Professional -- Error 1706. No valid
source could be found for product Microsoft Office 2000 Professional. The Windows
installer cannot continue.

Error - 9/9/2010 3:00:54 PM | Computer Name = HOME-OFFICE | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Professional -- Error 1706. No valid
source could be found for product Microsoft Office 2000 Professional. The Windows
installer cannot continue.

[ System Events ]
Error - 9/8/2010 11:53:04 PM | Computer Name = HOME-OFFICE | Source = Ftdisk | ID = 262193
Description = Configuring the Page file for crash dump failed. Make sure there is
a page file on the boot partition and that is large enough to contain all physical
memory.

Error - 9/8/2010 11:58:35 PM | Computer Name = HOME-OFFICE | Source = Service Control Manager | ID = 7023
Description = The Computer Browser service terminated with the following error:
%%1460

Error - 9/9/2010 12:02:47 AM | Computer Name = HOME-OFFICE | Source = ACPI | ID = 327685
Description = AMLI: ACPI BIOS is attempting to write to an illegal IO port address
(0x70), which lies in the 0x70 - 0x71 protected address range. This could lead to
system instability. Please contact your system vendor for technical assistance.

Error - 9/9/2010 12:02:47 AM | Computer Name = HOME-OFFICE | Source = ACPI | ID = 327684
Description = AMLI: ACPI BIOS is attempting to read from an illegal IO port address
(0x71), which lies in the 0x70 - 0x71 protected address range. This could lead to
system instability. Please contact your system vendor for technical assistance.

Error - 9/9/2010 12:07:54 AM | Computer Name = HOME-OFFICE | Source = Service Control Manager | ID = 7023
Description = The Computer Browser service terminated with the following error:
%%1460

Error - 9/9/2010 12:12:46 AM | Computer Name = HOME-OFFICE | Source = PlugPlayManager | ID = 11
Description = The device Root\LEGACY_UNLOCKERDRIVER5\0000 disappeared from the system
without first being prepared for removal.

Error - 9/9/2010 12:15:03 AM | Computer Name = HOME-OFFICE | Source = ACPI | ID = 327685
Description = AMLI: ACPI BIOS is attempting to write to an illegal IO port address
(0x70), which lies in the 0x70 - 0x71 protected address range. This could lead to
system instability. Please contact your system vendor for technical assistance.

Error - 9/9/2010 12:15:03 AM | Computer Name = HOME-OFFICE | Source = ACPI | ID = 327684
Description = AMLI: ACPI BIOS is attempting to read from an illegal IO port address
(0x71), which lies in the 0x70 - 0x71 protected address range. This could lead to
system instability. Please contact your system vendor for technical assistance.

Error - 9/9/2010 11:45:06 AM | Computer Name = HOME-OFFICE | Source = ACPI | ID = 327685
Description = AMLI: ACPI BIOS is attempting to write to an illegal IO port address
(0x70), which lies in the 0x70 - 0x71 protected address range. This could lead to
system instability. Please contact your system vendor for technical assistance.

Error - 9/9/2010 11:45:06 AM | Computer Name = HOME-OFFICE | Source = ACPI | ID = 327684
Description = AMLI: ACPI BIOS is attempting to read from an illegal IO port address
(0x71), which lies in the 0x70 - 0x71 protected address range. This could lead to
system instability. Please contact your system vendor for technical assistance.


< End of report >

 

I've somehow lost my Microsoft Office. I tried to do some work today with Excel and it wanted me to insert the installation disk. I didn't because I didn't want to install anything until this is over with. Also, I had installed a trial version of NCH video tools. The trial period has been long over but I keep getting pop up notices about once a week to buy the full version even though I (or so I thought) uninstalled the program. I must be getting paranoid because logic tells me it's not a virus but it's annoyingly invasive as if it is a virus.

 

Well this has been an exercise in patience. There have been a couple of problems, some my own fault. I did not read your instructions properly and it wasn't until I did the OTL fix that I realized I had not updated java so I started over. This resulted in 2 OTL logs, both posted here. While I was installing the java update AVG shield opened with several threat messages.

Moving on to Kaspersky - Kaspersky wouldn't run because it said I didn't have the Java plugin installed - FF wouldn't install the plugin because it said I already had it. I closed FF and started again. This time Kaspersky still wouldn't run because it said I didn't have the Java plugin installed - FF opened a window that said to install the plugin. This time it installed a different java with the same version number. The first one is xpiinstall version 6.0.210.73. The second one is jxpiinstall version 6.0.210.73. Both are from Sun Microsystems, Inc. Kaspersky was satisfied now and ran the scan. I left it running and went to bed. When I got up FF had crashed and Kaspersky was lost. I restarted FF and started the scan again and went out for the day. This time it finished - log to follow.

first OTL log:

All processes killed
========== OTL ==========
No active process named defwatch.exe was found!
Service Norton AntiVirus Server stopped successfully!
Service Norton AntiVirus Server deleted successfully!
C:\Program Files\NavNT\rtvscan.exe moved successfully.
Service DefWatch stopped successfully!
Service DefWatch deleted successfully!
C:\Program Files\NavNT\defwatch.exe moved successfully.
Service NAVEX15 stopped successfully!
Service NAVEX15 deleted successfully!
C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080827.038\NAVEX15.SYS moved successfully.
Service NAVENG stopped successfully!
Service NAVENG deleted successfully!
C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080827.038\NAVENG.SYS moved successfully.
Service SymEvent stopped successfully!
Service SymEvent deleted successfully!
C:\Program Files\Symantec\SYMEVENT.SYS moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Shockwave Updater deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\.IE5\ deleted successfully.
Starting removal of ActiveX control {32505657-9980-0010-8000-00AA00389B71}
C:\WINDOWS\Downloaded Program Files\wmvadvd.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{32505657-9980-0010-8000-00AA00389B71}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32505657-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{32505657-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32505657-9980-0010-8000-00AA00389B71}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\SET6F.tmp deleted successfully.
C:\WINDOWS\System32\SET71.tmp deleted successfully.
C:\WINDOWS\System32\SET75.tmp deleted successfully.
C:\WINDOWS\System32\SET76.tmp deleted successfully.
C:\WINDOWS\System32\SET7D.tmp deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET4.tmp deleted successfully.
C:\WINDOWS\SET8.tmp deleted successfully.
C:\WINDOWS\Driquwipiq.dat moved successfully.
C:\WINDOWS\Xsedegucob.bin moved successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:B74B4664 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:C4FA47B7 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:7FC6987F deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:2D0C22DC deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:A73EAFFB deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:86F974EB deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:21032CDA deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP09AEE3D deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:ACBFC561 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:551E1CB4 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:588B60C7 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:4EFDF5FB deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:298B27F3 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:CF5C4195 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Program Files\NavNT\AMS2 folder moved successfully.
C:\Program Files\NavNT folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 196742 bytes
->Flash cache emptied: 1853 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 1520 bytes

User: Pam
->Temp folder emptied: 214767 bytes
->Temporary Internet Files folder emptied: 1438761 bytes
->Java cache emptied: 51468991 bytes
->FireFox cache emptied: 106351480 bytes
->Google Chrome cache emptied: 11190534 bytes
->Flash cache emptied: 2122269 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 1582386 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 166.00 mb


[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

User: Pam
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.11.0 log created on 09092010_223546

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


second OTL log:

All processes killed
========== OTL ==========
No active process named defwatch.exe was found!
Error: No service named Norton AntiVirus Server was found to stop!
Service\Driver key Norton AntiVirus Server not found.
File C:\Program Files\NavNT\rtvscan.exe not found.
Error: No service named DefWatch was found to stop!
Service\Driver key DefWatch not found.
File C:\Program Files\NavNT\defwatch.exe not found.
Error: No service named NAVEX15 was found to stop!
Service\Driver key NAVEX15 not found.
File C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080827.038\NAVEX15.SYS not found.
Error: No service named NAVENG was found to stop!
Service\Driver key NAVENG not found.
File C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080827.038\NAVENG.SYS not found.
Error: No service named SymEvent was found to stop!
Service\Driver key SymEvent not found.
File C:\Program Files\Symantec\SYMEVENT.SYS not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Shockwave Updater not found.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\.IE5\ not found.
Starting removal of ActiveX control {32505657-9980-0010-8000-00AA00389B71}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{32505657-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32505657-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{32505657-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32505657-9980-0010-8000-00AA00389B71}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
File/Folder C:\WINDOWS\System32\*.tmp not found.
File/Folder C:\WINDOWS\*.tmp not found.
File C:\WINDOWS\Driquwipiq.dat not found.
File C:\WINDOWS\Xsedegucob.bin not found.
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:B74B4664 .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:C4FA47B7 .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:7FC6987F .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:2D0C22DC .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:A73EAFFB .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:86F974EB .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:21032CDA .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP09AEE3D .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:ACBFC561 .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:551E1CB4 .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:588B60C7 .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:4EFDF5FB .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:298B27F3 .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:CF5C4195 .
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\Program Files\NavNT not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Pam
->Temp folder emptied: 5966811 bytes
->Temporary Internet Files folder emptied: 107928 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 17454439 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 22.00 mb


[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

User: Pam
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.11.0 log created on 09092010_225643

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Pam\Local Settings\Temp\Perflib_Perfdata_148.dat not found!

Registry entries deleted on Reboot...


Checkup log:

Results of screen317's Security Check version 0.99.5
Windows XP Service Pack 2
Out of date service pack!!
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
AVG Free 9.0
Norton AntiVirus Corporate Edition
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
Java(TM) 6 Update 20
Out of date Java installed!
Adobe Flash Player 10.1.82.76
Adobe Reader 7.0.9
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.8)
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
````````````````````````````````
DNS Vulnerability Check:

``````````End of Log````````````

 

second checkup log:

Results of screen317's Security Check version 0.99.5
Windows XP Service Pack 2
Out of date service pack!!
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
AVG Free 9.0
Norton AntiVirus Corporate Edition
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
Java(TM) 6 Update 21
Adobe Flash Player 10.1.82.76
Adobe Reader 7.0.9
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.8)
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
````````````````````````````````
DNS Vulnerability Check:

``````````End of Log````````````

Kaspersky log:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Friday, September 10, 2010
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Friday, September 10, 2010 09:38:55
Records in database: 4207554
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
E:\
F:\
G:\
J:\

Scan statistics:
Objects scanned: 110299
Threats found: 8
Infected objects found: 13
Suspicious objects found: 0
Scan duration: 08:22:16


File name / Threat / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\Rgukua.exe.vir Infected: Packed.Win32.Katusha.n 1
C:\Qoobox\Quarantine\C\WINDOWS\Rgukub.exe.vir Infected: Packed.Win32.Katusha.n 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\afd.sys.vir Infected: Virus.Win32.TDSS.b 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\spool\prtprocs\w32x86\EIQ93cE9.dll.vir Infected: Backdoor.Win32.TDSS.agq 1
C:\System Volume Information\_restore{43F793CE-AC1B-48E8-B48E-6E188798D758}\RP1\A0000888.dll Infected: Trojan-GameThief.Win32.OnLineGames.bnpx 1
C:\System Volume Information\_restore{43F793CE-AC1B-48E8-B48E-6E188798D758}\RP1\A0000937.sys Infected: Virus.Win32.TDSS.b 1
C:\System Volume Information\_restore{43F793CE-AC1B-48E8-B48E-6E188798D758}\RP1\A0001004.dll Infected: Backdoor.Win32.TDSS.agq 1
C:\System Volume Information\_restore{43F793CE-AC1B-48E8-B48E-6E188798D758}\RP2\A0001115.exe Infected: Packed.Win32.Katusha.n 1
C:\System Volume Information\_restore{43F793CE-AC1B-48E8-B48E-6E188798D758}\RP2\A0001116.exe Infected: Packed.Win32.Katusha.n 1
C:\System Volume Information\_restore{43F793CE-AC1B-48E8-B48E-6E188798D758}\RP2\A0001211.dll Infected: Trojan-Downloader.Win32.Mufanom.aekq 1
G:\System Volume Information\_restore{43F793CE-AC1B-48E8-B48E-6E188798D758}\RP1\A0000463.exe Infected: Trojan-Dropper.Win32.Delf.gat 1
G:\System Volume Information\_restore{43F793CE-AC1B-48E8-B48E-6E188798D758}\RP1\A0000465.exe Infected: not-a-virus:WebToolbar.Win32.WhenU.a 1
G:\System Volume Information\_restore{43F793CE-AC1B-48E8-B48E-6E188798D758}\RP1\A0000824.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.60 1

Selected area has been scanned.

 

I'll do all the updates when this is done, promise.

 

Run Fix log:

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Pam
->Temp folder emptied: 129454659 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 128101 bytes
->FireFox cache emptied: 52794434 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 611 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 174.00 mb


[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

User: Pam
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.11.0 log created on 09102010_223106

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

 

well.. so far so good. you are the best!

I've received a HUGE apology from pogo, probably in the hopes I don't cancel the account. I've already told them I'm going to. I'm just sorry that aside from the membership I also purchased some games from them, too. The kids are still trying to talk me out of cancelling the account.

I was very careful not to do any financial stuff (banking, credit cards, etc.) and aside from email and facebook there were no other password related websites visited. Should I still change them? I guess I was lucky that excel wouldn't work since I was going to update my bank statement. I have to reinstall it.

Again, thanks broni for all your help.

 

FYI - Foxit doesn't let you uncheck the toolbar - you have to agree to install it to download the program.