Solved Tim's Vista Laptop can't access Internet

tvjohns · 2011/05/12

[Resolved] Tim's Vista Laptop can't access Internet

I have a Gateway Laptop running Vista Home Premium OS.

Yesterday evening while accessing email I had a web site link pop up that I hadn't asked for and as I no interest in investigating I clicked delete. Couple minutes went by the Firefox browser I was running automatically shut down -- that is, not by my effort.

Then this window opens on my desktop labeled Vista Home Security. I know pretty much everything installed on my laptop and am pretty certain this thing was not properly on my hard drive. And over the 2.5 years I used this laptop, it's never come up before under any previous circumstances and I certainly never installed such a 3rd party app myself.

As I watch (without clicking or touching anything) this thing starts running what it labels "system scan for spyware, adware, trojans, etc." After only a couple moments reporting "Detected 28 critical system objects. "

To all appearances looks proper operation to anyone not as paranoid as me, newbies especially, which I am NOT. Then comes the kicker:

This thing identifies itself as an unregistered version and provides a link to click to Register AND THEN this previously unnamed list of 28 infections and vulnerabilities will become available, including means of removing them. Also urges me to BUY the full version!

I did not do this, of course. I closed this "Vista Home Security" window without clicking anything else.

Problem is: Whenever I tried to restart Firefox This same (what I believe to be a bogus security app) brings up the same warning screen with a big "DANGER Firefox infected with..." and then gives a long spiel of what Firefox is infected with and the danger of allowing Firefox to load my standard home page, open Google search of any other internet site such as Windows BBS. Firefox is simply locked up and I have to shut it down. I also have Internet Explorer 8. Tried opening it, same Danger message and IE8 locked up too.

One further curious thing I'm sure is associated with this "Vista Home Security" thing: the executable file that apparently runs this thing is jox.exe.
Sever times I used ctrl-alt-del to open Task Mgr., saw the jox.exe, clicked to "End Process" and it disappears as it should. This doesn't stop "Vista Home Security" which has a MS-looking security-warning icon in the little system tray on the Desktop toolbar. Plus every time I reopen Task Mgr. jox.exe is back

FINALLY: On my desktop I have Malware bytes free version that I frequently run (Got it from someone on this malware site from your help last year on a unrelated problem on this same laptop.)

IN FACT I had just run Malware bytes Quick Scan a couple days before this present problem and it ran fine, showing no infection whatsoever

BUT NOW WHEN I TRIED SEVERAL TIMES TO RUN MALWARE BYTES-NOTHING.

Malware bytes will not function.

Any ideas of what's really going on here and how to fix it; or at least confirming to me whether "Vista Home Security" is malware or a legit app would be much appreciated.

Thank you for your time and attention,

Timothy Johns

broni · 2011/05/12

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running tools or applying updates other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

====================================================

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

[color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

[color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

tvjohns · 2011/05/13

Received your post. FYI: I did in a sense get the problem solved or at least got this malware thing to disappear from my desktop, no longer active or locking up Firefox and IE-8. However, I agree with and take seriously your advice that just because things "look" better doesn't mean still isn't a concern about machine being totally clean. I am going to follow you instructions, only tied up over weekend. So I can't get to them till later in week.

Way I freed up laptop function by the way (took a while for the obvious to occur to me, I've had so little trouble with this Vista laptop) was to opt back to a several days earlier Restore Point. Again, I do very much appreciate your prompt and so helpful response. AND AGAIN I SHALL STILL FOLLOW ALL YOUR GOOD INSTRUCTIONS. Many thanks.

broni · 2011/05/13

You're welcome

broni · 2011/05/24

Reopened....

tvjohns · 2011/05/28

ComboFix log:

ComboFix 11-05-23.02 - Timothy 05/24/2011 1:33.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1981.1039 [GMT -5:00]
Running from: c:\users\Timothy\Downloads\# MY LAPTOP INFECTION PROBLEM\# 2011-0 5NEW INFECTION PROBLEM\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\my System
c:\my system\1 Click System Restore Point.lnk
c:\my system\Batch.lnk
c:\my system\Batch\0 0 XP Batch Files\Auto Backup Batch.tim
c:\my system\Batch\0 0 XP Batch Files\AV Scan.bat
c:\my system\Batch\0 0 XP Batch Files\AV Scan.bat.lnk
c:\my system\Batch\0 0 XP Batch Files\BacknShut.lnk
c:\my system\Batch\0 0 XP Batch Files\Backup XP Drivers\Driverback.bat
c:\my system\Batch\0 0 XP Batch Files\Backup&Restart.bat
c:\my system\Batch\0 0 XP Batch Files\BackupAndOut.bat
c:\my system\Batch\0 0 XP Batch Files\Clean Temp at Boot-up\cleantemp.bat
c:\my system\Batch\0 0 XP Batch Files\cleantemp.bat
c:\my system\Batch\0 0 XP Batch Files\cVisioneer Backup.bat
c:\my system\Batch\0 0 XP Batch Files\DeArchive Files.bat
c:\my system\Batch\0 0 XP Batch Files\F Backup.bat
c:\my system\Batch\0 0 XP Batch Files\F Backup.lnk
c:\my system\Batch\0 0 XP Batch Files\First Docs Backup.old
c:\my system\Batch\0 0 XP Batch Files\First Documents Backup.old
c:\my system\Batch\0 0 XP Batch Files\My documents Backup.bat
c:\my system\Batch\0 0 XP Batch Files\old My Documents Backup.bat
c:\my system\Batch\0 0 XP Batch Files\old Writing Backup.bat
c:\my system\Batch\0 0 XP Batch Files\ScanDocs Backup.bat
c:\my system\Batch\0 0 XP Batch Files\Shutdown Not.bat
c:\my system\Batch\0 0 XP Batch Files\Shutdown.bat
c:\my system\Batch\0 0 XP Batch Files\Visioneer F Backup.bat
c:\my system\Batch\0 0 XP Batch Files\Visioneer F Backup.lnk
c:\my system\Batch\0 0 XP Batch Files\Writing Backup.bat
c:\my system\Batch\0 0 XP Batch Files\Writing CD Backup.bat
c:\my system\Batch\0 0 XP Batch Files\Writing CD Backup.lnk
c:\my system\Batch\0 0 XP Batch Files\Writing F Backup.bat
c:\my system\Batch\0 0 XP Batch Files\Writing F Backup.lnk
c:\my system\Batch\0 0 XP Batch Files\XP Test.bat
c:\my system\Batch\Archive.bat
c:\my system\Batch\Batch command note.txt
c:\my system\Batch\Batch File Issue.txt
c:\my system\Batch\C_Backup Copy 1.bat
c:\my system\Batch\C_Backup.bat
c:\my system\Batch\CD_RW Backup.BAT
c:\my system\Batch\CD_RW Backup.BAT.pif
c:\my system\Batch\Copy of Writing Backup.bat
c:\my system\Batch\D_Backup.BAT
c:\my system\Batch\D_Backup.BAT.pif
c:\my system\Batch\Exit Commands\1 Shutdown.lnk
c:\my system\Batch\Exit Commands\2 Forced Shutdown.lnk
c:\my system\Batch\Exit Commands\3 Reboot.lnk
c:\my system\Batch\Exit Commands\4 Forced Reboot.lnk
c:\my system\Batch\FloppyMat.bat
c:\my system\Batch\FlopyBak.bat
c:\my system\Batch\IE Cache.bat
c:\my system\Batch\NtscpRes.bat
c:\my system\Batch\OEMBak.bat
c:\my system\Batch\old sCache.bat
c:\my system\Batch\old tCache.bat
c:\my system\Batch\sCache.bat
c:\my system\Batch\sCacheClean.bat
c:\my system\Batch\sCacheClean.pif
c:\my system\Batch\SystemBak.bat
c:\my system\Batch\TaskPlus.bat
c:\my system\Batch\tCache.bat
c:\my system\Batch\tCache.bat.pif
c:\my system\Batch\tCacheClean.bat
c:\my system\Batch\tCacheClean.pif
c:\my system\Batch\Test.bat
c:\my system\Batch\XX COPY Downloads.bat
c:\my system\Batch\XX COPY Downloads.lnk
c:\my system\F Backup.lnk
c:\my system\shutdown.exe
c:\my system\Ult Vista Tweaker.lnk
c:\my system\Ultimate Windows Tweaker.exe
c:\my system\Writing CD Backup.lnk
c:\my system\Writing F Backup.lnk
c:\my system\XP Batch Files.lnk
c:\my system\xp_sysrestorepoint.vbs
c:\users\Timothy\GoToAssistDownloadHelper.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-04-24 to 2011-05-24 )))))))))))))))))))))))))))))))
.
.
2011-05-24 06:46 . 2011-05-24 06:47 -------- d-----w- c:\users\Timothy\AppData\Local\temp
2011-05-24 06:46 . 2011-05-24 06:46 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-05-24 06:46 . 2011-05-24 06:46 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-24 01:42 . 2011-05-24 01:42 -------- d-----w- c:\programdata\Dell V310-V510 Series
2011-05-23 15:57 . 2011-05-24 06:02 -------- d-----w- c:\users\Timothy\{170c9440-7bac-4bb1-98c3-a42d7f93ba46}
2011-05-23 15:55 . 2010-05-21 22:19 213672 ----a-w- c:\windows\system32\DLEAwupd.exe
2011-05-23 15:55 . 2010-02-22 10:10 372736 ----a-w- c:\windows\system32\DLEAwupd.dll
2011-05-23 15:53 . 2011-05-23 15:56 -------- d-----w- c:\program files\Dell
2011-05-23 15:52 . 2011-05-23 15:55 -------- d-----w- c:\program files\Dell Toolbar
2011-05-23 15:52 . 2011-05-23 15:52 -------- d-----w- c:\program files\Dell PC Fax
2011-05-23 15:52 . 2011-05-24 06:02 -------- d-----w- c:\program files\Dell Printable Web
2011-05-23 15:49 . 2011-05-24 06:02 -------- d-----w- c:\program files\Dell V310-V510 Series
2011-05-16 20:10 . 2011-05-24 06:02 -------- d-----w- c:\programdata\Ezprint
2011-05-16 18:57 . 2011-05-24 06:02 -------- d-----w- c:\programdata\Dl_cats
2011-05-16 18:07 . 2009-02-20 08:50 28672 ----a-w- c:\windows\system32\DLEAsmr.dll
2011-05-16 18:07 . 2009-02-20 08:49 299008 ----a-w- c:\windows\system32\DLEAsm.dll
2011-05-16 17:55 . 2011-05-16 17:55 -------- d-----w- c:\programdata\Citrix
2011-05-16 17:49 . 2011-05-16 17:49 -------- d-----w- c:\program files\Citrix
2011-05-16 17:49 . 2011-05-16 17:49 -------- d-----w- c:\users\Timothy\AppData\Local\Citrix
2011-05-12 17:32 . 2011-05-16 20:10 -------- d-----w- c:\program files\Common Files\PC Tools
2011-05-12 17:32 . 2011-05-12 17:32 -------- d-----w- c:\programdata\PC Tools
2011-05-12 17:32 . 2011-05-12 17:32 -------- d-----w- c:\users\Timothy\AppData\Roaming\PC Tools
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-10 04:24 . 2010-02-05 18:25 2828 --sha-w- c:\programdata\KGyGaAvL.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC "= "c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"Rainlendar2 "= "c:\program files\Rainlendar2\Rainlendar2.exe" [2007-04-15 1291264]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-17 815104]
"hpqSRMon "= "c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"avast5 "= "c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]
"VistaFirewallControl "= "c:\program files\VistaFirewallControl\VistaFirewallControl.exe" [2008-07-11 716800]
"dleamon.exe "= "c:\program files\Dell V310-V510 Series\dleamon.exe" [2010-08-09 770728]
"EzPrint "= "c:\program files\Dell V310-V510 Series\ezprint.exe" [2010-08-09 139944]
.
c:\users\Timothy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Stickies.lnk - c:\program files\stickies\stickies.exe [2007-3-9 700416]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 0 (0x0)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableLockWorkstation "= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoThumbnail "= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification "= 0 (0x0)
"HideSCABattery "= 0 (0x0)
"HideSCANetwork "= 0 (0x0)
"HideSCAVolume "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2011-05-16 17:49 13672 ----a-w- c:\program files\Citrix\GoToAssist\615\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-11 01:51 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-10-15 23:20 1838592 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 21:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media Codec Update Service]
2007-04-08 16:44 303104 ----a-w- c:\program files\Essentials Codec Pack\update.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2001-08-23 21:52 331830 ----a-w- c:\program files\Microsoft Works\wkssb.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2001-08-17 04:41 28738 ----a-w- c:\program files\Common Files\microsoft shared\Works Shared\WkUFind.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Monitor]
2009-11-10 16:14 443728 ----a-w- c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickFinder Scheduler]
2008-11-15 01:08 83232 ----a-w- c:\program files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tweak UI]
2000-06-18 19:03 106544 ----a-w- c:\windows\System32\TWEAKUI.CPL
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2001-10-06 00:34 24576 ----a-w- c:\program files\Microsoft Works\wkfud.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3777651122-2117734261-3338017706-1000]
"EnableNotificationsRef "=dword:00000003
"EnableNotifications "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3777651122-2117734261-3338017706-500]
"EnableNotificationsRef "=dword:00000002
.
R2 gupdate1c9b096df02f6b;Google Update Service (gupdate1c9b096df02f6b);c:\program files\Google\Update\GoogleUpdate.exe [2009-03-29 133104]
R3 NETw2v32;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-07-07 14904]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-01-13 51280]
S2 dlea_device;dlea_device;c:\windows\system32\dleacoms.exe [2010-05-21 598696]
S2 lxdk_device;lxdk_device;c:\windows\system32\lxdkcoms.exe [2007-06-14 598960]
S2 VistaFirewallService;VistaFirewallService;c:\program files\VistaFirewallControl\VistaFirewallService.exe [2008-07-11 286720]
S3 RTL85n86;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver;c:\windows\system32\DRIVERS\RTL85n86.sys [2007-03-12 354816]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-29 17:44]
.
2011-05-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-29 17:44]
.
2011-05-24 c:\windows\Tasks\User_Feed_Synchronization-{63FCD27C-7927-41DA-BAB8-30F16C6499BD}.job
- c:\windows\system32\msfeedssync.exe [2010-10-09 04:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.yahoo.com/
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=PTB&M=MT3707
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Copy to &Lightning Note - c:\program files\Corel\WordPerfect Lightning\Programs\WPLightningCopyToNote.hta
IE: Open with WordPerfect - c:\program files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
IE: {{3B54DEAB-C6D4-48a8-8C32-A70558643400} - c:\program files\FinalVideoDownloader\fvdRunner.html
TCP: {8FED5479-73C3-4831-83DB-F8ECE3F4DA8E} = 68.94.156.1,68.94.157.1
FF - ProfilePath - c:\users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\
FF - prefs.js: browser.startup.homepage - hxxp://att.my.yahoo.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Tab Mix Plus: {dc572301-7619-498c-a57d-39143191b318} - %profile%\extensions\{dc572301-7619-498c-a57d-39143191b318}
FF - Ext: Aeon: {ded0fc70-7215-4802-afeb-b2982d3e7225} - %profile%\extensions\{ded0fc70-7215-4802-afeb-b2982d3e7225}
FF - Ext: OpenBook: {aba3f5c2-35d5-4960-bdfc-de9c162e39ce} - %profile%\extensions\{aba3f5c2-35d5-4960-bdfc-de9c162e39ce}
FF - Ext: Taboo: taboo@runningfrombears.com - %profile%\extensions\taboo@runningfrombears.com
FF - Ext: deskCut: {9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA} - %profile%\extensions\{9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}
FF - Ext: BetterPrivacy: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3} - %profile%\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
FF - Ext: IE View: {6e84150a-d526-41f1-a480-a67d3fed910d} - %profile%\extensions\{6e84150a-d526-41f1-a480-a67d3fed910d}
FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - Ext: Download Statusbar: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} - %profile%\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
FF - Ext: Easy Youtube Video Downloader: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} - %profile%\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - user.js: yahoo.homepage.dontask - true
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-PC Pitstop Optimize Reminder - c:\program files\PCPitstop\Optimize3\Reminder-Optimize3.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-24 01:46
Windows 6.0.6001 Service Pack 1 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,75,09,77,d3,3c,86,4d,44,99,a7,06,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,75,09,77,d3,3c,86,4d,44,99,a7,06,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
"MSCurrentCountry "=dword:000000b5
.
Completion time: 2011-05-24 01:50:45
ComboFix-quarantined-files.txt 2011-05-24 06:50
.
Pre-Run: 60,365,377,536 bytes free
Post-Run: 60,039,208,960 bytes free
.
- - End Of File - - 29A5B09BBE8DC44BAD3BAFB5DE647614

broni · 2011/05/28

Is the computer doing any better?

Can you update and run MBAM now?

tvjohns · 2011/06/02

Computer is doing great. No glitches, hangups or any sort of problem showing.

I am able to run MalwareByts at will and in fact have done so. MBAM works great. I would never be without it.

tvjohns · 2011/06/02

P.S. To be accurate I should have added when I said I have run MBAM that the result showed computer clean.

broni · 2011/06/02

Good news

Let's run couple more checks to make sure, nothing is hiding there...

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Click the Scan All Users checkbox.

Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

broni · 2011/06/08

Reopened.

tvjohns · 2011/06/09

Not sure I did this OTL thing right. I ran it again tonight and got a OTL.txt file with tonights date. But NOT a Extras.txt file with tonight's date. Still have yesterday's Extra file though which I will submit.

broni · 2011/06/09

Go ahead...

tvjohns · 2011/06/09

Just got error message on OTL log file post in quick reply. Says file is too long (56995 characters). Must shorten to 55000. So guess I must send OTL log in 2 separate quick replies. So 2 parts follow:

tvjohns · 2011/06/09

OTL logfile created on: 6/9/2011 10:57:19 PM - Run 2
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Timothy\Desktop\OTL SCAN AND LOGS
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.93 Gb Total Physical Memory | 1.04 Gb Available Physical Memory | 53.94% Memory free
4.11 Gb Paging File | 2.81 Gb Available in Paging File | 68.41% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 139.29 Gb Total Space | 54.36 Gb Free Space | 39.03% Space Free | Partition Type: NTFS
Drive D: | 9.76 Gb Total Space | 3.29 Gb Free Space | 33.74% Space Free | Partition Type: NTFS
Drive F: | 232.88 Gb Total Space | 152.96 Gb Free Space | 65.68% Space Free | Partition Type: NTFS
Drive G: | 1.89 Gb Total Space | 1.47 Gb Free Space | 77.78% Space Free | Partition Type: FAT

Computer Name: TIMOTHY-PC | User Name: Timothy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/08 19:24:35 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Timothy\Desktop\OTL SCAN AND LOGS\OTL.exe
PRC - [2011/05/10 07:10:58 | 003,459,712 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2011/05/10 07:10:57 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/10/02 07:47:46 | 012,479,664 | ---- | M] (Mozilla Messaging) -- C:\Program Files\Mozilla Thunderbird\thunderbird.exe
PRC - [2010/08/09 09:32:50 | 000,139,944 | ---- | M] () -- C:\Program Files\Dell V310-V510 Series\ezprint.exe
PRC - [2010/08/09 09:32:48 | 000,770,728 | ---- | M] () -- C:\Program Files\Dell V310-V510 Series\dleamon.exe
PRC - [2009/11/10 10:28:06 | 001,131,808 | ---- | M] (LeapFrog Enterprises, Inc.) -- C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
PRC - [2009/03/02 21:38:13 | 000,017,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iashost.exe
PRC - [2008/10/29 01:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/07/11 16:04:24 | 000,716,800 | ---- | M] (Sphinx Software) -- C:\Program Files\VistaFirewallControl\VistaFirewallControl.exe
PRC - [2008/07/11 16:03:08 | 000,286,720 | ---- | M] (Sphinx Software) -- C:\Program Files\VistaFirewallControl\VistaFirewallService.exe
PRC - [2008/01/19 02:33:28 | 001,169,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sdclt.exe
PRC - [2007/07/24 12:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
PRC - [2007/06/14 03:15:34 | 000,598,960 | ---- | M] ( ) -- C:\Windows\System32\lxdkcoms.exe
PRC - [2007/04/15 01:31:34 | 001,291,264 | ---- | M] () -- C:\Program Files\Rainlendar2\Rainlendar2.exe
PRC - [2006/10/04 23:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe

========== Modules (SafeList) ==========

MOD - [2011/06/08 19:24:35 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Timothy\Desktop\OTL SCAN AND LOGS\OTL.exe
MOD - [2011/05/10 07:10:55 | 000,199,792 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll
MOD - [2008/01/19 02:26:34 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2011/05/16 12:49:34 | 000,013,160 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files\Citrix\GoToAssist\615\g2aservice.exe -- (GoToAssist)
SRV - [2011/05/10 07:10:57 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/05/21 17:19:52 | 000,598,696 | ---- | M] ( ) [Auto | Stopped] -- C:\Windows\System32\dleacoms.exe -- (dlea_device)
SRV - [2010/05/21 17:19:46 | 000,193,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\spool\DRIVERS\W32X86\3\\dleaserv.exe -- (dleaCATSCustConnectService)
SRV - [2009/11/10 10:28:06 | 001,131,808 | ---- | M] (LeapFrog Enterprises, Inc.) [Auto | Running] -- C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe -- (LeapFrog Connect Device Service)
SRV - [2008/07/11 16:03:08 | 000,286,720 | ---- | M] (Sphinx Software) [Auto | Running] -- C:\Program Files\VistaFirewallControl\VistaFirewallService.exe -- (VistaFirewallService)
SRV - [2008/01/19 02:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/07/24 12:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2007/06/14 03:15:34 | 000,598,960 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxdkcoms.exe -- (lxdk_device)
SRV - [2006/10/04 23:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

========== Driver Services (SafeList) ==========

DRV - [2011/05/10 07:03:54 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/05/10 07:03:44 | 000,307,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/05/10 07:02:37 | 000,049,240 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/05/10 06:59:56 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/05/10 06:59:44 | 000,053,592 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2011/05/10 06:59:35 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/07/07 09:05:32 | 000,014,904 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\psi_mf.sys -- (PSI)
DRV - [2008/01/19 01:14:59 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2007/03/12 17:49:30 | 000,354,816 | ---- | M] (Realtek) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTL85n86.sys -- (RTL85n86)
DRV - [2007/01/26 03:19:46 | 002,387,456 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2007/01/02 19:44:30 | 000,649,216 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2006/11/28 02:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006/11/02 02:30:56 | 002,589,184 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw2v32.sys -- (NETw2v32) Intel(R)
DRV - [2006/11/02 02:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=PTB&M=MT3707

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - HKLM\software\mozilla\Firefox\Extensions\\copytolightning@corel.com: c:\Program Files\Corel\WordPerfect Lightning\Programs\FirefoxExtension\ [2010/02/05 13:18:37 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\downloader@finalvideotools.com: C:\Program Files\FinalVideoDownloader\Firefox [2010/12/26 02:50:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/30 21:45:07 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/01/24 00:46:11 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/02/03 23:51:38 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/10/02 07:47:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Extensions
[2010/10/02 07:47:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010/04/29 20:13:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\6revo64t.ReDo 01\extensions
[2011/01/23 22:40:09 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\6revo64t.ReDo 01\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/05/09 18:00:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions
[2011/01/17 10:14:46 | 000,000,000 | ---D | M] ( "Search Engine Security ") -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\{197573FA-9BF9-11DF-9D68-A441DFD72085}(623)
[2011/01/23 22:40:10 | 000,000,000 | ---D | M] (IE View) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\{6e84150a-d526-41f1-a480-a67d3fed910d}
[2011/01/23 22:40:10 | 000,000,000 | ---D | M] (deskCut) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\{9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}
[2011/01/23 22:40:10 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2011/01/23 22:40:10 | 000,000,000 | ---D | M] ( "OpenBook ") -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\{aba3f5c2-35d5-4960-bdfc-de9c162e39ce}
[2011/03/12 13:43:06 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/01/17 10:14:46 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(634)
[2011/01/24 11:56:42 | 000,000,000 | ---D | M] (Easy Youtube Video Downloader) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
[2011/01/23 22:40:11 | 000,000,000 | ---D | M] ( "BetterPrivacy ") -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
[2011/01/24 06:26:33 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2011/01/17 10:14:48 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}(640)
[2011/01/23 22:40:11 | 000,000,000 | ---D | M] ( "Tab Mix Plus ") -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2011/01/23 22:40:11 | 000,000,000 | ---D | M] (Aeon) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\{ded0fc70-7215-4802-afeb-b2982d3e7225}
[2011/02/03 23:51:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\artur.dubovoy@gmail.com
[2011/01/17 10:14:47 | 000,000,000 | ---D | M] (Autofill Forms) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\autofillForms@blueimp(603).net
[2011/05/26 20:15:25 | 000,000,000 | ---D | M] (Autofill Forms) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\autofillForms@blueimp.net
[2011/01/23 22:40:10 | 000,000,000 | ---D | M] (Taboo) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\bknhjd23.Tim's Profile\extensions\taboo@runningfrombears.com
[2011/01/24 00:35:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\lgfmn6ec.Tim User\extensions
[2011/01/23 22:40:12 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\lgfmn6ec.Tim User\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2011/01/23 22:40:12 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\lgfmn6ec.Tim User\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/01/23 22:40:12 | 000,000,000 | ---D | M] (IE View) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\lgfmn6ec.Tim User\extensions\{6e84150a-d526-41f1-a480-a67d3fed910d}
[2011/01/23 22:40:12 | 000,000,000 | ---D | M] (deskCut) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\lgfmn6ec.Tim User\extensions\{9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}
[2011/01/23 22:40:12 | 000,000,000 | ---D | M] ( "OpenBook ") -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\lgfmn6ec.Tim User\extensions\{aba3f5c2-35d5-4960-bdfc-de9c162e39ce}
[2011/01/23 22:40:12 | 000,000,000 | ---D | M] ( "BetterPrivacy ") -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\lgfmn6ec.Tim User\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
[2011/01/23 22:40:12 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\lgfmn6ec.Tim User\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2011/01/23 22:40:12 | 000,000,000 | ---D | M] ( "Tab Mix Plus ") -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\lgfmn6ec.Tim User\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2011/01/23 22:40:12 | 000,000,000 | ---D | M] (Aeon) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\lgfmn6ec.Tim User\extensions\{ded0fc70-7215-4802-afeb-b2982d3e7225}
[2011/01/23 22:40:11 | 000,000,000 | ---D | M] (Autofill Forms) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\lgfmn6ec.Tim User\extensions\autofillForms@blueimp.net
[2011/01/23 22:40:11 | 000,000,000 | ---D | M] (Taboo) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\lgfmn6ec.Tim User\extensions\taboo@runningfrombears.com
[2011/01/23 22:40:12 | 000,000,000 | ---D | M] (1-Click YouTube Video Downloader) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\lgfmn6ec.Tim User\extensions\YoutubeDownloader@PeterOlayev.com
[2010/04/29 19:44:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Timothy\AppData\Roaming\Mozilla\Firefox\Profiles\zx39zvl4.User2010_4_29\extensions
[2010/12/26 02:50:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/10/07 23:03:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/07 23:02:44 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/05/01 15:37:05 | 000,005,961 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\The Free Dictionary.xml

O1 HOSTS File: ([2011/05/24 01:46:48 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Dell Toolbar) - {09B71986-2AC5-482d-B6CB-42EA34F4F85B} - C:\Program Files\Dell Toolbar\toolband.dll ()
O2 - BHO: (iFinger plugin / Browser helper object) - {A114D52B-870C-4F15-8021-B6D7F91A054B} - C:\Program Files\iFinger\plugins\IE.ifp (iFinger Ltd)
O3 - HKLM\..\Toolbar: (Dell Toolbar) - {09B71986-2AC5-482d-B6CB-42EA34F4F85B} - C:\Program Files\Dell Toolbar\toolband.dll ()
O3 - HKCU\..\Toolbar\ShellBrowser: (Dell Toolbar) - {09B71986-2AC5-482D-B6CB-42EA34F4F85B} - C:\Program Files\Dell Toolbar\toolband.dll ()
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [dleamon.exe] C:\Program Files\Dell V310-V510 Series\dleamon.exe ()
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Dell V310-V510 Series\ezprint.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Tweak UI] C:\Windows\System32\TWEAKUI.CPL (Microsoft Corporation)
O4 - HKLM..\Run: [VistaFirewallControl] C:\Program Files\VistaFirewallControl\VistaFirewallControl.exe (Sphinx Software)
O4 - HKCU..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe ()
O4 - HKCU..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10l_Plugin.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\Timothy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stickies.lnk = C:\Program Files\stickies\stickies.exe (Zhorn Software)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LockTaskbar = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: TaskbarNoThumbnail = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: TaskbarNoNotification = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LockTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCABattery = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCANetwork = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAVolume = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWinKeys = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisablePersonalDirChange = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSecurityTab = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 1
O8 - Extra context menu item: Copy to &Lightning Note - c:\Program Files\Corel\WordPerfect Lightning\Programs\WPLightningCopyToNote.hta ()
O8 - Extra context menu item: Open with WordPerfect - c:\Program Files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta ()
O9 - Extra Button: Download Video - {3B54DEAB-C6D4-48a8-8C32-A70558643400} - C:\Program Files\FinalVideoDownloader\fvdRunner.html ()
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll (PCPitstop Exam)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\615\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\615\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Users\Timothy\Pictures\My Pictures\Haylee Portrait redEye fixed 04.jpg
O24 - Desktop BackupWallPaper: C:\Users\Timothy\Pictures\My Pictures\Haylee Portrait redEye fixed 04.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010/10/08 20:18:45 | 000,000,000 | R--D | M] - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010/10/08 20:18:45 | 000,000,000 | R--D | M] - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010/10/08 20:27:00 | 000,000,000 | R--D | M] - F:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2011/05/12 14:30:44 | 000,000,000 | RHSD | M] - G:\autorun.inf -- [ FAT ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...com [@ = ComFile] -- Reg Error: Key error. File not found
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codecx.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\Windows\System32\divx.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/06/08 20:06:04 | 000,000,000 | ---D | C] -- C:\Users\Timothy\Desktop\OTL SCAN AND LOGS
[2011/06/07 21:43:07 | 000,441,176 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2011/05/26 07:44:09 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011/05/24 14:43:10 | 000,000,000 | ---D | C] -- C:\Users\Timothy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell Inc
[2011/05/24 12:40:10 | 000,000,000 | ---D | C] -- C:\Users\Timothy\AppData\Local\Deployment
[2011/05/24 09:20:01 | 000,442,368 | ---- | C] ( ) -- C:\Windows\System32\dleacoin.dll
[2011/05/24 01:50:55 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/05/24 01:50:47 | 000,000,000 | ---D | C] -- C:\Users\Timothy\AppData\Local\temp
[2011/05/24 01:29:18 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/05/24 01:29:18 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/05/24 01:29:18 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/05/24 01:27:25 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2011/05/24 01:16:27 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/05/23 22:43:58 | 000,000,000 | ---D | C] -- C:\Users\Timothy\Desktop\MOVIEPLEX
[2011/05/23 20:42:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Dell V310-V510 Series
[2011/05/23 20:27:11 | 000,000,000 | R--D | C] -- C:\Users\Timothy\Application Data\Microsoft\Internet Explorer\Quick Launch\DELL STUFF
[2011/05/23 10:57:29 | 000,000,000 | ---D | C] -- C:\Users\Timothy\{170c9440-7bac-4bb1-98c3-a42d7f93ba46}
[2011/05/23 10:53:36 | 000,000,000 | ---D | C] -- C:\Program Files\Dell
[2011/05/23 10:52:30 | 000,000,000 | ---D | C] -- C:\Program Files\Dell Toolbar
[2011/05/23 10:52:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell Printers
[2011/05/23 10:52:20 | 000,000,000 | ---D | C] -- C:\Program Files\Dell PC Fax
[2011/05/23 10:52:17 | 000,000,000 | ---D | C] -- C:\Program Files\Dell Printable Web
[2011/05/23 10:51:11 | 000,364,544 | ---- | C] ( ) -- C:\Windows\System32\dleainpa.dll
[2011/05/23 10:51:11 | 000,356,352 | ---- | C] ( ) -- C:\Windows\System32\DLEAhcp.dll
[2011/05/23 10:51:11 | 000,344,064 | ---- | C] ( ) -- C:\Windows\System32\dleaiesc.dll
[2011/05/23 10:51:10 | 001,048,576 | ---- | C] ( ) -- C:\Windows\System32\dleaserv.dll
[2011/05/23 10:51:10 | 000,847,872 | ---- | C] ( ) -- C:\Windows\System32\dleausb1.dll
[2011/05/23 10:51:09 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\dleapmui.dll
[2011/05/23 10:51:09 | 000,577,536 | ---- | C] ( ) -- C:\Windows\System32\dlealmpm.dll
[2011/05/23 10:51:08 | 000,324,264 | ---- | C] ( ) -- C:\Windows\System32\dleaih.exe
[2011/05/23 10:51:07 | 000,688,128 | ---- | C] ( ) -- C:\Windows\System32\dleahbn3.dll
[2011/05/23 10:51:06 | 000,598,696 | ---- | C] ( ) -- C:\Windows\System32\dleacoms.exe
[2011/05/23 10:51:06 | 000,372,736 | ---- | C] ( ) -- C:\Windows\System32\dleacomm.dll
[2011/05/23 10:51:05 | 000,802,816 | ---- | C] ( ) -- C:\Windows\System32\dleacomc.dll
[2011/05/23 10:51:05 | 000,373,416 | ---- | C] ( ) -- C:\Windows\System32\dleacfg.exe
[2011/05/23 10:49:58 | 000,000,000 | ---D | C] -- C:\Program Files\Dell V310-V510 Series
[2011/05/16 15:10:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Ezprint
[2011/05/16 13:57:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Dl_cats
[2011/05/16 12:55:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Citrix
[2011/05/16 12:49:35 | 000,000,000 | ---D | C] -- C:\Program Files\Citrix
[2011/05/16 12:49:13 | 000,000,000 | ---D | C] -- C:\Users\Timothy\AppData\Local\Citrix
[2011/05/12 12:32:00 | 000,000,000 | ---D | C] -- C:\Users\Timothy\AppData\Roaming\PC Tools
[2011/05/12 12:32:00 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2011/05/12 12:32:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2011/05/12 12:16:34 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2007/06/13 22:15:36 | 000,320,432 | ---- | C] ( ) -- C:\Windows\System32\lxdkih.exe
[2007/06/13 22:15:34 | 000,598,960 | ---- | C] ( ) -- C:\Windows\System32\lxdkcoms.exe
[2007/06/13 22:15:32 | 000,365,488 | ---- | C] ( ) -- C:\Windows\System32\lxdkcfg.exe
[2007/05/17 04:11:04 | 000,647,168 | ---- | C] ( ) -- C:\Windows\System32\lxdkpmui.dll
[2007/05/17 04:08:00 | 001,200,128 | ---- | C] ( ) -- C:\Windows\System32\lxdkserv.dll
[2007/05/17 04:03:04 | 000,356,352 | ---- | C] ( ) -- C:\Windows\System32\lxdkinpa.dll
[2007/05/17 04:02:58 | 000,565,248 | ---- | C] ( ) -- C:\Windows\System32\lxdklmpm.dll
[2007/05/17 04:02:42 | 000,364,544 | ---- | C] ( ) -- C:\Windows\System32\lxdkcomm.dll
[2007/05/17 04:01:22 | 000,663,552 | ---- | C] ( ) -- C:\Windows\System32\lxdkhbn3.dll
[2007/05/17 04:00:42 | 000,950,272 | ---- | C] ( ) -- C:\Windows\System32\lxdkusb1.dll
[2007/05/17 04:00:30 | 000,860,160 | ---- | C] ( ) -- C:\Windows\System32\lxdkcomc.dll
[2007/05/17 03:59:12 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\lxdkprox.dll
[2007/05/17 03:57:02 | 000,339,968 | ---- | C] ( ) -- C:\Windows\System32\lxdkiesc.dll

========== Files - Modified Within 30 Days ==========

[2011/06/09 23:03:15 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/09 22:30:30 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/09 22:30:30 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/09 20:10:26 | 000,085,504 | ---- | M] () -- C:\Users\Timothy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/09 13:30:40 | 000,000,426 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{63FCD27C-7927-41DA-BAB8-30F16C6499BD}.job
[2011/06/09 00:03:00 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/08 06:30:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/06/07 21:43:07 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2011/06/02 01:13:06 | 000,595,684 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/06/02 01:13:06 | 000,101,350 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/06/02 00:54:50 | 000,000,930 | ---- | M] () -- C:\Users\Timothy\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/05/26 08:11:12 | 000,001,173 | ---- | M] () -- C:\Users\Timothy\Desktop\#0 Desktop Text Files.lnk
[2011/05/24 22:31:19 | 000,000,491 | ---- | M] () -- C:\Users\Timothy\Desktop\# MY SCANS.lnk
[2011/05/24 22:20:04 | 000,000,491 | ---- | M] () -- C:\Users\Timothy\Documents\MY SCANS Pix.lnk
[2011/05/24 17:52:06 | 000,000,530 | ---- | M] () -- C:\Users\Timothy\Desktop\My Scans.lnk
[2011/05/24 17:38:06 | 000,186,432 | ---- | M] () -- C:\Windows\System32\LexFiles.ulf
[2011/05/24 17:15:46 | 000,001,807 | ---- | M] () -- C:\Users\Public\Desktop\Dell Scan.LNK
[2011/05/24 14:58:45 | 000,000,433 | ---- | M] () -- C:\Users\Timothy\Desktop\ComboFix Log.lnk
[2011/05/24 13:04:42 | 000,103,784 | ---- | M] () -- C:\Users\Timothy\GoToAssistDownloadHelper.exe
[2011/05/24 01:46:48 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/05/24 00:55:01 | 000,010,362 | -HS- | M] () -- C:\Users\Timothy\AppData\Local\s3y6i48l744h4x280ce123866cp324d301uytp1006
[2011/05/24 00:55:01 | 000,010,362 | -HS- | M] () -- C:\ProgramData\s3y6i48l744h4x280ce123866cp324d301uytp1006
[2011/05/18 11:35:49 | 000,001,813 | ---- | M] () -- C:\Users\Timothy\Application Data\Microsoft\Internet Explorer\Quick Launch\Order of Service.lnk
[2011/05/12 13:43:59 | 000,009,516 | -HS- | M] () -- C:\Users\Timothy\AppData\Local\230t17d8r0p00q1761g3mnq4h8r4n7k5w62
[2011/05/12 13:43:59 | 000,009,516 | -HS- | M] () -- C:\ProgramData\230t17d8r0p00q1761g3mnq4h8r4n7k5w62

========== Files Created - No Company Name ==========

[2011/05/24 22:31:19 | 000,000,491 | ---- | C] () -- C:\Users\Timothy\Desktop\# MY SCANS.lnk
[2011/05/24 22:20:04 | 000,000,491 | ---- | C] () -- C:\Users\Timothy\Documents\MY SCANS Pix.lnk
[2011/05/24 17:52:06 | 000,000,530 | ---- | C] () -- C:\Users\Timothy\Desktop\My Scans.lnk
[2011/05/24 17:15:46 | 000,001,807 | ---- | C] () -- C:\Users\Public\Desktop\Dell Scan.LNK
[2011/05/24 14:58:45 | 000,000,433 | ---- | C] () -- C:\Users\Timothy\Desktop\ComboFix Log.lnk
[2011/05/24 12:52:56 | 000,103,784 | ---- | C] () -- C:\Users\Timothy\GoToAssistDownloadHelper.exe
[2011/05/24 09:20:21 | 000,040,960 | ---- | C] () -- C:\Windows\System32\dleavs.dll
[2011/05/24 09:19:48 | 000,065,106 | ---- | C] () -- C:\Windows\System32\dleaprpr.chm
[2011/05/24 09:19:47 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dleagcfg.dll
[2011/05/24 09:19:45 | 000,294,912 | ---- | C] () -- C:\Windows\System32\dleacui.dll
[2011/05/24 09:19:45 | 000,110,592 | ---- | C] () -- C:\Windows\System32\dleacuir.dll
[2011/05/24 09:19:45 | 000,008,696 | ---- | C] () -- C:\Windows\System32\dleacommuilogo_rtl.bmp
[2011/05/24 09:19:45 | 000,008,696 | ---- | C] () -- C:\Windows\System32\dleacommuilogo.bmp
[2011/05/24 01:29:18 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/05/24 01:29:18 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/05/24 01:29:18 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011/05/24 01:29:18 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/05/24 01:29:18 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/05/24 00:48:03 | 000,010,362 | -HS- | C] () -- C:\Users\Timothy\AppData\Local\s3y6i48l744h4x280ce123866cp324d301uytp1006
[2011/05/24 00:48:03 | 000,010,362 | -HS- | C] () -- C:\ProgramData\s3y6i48l744h4x280ce123866cp324d301uytp1006
[2011/05/23 10:55:09 | 000,372,736 | ---- | C] () -- C:\Windows\System32\DLEAwupd.dll
[2011/05/23 10:55:09 | 000,213,672 | ---- | C] () -- C:\Windows\System32\DLEAwupd.exe
[2011/05/23 10:51:11 | 000,331,776 | ---- | C] () -- C:\Windows\System32\DLEAinst.dll
[2011/05/23 10:51:09 | 000,057,344 | ---- | C] () -- C:\Windows\System32\dleajswr.dll
[2011/05/23 10:51:08 | 000,323,584 | ---- | C] () -- C:\Windows\System32\dleains.dll
[2011/05/23 10:51:08 | 000,262,144 | ---- | C] () -- C:\Windows\System32\dleainsb.dll
[2011/05/23 10:51:08 | 000,106,496 | ---- | C] () -- C:\Windows\System32\dleainsr.dll
[2011/05/23 10:51:07 | 000,208,896 | ---- | C] () -- C:\Windows\System32\dleagrd.dll
[2011/05/23 10:51:07 | 000,090,112 | ---- | C] () -- C:\Windows\System32\dleacub.dll
[2011/05/23 10:51:06 | 000,253,952 | ---- | C] () -- C:\Windows\System32\dleacu.dll
[2011/05/23 10:51:06 | 000,036,864 | ---- | C] () -- C:\Windows\System32\dleacur.dll
[2011/05/23 10:51:05 | 000,086,180 | ---- | C] () -- C:\Windows\System32\DLEAcfg.dll
[2011/05/23 10:51:05 | 000,002,064 | ---- | C] () -- C:\Windows\System32\dlea.loc
[2011/05/18 08:16:05 | 000,001,813 | ---- | C] () -- C:\Users\Timothy\Application Data\Microsoft\Internet Explorer\Quick Launch\Order of Service.lnk
[2011/05/16 13:07:16 | 000,028,672 | ---- | C] () -- C:\Windows\System32\DLEAsmr.dll
[2011/05/16 13:07:15 | 000,299,008 | ---- | C] () -- C:\Windows\System32\DLEAsm.dll
[2011/05/12 00:07:54 | 000,009,516 | -HS- | C] () -- C:\Users\Timothy\AppData\Local\230t17d8r0p00q1761g3mnq4h8r4n7k5w62
[2011/05/12 00:07:54 | 000,009,516 | -HS- | C] () -- C:\ProgramData\230t17d8r0p00q1761g3mnq4h8r4n7k5w62
[2011/03/27 17:42:12 | 000,000,141 | ---- | C] () -- C:\Windows\CareBear.ini
[2011/02/14 14:22:47 | 000,000,048 | ---- | C] () -- C:\Windows\TaxACT10.ini
[2011/01/26 15:05:41 | 002,447,334 | ---- | C] () -- C:\Users\Timothy\AppData\Local\[j0003]-[p01].bmp
[2010/12/27 23:46:08 | 000,069,632 | ---- | C] () -- C:\Windows\System32\GkSui18.EXE
[2010/11/12 18:16:55 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2010/03/04 01:43:50 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010/02/22 11:20:01 | 000,000,048 | ---- | C] () -- C:\Windows\TaxACT09.ini
[2010/02/05 13:25:19 | 000,002,828 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2009/12/26 15:25:01 | 000,000,110 | ---- | C] () -- C:\Windows\{7E7D778E-121D-4BBD-BA29-FAA81B9FBD8C}_WiseFW.ini
[2009/12/07 13:19:41 | 000,000,680 | ---- | C] () -- C:\Users\Timothy\AppData\Local\d3d9caps.dat
[2009/09/30 16:20:56 | 000,000,626 | ---- | C] () -- C:\Windows\unins001.dat
[2009/09/21 21:40:45 | 000,000,661 | ---- | C] () -- C:\Windows\unins000.dat
[2009/08/12 21:56:59 | 000,000,047 | ---- | C] () -- C:\Windows\WinInit.Ini
[2009/06/26 22:11:09 | 000,100,043 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009/02/28 12:34:24 | 000,000,057 | ---- | C] () -- C:\Windows\TaxACT08.ini
[2008/09/22 17:11:29 | 000,003,654 | ---- | C] () -- C:\Windows\System32\drivers\Sonyhcp.dll
[2008/07/31 15:49:02 | 000,001,065 | ---- | C] () -- C:\Windows\winamp.ini
[2008/07/26 20:12:13 | 000,010,852 | ---- | C] () -- C:\ProgramData\lxdk
[2008/07/25 13:54:32 | 000,053,248 | ---- | C] () -- C:\Windows\uneng.exe
[2008/07/16 23:05:10 | 000,073,220 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat
[2008/07/16 23:05:10 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat
[2008/07/16 23:05:10 | 000,029,114 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat
[2008/07/16 23:05:10 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat
[2008/07/16 23:05:10 | 000,021,021 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat
[2008/07/16 23:05:10 | 000,015,670 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat
[2008/07/16 23:05:10 | 000,013,280 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat
[2008/07/16 23:05:10 | 000,010,673 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat
[2008/07/16 23:05:10 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat
[2008/07/16 23:05:10 | 000,001,140 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat
[2008/07/16 23:05:10 | 000,001,140 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat
[2008/07/16 23:05:10 | 000,001,137 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat
[2008/07/16 23:05:10 | 000,001,130 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat
[2008/07/16 23:05:10 | 000,001,130 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat
[2008/07/16 23:05:10 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat
[2008/07/16 23:05:10 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2008/07/16 22:02:34 | 000,000,044 | ---- | C] () -- C:\Windows\EPR220.ini
[2008/07/15 20:22:34 | 000,069,632 | ---- | C] () -- C:\Windows\System32\lxdkoem.dll
[2007/08/04 16:11:49 | 000,163,840 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2007/08/04 16:11:46 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2007/08/04 16:11:46 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2007/08/04 16:11:45 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2007/08/04 16:11:42 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2007/06/28 16:45:58 | 000,087,808 | ---- | C] () -- C:\Windows\System32\cpwmon2k.dll
[2007/06/16 13:57:53 | 000,023,888 | ---- | C] () -- C:\Users\Timothy\AppData\Roaming\UserTile.png
[2007/06/08 16:26:33 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2007/06/08 10:11:59 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2007/06/07 20:50:55 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2007/06/07 15:51:57 | 000,000,094 | ---- | C] () -- C:\Users\Timothy\AppData\Roaming\wklnhst.dat
[2007/06/07 15:13:14 | 000,085,504 | ---- | C] () -- C:\Users\Timothy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/06/05 22:25:46 | 000,208,896 | ---- | C] () -- C:\Windows\System32\lxdkgrd.dll
[2007/05/03 05:50:10 | 000,348,160 | ---- | C] () -- C:\Windows\System32\lxdkcoin.dll
[2007/03/16 20:01:59 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2007/03/16 20:01:56 | 000,145,112 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2007/03/16 19:59:13 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007/03/16 19:46:57 | 000,000,004 | ---- | C] () -- C:\Windows\Pix11.dat
[2006/11/02 07:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 07:47:37 | 000,431,736 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:33:01 | 000,595,684 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,101,350 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 05:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006/11/02 05:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 03:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/11/02 02:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2006/07/31 15:53:18 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxdkvs.dll
[2006/06/11 19:01:15 | 000,352,256 | ---- | C] () -- C:\Windows\System32\HotlineClient.exe
[2002/09/18 00:45:00 | 000,119,808 | ---- | C] () -- C:\Windows\lsb_un20.exe
[1999/01/22 13:46:58 | 000,065,536 | ---- | C] () -- C:\Windows\System32\MSRTEDIT.DLL

========== LOP Check ==========

[2011/01/23 22:40:02 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\5300 Series
[2008/07/25 21:05:07 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\Ashampoo
[2007/06/19 11:01:59 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\Bret Taylor
[2008/12/02 00:04:23 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\Bullzip
[2009/07/08 23:48:19 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\FileZilla
[2010/12/26 03:01:51 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\FinalVideoDownloader
[2010/10/26 21:22:31 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\Foxit
[2011/01/23 22:40:02 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\GetRightToGo
[2011/03/17 21:42:37 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\InfraRecorder
[2007/06/19 14:06:51 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\IrfanView
[2011/01/23 22:40:02 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\KompoZer
[2008/08/04 13:26:37 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\Leadertech
[2009/06/26 20:25:10 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\Lexmark Productivity Studio
[2007/06/07 15:54:45 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\SampleView
[2009/07/10 20:48:16 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\Serif
[2011/05/12 13:57:19 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\stickies
[2008/04/04 23:37:55 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\SumatraPDF
[2007/06/07 15:52:36 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\Template
[2011/01/23 22:40:13 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\Thunderbird
[2010/09/24 16:35:47 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\uTorrent
[2009/12/07 00:17:04 | 000,000,000 | ---D | M] -- C:\Users\Timothy\AppData\Roaming\WildTangent
[2011/06/08 06:27:36 | 000,032,548 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/06/09 13:30:40 | 000,000,426 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{63FCD27C-7927-41DA-BAB8-30F16C6499BD}.job

========== Purity Check ==========

tvjohns · 2011/06/09

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 16:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2008/01/19 02:45:45 | 000,333,203 | RHS- | M] () -- C:\bootmgr
[2006/06/11 19:36:06 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2011/05/24 01:50:45 | 000,017,074 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 16:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2009/04/19 16:04:43 | 000,000,311 | ---- | M] () -- C:\faxend.log
[2009/04/19 16:04:43 | 000,000,162 | ---- | M] () -- C:\faxendPdoc.log
[2009/04/19 16:04:42 | 000,000,248 | ---- | M] () -- C:\faxfile.log
[2007/06/12 15:42:51 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/10/07 23:35:18 | 000,016,378 | ---- | M] () -- C:\JavaRa.log
[2007/06/12 15:42:51 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011/06/08 06:29:47 | 2392,211,456 | -HS- | M] () -- C:\pagefile.sys
[2007/03/16 19:45:40 | 000,000,163 | ---- | M] () -- C:\power2go.log
[2007/11/18 11:38:44 | 000,000,138 | ---- | M] () -- C:\Quick Restore Point.vbs
[2011/05/12 12:09:11 | 000,115,084 | ---- | M] () -- C:\TDSSKiller.2.5.0.0_12.05.2011_12.07.38_log.txt

< %systemroot%\Fonts\*.com >
[2006/11/02 07:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 07:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 07:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 07:37:12 | 000,030,808 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 16:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/11/04 08:14:19 | 000,157,696 | ---- | M] () -- C:\Windows\System32\spool\prtprocs\w32x86\dleadrpp.dll
[2008/10/28 12:49:30 | 000,321,536 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\hpzpp696.dll
[2008/01/19 02:34:28 | 000,089,600 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 07:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 21:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/10 07:10:59 | 000,040,112 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/06/26 23:01:44 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 05:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 05:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 05:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/05/22 20:27:36 | 000,000,612 | -HS- | M] () -- C:\Users\Timothy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/02/07 14:52:13 | 001,428,392 | ---- | M] () -- C:\Users\Timothy\Desktop\ta10mo1040.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >
[2011/05/24 13:04:42 | 000,103,784 | ---- | M] () -- C:\Users\Timothy\GoToAssistDownloadHelper.exe

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >
[2009/06/26 23:00:17 | 000,008,192 | ---- | M] () -- C:\Windows\security\database\edb.chk
[2009/06/26 22:59:47 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edb.log
[2009/06/26 22:59:46 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00001.jrs
[2009/06/26 22:59:47 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00002.jrs
[2009/06/26 22:59:46 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbtmp.log
[2009/06/26 22:59:47 | 001,056,768 | ---- | M] () -- C:\Windows\security\database\tmp.edb

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2011/05/16 14:47:14 | 000,000,540 | ---- | M] () -- C:\Users\Timothy\Favorites\0 0 My Library.lnk
[2011/05/16 14:47:14 | 000,000,825 | ---- | M] () -- C:\Users\Timothy\Favorites\CHURCH.LNK
[2011/05/16 14:47:14 | 000,000,104 | ---- | M] () -- C:\Users\Timothy\Favorites\Computer.LNK
[2007/09/01 12:21:29 | 000,000,402 | -HS- | M] () -- C:\Users\Timothy\Favorites\desktop.ini
[2011/05/16 14:47:14 | 000,000,406 | ---- | M] () -- C:\Users\Timothy\Favorites\DOWNLOADS.LNK
[2011/05/16 14:47:14 | 000,000,812 | ---- | M] () -- C:\Users\Timothy\Favorites\FORMS.LNK
[2011/05/16 14:47:14 | 000,000,759 | ---- | M] () -- C:\Users\Timothy\Favorites\GATEWAY OEM PDF USER MANUALS.lnk
[2011/05/16 14:47:14 | 000,000,986 | ---- | M] () -- C:\Users\Timothy\Favorites\J.R.R. Tolkien.LNK
[2011/05/16 14:47:14 | 000,000,377 | ---- | M] () -- C:\Users\Timothy\Favorites\SAVE.lnk
[2011/05/16 14:47:14 | 000,000,722 | ---- | M] () -- C:\Users\Timothy\Favorites\STOREHOUSE.LNK
[2011/05/16 14:47:14 | 000,000,284 | ---- | M] () -- C:\Users\Timothy\Favorites\WD Backup (F).LNK
[2011/05/16 14:47:14 | 000,000,312 | ---- | M] () -- C:\Users\Timothy\Favorites\WD Backup.lnk
[2011/05/16 14:47:14 | 000,000,830 | ---- | M] () -- C:\Users\Timothy\Favorites\WRITING.LNK

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2011/05/12 13:43:59 | 000,009,516 | -HS- | M] () -- C:\ProgramData\230t17d8r0p00q1761g3mnq4h8r4n7k5w62
[2011/05/16 14:48:59 | 000,000,367 | ---- | M] () -- C:\ProgramData\dlea.log
[2011/05/23 20:42:15 | 000,000,248 | ---- | M] () -- C:\ProgramData\dleaDiagnostics.log
[2011/06/06 22:09:48 | 000,006,072 | ---- | M] () -- C:\ProgramData\dleaJSW.log
[2011/06/08 06:32:30 | 000,018,291 | ---- | M] () -- C:\ProgramData\dleascan.log
[2011/05/23 12:02:50 | 000,000,504 | ---- | M] () -- C:\ProgramData\FastPics.log
[2011/05/26 08:00:19 | 000,007,114 | ---- | M] () -- C:\ProgramData\hpzinstall.log
[2011/03/09 23:24:47 | 000,002,828 | -HS- | M] () -- C:\ProgramData\KGyGaAvL.sys
[2009/08/04 08:40:52 | 000,010,852 | ---- | M] () -- C:\ProgramData\lxdk
[2010/10/04 23:01:18 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2011/05/24 00:55:01 | 000,010,362 | -HS- | M] () -- C:\ProgramData\s3y6i48l744h4x280ce123866cp324d301uytp1006
[2011/05/16 13:08:10 | 000,000,000 | ---- | M] () -- C:\ProgramData\UpdaterLog.txt

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-10-10 03:25:44

========== Alternate Data Streams ==========

@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMPFC5A2B2

< End of report >

tvjohns · 2011/06/09

OTL Extras logfile created on: 6/8/2011 7:33:16 PM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Timothy\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.93 Gb Total Physical Memory | 1.02 Gb Available Physical Memory | 52.82% Memory free
4.11 Gb Paging File | 3.15 Gb Available in Paging File | 76.59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 139.29 Gb Total Space | 54.79 Gb Free Space | 39.33% Space Free | Partition Type: NTFS
Drive D: | 9.76 Gb Total Space | 3.29 Gb Free Space | 33.74% Space Free | Partition Type: NTFS
Drive F: | 232.88 Gb Total Space | 153.95 Gb Free Space | 66.10% Space Free | Partition Type: NTFS
Drive G: | 1.89 Gb Total Space | 1.47 Gb Free Space | 77.78% Space Free | Partition Type: FAT

Computer Name: TIMOTHY-PC | User Name: Timothy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-3777651122-2117734261-3338017706-1000\SOFTWARE\Classes\<extension>]
.bat [@ = batfile] -- Reg Error: Key error. File not found
.cmd [@ = cmdfile] -- Reg Error: Key error. File not found
.com [@ = ComFile] -- Reg Error: Key error. File not found
.exe [@ = exefile] -- Reg Error: Key error. File not found
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\Winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3777651122-2117734261-3338017706-1000]
"EnableNotificationsRef" = 3
"EnableNotifications" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3777651122-2117734261-3338017706-500]
"EnableNotificationsRef" = 2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{3DF2CD1F-53E6-46DF-A88F-27D97DE77049}" = rport=427 | protocol=17 | dir=in | svc=hpslpsvc | app=c:\windows\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02C96BF4-FA36-434E-8069-D8346547EFB2}" = dir=in | app=c:\windows\system32\dleacoms.exe |
"{0350E846-6F58-4CDA-8ECC-C895DAC6DA8F}" = protocol=6 | dir=in | app=c:\program files\abbyy finereader 6.0 sprint\scan\scanman6.exe |
"{05BB904D-4EE6-43E3-BFC1-44740108825A}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{08B9E8A5-8C3D-4352-B3F6-3C98C83EBB98}" = dir=in | app=c:\windows\system32\dleacoms.exe |
"{201C8A1C-E423-4FDA-8DE0-8CEEAC05C91F}" = dir=in | app=c:\windows\system32\dleacoms.exe |
"{3D2272F7-C578-4091-936C-A621471C4AFB}" = dir=in | app=c:\windows\system32\dleacoms.exe |
"{4638499C-B9DE-4BA3-8075-463700B7C9C5}" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"{4EAECC6A-B9FB-4359-A7F4-2E9BD51F65B3}" = dir=in | app=c:\windows\system32\dleacoms.exe |
"{508F726D-8A2B-44DC-B07C-41007FBC2D2D}" = protocol=17 | dir=in | app=c:\program files\lexmark 5300 series\lxdkmon.exe |
"{6529CB61-93BA-4CF3-BC5F-009734792653}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{6A95939C-4F0D-46C8-8DE8-4D975AE6368D}" = protocol=17 | dir=in | app=c:\program files\lexmark 5300 series\lxdkfax.exe |
"{8C48FD0A-C17D-4FC6-B010-46D7A2DE9E85}" = dir=in | app=c:\windows\system32\dleacoms.exe |
"{8F4A4547-B6E0-42D7-9B86-96EFCC703A23}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdkpswx.exe |
"{9C428E44-C2BF-416F-81D5-0720EF9B6940}" = dir=in | app=c:\windows\system32\dleacoms.exe |
"{A3C03C46-AA87-440E-902F-6EFB1C5B01A6}" = dir=in | app=c:\windows\system32\dleacoms.exe |
"{A787B4DB-BDD5-4F38-8B8D-89647CD3EB77}" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"{A873D863-2315-431A-B473-EFF6E6DF7EEE}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdkpswx.exe |
"{B1D5B609-CC36-420A-9059-3FB4BB495943}" = dir=in | app=c:\windows\system32\dleacoms.exe |
"{C02B3245-3360-4CC2-97BC-5404D12C4808}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe |
"{C6CB5C31-9123-4F29-B477-0041F4714769}" = protocol=6 | dir=in | app=c:\program files\lexmark 5300 series\lxdkmon.exe |
"{DE32A21C-F9F1-4BCE-AF8C-7C4322E9794C}" = protocol=17 | dir=in | app=c:\program files\abbyy finereader 6.0 sprint\scan\scanman6.exe |
"{F4E72491-AF1A-4AF4-83E3-6E702BBC0C76}" = dir=in | app=e:\setup\hpznui01.exe |
"{F5DC5189-2680-4392-AA45-1B00DBFA86D5}" = protocol=6 | dir=in | app=c:\program files\lexmark 5300 series\lxdkfax.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{DCDAB2ED-5741-4C30-A1A4-0FCB8A529001}" = WordPerfect Office X4
"{00010409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Professional
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0002E558-0ECD-A936-10A5-1B729DA43556}" = CCC Help Swedish
"{01386D1F-ADE7-43B4-A4E9-312FC5BC726F}_is1" = SWF Opener
"{09B71986-2AC5-482d-B6CB-42EA34F4F85B}" = Dell Toolbar
"{09DB429C-A7FD-A497-AB63-474312DA319A}" = CCC Help Hungarian
"{0EB2E325-0E93-E290-0050-2C7DD347F1C8}" = Catalyst Control Center Localization Swedish
"{0F3841EE-E95D-A803-BEAD-BCEF7599E9E4}" = Catalyst Control Center Localization Russian
"{1235083F-52F9-44CC-9DF5-F9B7802BB9B7}" = ISO Recorder
"{1949C64B-A7B5-DEBF-77E2-1BDB7F2680AF}" = CCC Help Turkish
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.6.5
"{1DF03ECE-6AF4-414E-B118-C316F151A9A2}" = Corel WordPerfect Office - iFilter
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{22B2E56B-3890-BE26-3A74-B7826095AEF4}" = Catalyst Control Center Localization Polish
"{25E7798D-2B75-10A0-EBDD-6C190984F63E}" = Catalyst Control Center Localization French
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21
"{27F0AAD2-0C7D-7C60-7B2B-03591B325373}" = Catalyst Control Center Localization Italian
"{322206DC-9408-F212-D620-A8FB2036B2FB}" = CCC Help German
"{360DF404-E2A5-C0FC-8408-F2205F8F93F0}" = Catalyst Control Center Localization Turkish
"{3935969C-E8AC-0352-CE71-1ABDA33934ED}" = Catalyst Control Center Localization Hungarian
"{39600969-41C3-4658-876E-16F108FC5C92}" = ISO Recorder
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}" = ATI Catalyst Install Manager
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4394DC3A-5DAC-4C80-A86E-FF462D0AD653}" = Windows 7 Upgrade Advisor Beta
"{44C05309-60F4-410B-BC32-31733CFF1A41}" = Microsoft Digital Image Starter Edition 2006 Editor
"{46CE3A3E-ADE9-0C32-88DF-9F591BC51418}" = Catalyst Control Center Localization Spanish
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{4873CC58-69D8-490D-9E5C-001DC2EE2000}" = WordPerfect Lightning
"{4873CC58-69D8-490D-9E5C-001DC2EE2010}" = WordPerfect Lightning - Messages
"{4873CC58-69D8-490D-9E5C-001DC2EE2020}" = WordPerfect Lightning - IPM
"{4873CC58-69D8-490D-9E5C-001DC2EE2100}" = WordPerfect Lightning - EN
"{495BA862-D59D-4676-C759-57269564E61E}" = CCC Help Japanese
"{49879A92-C58E-1519-0173-33DBC905264B}" = Catalyst Control Center Localization Danish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4DE0B33E-019A-CDBA-C2D1-C66F8598EF15}" = ccc-core-static
"{4FE542EB-FF0B-4739-94DD-25C8AE0AB251}" = Microsoft Digital Image Starter Edition 2006 Library
"{51C16BD0-9FFD-C784-A00B-91033B395CCD}" = CCC Help Chinese Standard
"{547962FC-1693-51BD-AE67-4A5624F248D7}" = Catalyst Control Center Localization Portuguese
"{5A30E7D9-5931-2E3B-24A5-1C61A8A32BEA}" = CCC Help Chinese Traditional
"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver
"{63AD467C-DD3C-6F83-BEAA-3AECD0A9ADE1}" = CCC Help Spanish
"{64FB04DB-0D65-379A-25AF-2364DD4CC808}" = CCC Help Thai
"{658F96CA-2453-4BF0-092E-940DA7B17771}" = Catalyst Control Center Localization Korean
"{65A3266C-E2B2-0516-6BD9-9646848582B6}" = CCC Help Finnish
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6D8E9408-AD5B-949A-BDAB-5E4CFB87F2D7}" = ccc-utility
"{6E7913EF-6D6F-CC09-F938-F90529786DD9}" = Catalyst Control Center Localization Chinese Traditional
"{7452472E-FC85-4AEB-8B67-24C63ECCF5C8}" = LeapFrog Leapster2 Plugin
"{759601D2-35EC-F152-9F50-83D340AB103F}" = CCC Help Italian
"{778C1AE0-219C-9B6F-CA78-DA141B923863}" = Catalyst Control Center Graphics Full New
"{7E7D778E-121D-4BBD-BA29-FAA81B9FBD8C}" = LeapFrog Connect
"{7F3BCF8A-8E02-4659-AF25-F9AB66BD6718}" = Gateway Recovery Center Installer
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C4AB8A-532A-ED1A-E09A-F4AD42116482}" = Catalyst Control Center Graphics Full Existing
"{84F1DAC1-E1BF-4A21-9D2B-DD3E12686A2C}" = Read in Microsoft Reader Add-in for Microsoft Word
"{878C05F8-97C4-0F5E-0C3F-0E61E4B3D217}" = CCC Help Greek
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A9B0682-04CE-DBF8-BC78-CB22F05D8C66}" = CCC Help French
"{8D273DE5-ABFA-4BD0-A9D7-EE9C971438C4}_is1" = PDF-Viewer
"{911B0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{938DB600-40A0-B699-5B42-DC9D61AB7BB4}" = CCC Help Korean
"{9426CB58-993A-79FF-55F3-98848521EBC5}" = Catalyst Control Center Localization Finnish
"{97AE00A8-1336-410F-B467-1C6623127BD6}" = DesignPro 5.0 Limited Edition
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1.2
"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker
"{A0971531-1B42-06E0-8ECC-8EE08C0459D0}" = CCC Help Norwegian
"{A133AB8B-A1F6-78E8-E328-45A76A0468AE}" = Catalyst Control Center Localization Thai
"{A1B7B9B3-E1D2-41CA-9B4A-F18DC2710704}" = Microsoft Works 6.0
"{A3A60756-C33D-27DB-B02E-76429268C190}" = Catalyst Control Center Localization Greek
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A4E38E54-26D5-90C6-B90B-466F152018A7}" = CCC Help Portuguese
"{A70B3041-50D7-005A-4FF3-36E93F6AB694}" = Catalyst Control Center Core Implementation
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A81100000003}" = Adobe Reader 8.1.1
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{AF6D6F8A-CAA7-8222-14BC-0B22DDFADF1E}" = Catalyst Control Center Localization Chinese Standard
"{B6F7DBE7-2FE2-458F-A738-B10832746036}" = Microsoft Reader
"{BAF474E1-48BA-398A-07BE-ABB3C990E78B}" = Catalyst Control Center Localization Czech
"{BD3DCAB0-3FE5-44FB-90DA-EFB0A2CD1387}" = Works Synchronization
"{BDC83FD3-1A0F-46FB-8852-5E9A94294143}" = Serif PagePlus 8.0 PDF Edition
"{C3A439E4-7303-491F-A678-CEA36A87D517}" = Microsoft Works Suite Add-in for Microsoft Word
"{C553BA7A-425C-2714-4501-6B6CB5A6B827}" = CCC Help Czech
"{CAC37C33-B7E6-46F2-6417-CE35D9A67139}" = Skins
"{CBFF2367-B391-5C21-B52B-AA3865E4EC91}" = Catalyst Control Center Localization Japanese
"{CD97508D-5478-A687-9DBE-7CB9BF9D470B}" = CCC Help Russian
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE4E9BCD-0F71-581D-07B0-E1BF99D0369D}" = CCC Help English
"{CE706D4B-0F0D-E88D-6D3F-511E1F95EF98}" = Catalyst Control Center Graphics Light
"{D1B6D42E-5616-BD1B-5819-EC933F93FBB7}" = CCC Help Polish
"{D4BD3E17-1948-3F83-A0EC-1672C0A7A7F7}" = Catalyst Control Center Localization Norwegian
"{D7670CA7-6936-4578-ADD1-0FE2EE2CCD05}" = RLDS Scripture and Church History Set
"{DC19E750-988B-4005-A355-85EF66055EFE}" = Works Suite OS Pack
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529000}" = WordPerfect Office X4
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529001}" = WordPerfect Office X4 - ICA
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529010}" = WordPerfect Office X4 - Common
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529011}" = WordPerfect Office X4 - WP
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529012}" = WordPerfect Office X4 - QP
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529013}" = WordPerfect Office X4 - PR
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529014}" = WordPerfect Office X4 - Content
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529016}" = WordPerfect Office X4 - Skins
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529017}" = WordPerfect Office X4 - Filters
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529018}" = WordPerfect Office X4 - Graphics
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529023}" = WordPerfect Office X4 - System
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529030}" = WordPerfect Office X4 - Migration Manager
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529040}" = WordPerfect Office X4 - IPM
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529041}" = WordPerfect Office X4 - IPM EN
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529050}" = WordPerfect Office X4 - PerfectExperts
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529100}" = WordPerfect Office X4 - EN
"{DF19E545-6D54-1C97-A2CB-E9999C60AC93}" = CCC Help Dutch
"{E425773B-79C4-598E-E898-A8162D9A262A}" = Catalyst Control Center Localization Dutch
"{EB4000D9-3766-971E-E337-89706683D7D2}" = CCC Help Danish
"{EC481AEA-EEA3-1AD7-76F3-4A97E875CC3E}" = Catalyst Control Center Localization German
"{F691A1F5-2789-46CE-A45A-57763198D384}" = FxVisor
"{F6EE49FD-B736-4888-A05A-115F3B1160FA}" = WordPerfect Lightning - MSOM
"{FF515342-20EE-3F8B-D1FA-DD605BE90FAF}" = Catalyst Control Center Graphics Previews Vista
"1-Click YouTube Downloader_is1" = 1-Click YouTube Downloader 4.0
"7-Zip" = 7-Zip 4.57
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"ATI Uninstaller" = ATI Uninstaller
"avast" = avast! Free Antivirus
"CareBearsDKey" = CareBears
"CCleaner" = CCleaner (remove only)
"CodeStuff Starter" = CodeStuff Starter
"CutePDF Writer Installation" = CutePDF Writer 2.7
"Dell V310-V510 Series" = Dell V310-V510 Series
"EPSON Printer and Utilities" = EPSON Printer Software
"ESET Online Scanner" = ESET Online Scanner v3
"FileZilla Client" = FileZilla Client 3.2.6.1
"FinalVideoDownloader_is1" = Final Video Downloader 2010
"FLV Player2.0.25" = FLV Player
"Gateway Game Console" = Gateway Game Console
"Gear Flash Downloader_is1" = Gear Flash Downloader 1.0
"Google Desktop" = Google Desktop
"GoToAssist" = GoToAssist Corporate
"GPL Ghostscript 8.63" = GPL Ghostscript 8.63
"Icon Restore_is1" = Icon Restore 1.0
"iFinger 2.0" = iFinger 2.0
"InstallShield_{97AE00A8-1336-410F-B467-1C6623127BD6}" = DesignPro 5.0 Limited Edition
"IrfanView" = IrfanView (remove only)
"KeyNote_is1" = KeyNote 1.6.5
"KLiteCodecPack_is1" = K-Lite Codec Pack 3.3.0 Full
"Leapster2Plugin" = Use the entry named LeapFrog Connect to uninstall (LeapFrog Leapster2 Plugin)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.0.1200
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Money2006b" = Microsoft Money 2006
"Mozilla Firefox (3.0.19)" = Mozilla Firefox (3.0.19)
"Mozilla Thunderbird (3.1.4)" = Mozilla Thunderbird (3.1.4)
"PictureItSuiteTrial_v12" = Microsoft Digital Image Starter Edition 2006
"QuicktimeAlt_is1" = QuickTime Alternative 3.2.2
"Rainlendar2" = Rainlendar2 (remove only)
"RAMpage" = RAMpage
"Recuva" = Recuva (remove only)
"RegEditX" = RegEditX
"Revo Uninstaller" = Revo Uninstaller 1.83
"Secunia PSI" = Secunia PSI
"ShadowExplorer_is1" = ShadowExplorer 0.4
"Stickies 6.0c" = Stickies 6.0c
"SumatraPDF" = SumatraPDF
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TaxACT 2008" = TaxACT 2008
"TaxACT 2008 Missouri" = TaxACT 2008 Missouri
"TaxACT 2009" = TaxACT 2009
"TaxACT 2009 Missouri" = TaxACT 2009 Missouri
"TaxACT 2010" = TaxACT 2010
"TaxACT 2010 Missouri" = TaxACT 2010 Missouri
"The Restored Scriptures_is1" = The Restored Scriptures
"UnInstall Icon Restore_is1" = UnInstall Icon Restore 1.0
"UPCShell" = LeapFrog Connect
"VistaFirewallControl (i386)_is1" = VistaFirewallControl 2.0.0.105
"Winamp" = Winamp (remove only)
"Works2002Setup" = Microsoft Works 2002 Setup Launcher

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3777651122-2117734261-3338017706-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f031ef6ac137efc5" = Dell Driver Download Manager

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

broni · 2011/06/09

1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.

Accept any prompts.

====================================================

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings:  "ProxyOverride" = <local>
O37 - HKCU\...com [@ = ComFile] -- Reg Error: Key error. File not found
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found
[2011/05/24 00:55:01 | 000,010,362 | -HS- | M] () -- C:\Users\Timothy\AppData\Local\s3y6i48l744h4x280ce123866cp324d301uytp1006
[2011/05/24 00:55:01 | 000,010,362 | -HS- | M] () -- C:\ProgramData\s3y6i48l744h4x280ce123866cp324d301uytp1006
[2011/05/12 13:43:59 | 000,009,516 | -HS- | M] () -- C:\Users\Timothy\AppData\Local\230t17d8r0p00q1761g3mnq4h8r4n7k5w62
[2011/05/12 13:43:59 | 000,009,516 | -HS- | M] () -- C:\ProgramData\230t17d8r0p00q1761g3mnq4h8r4n7k5w62
[2010/02/05 13:25:19 | 000,002,828 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:DFC5A2B2

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
====================================================

Last scans....

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Tick the box next to YES, I accept the Terms of Use

Click Start

IMPORTANT! UN-check Remove found threats

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, push List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

tvjohns · 2011/06/10

Problem with upgrade Java. I clicked on the link you provided. Page shows check version link, did so says I need newer version. Clicked on download newer version to desktop. Got exe file name jxpiinstall. When I clicked on it got the following error message:
"Installer cannot proceed with current internet connection settings "
Not sure what the cause but could not install Java update. Tried turning off Vista Firewall and Avant anti-virus. Neither helped, still got same cannot proceed message.

Assume you can give me work around (do I for some reason need to remove older Java first, etc?). If not, does no newer Java make a difference in going ahead with other fixes you recommend: OTL Custom scans/fixes; Security Check; ESET Scan?

broni · 2011/06/10

Go here: http://www.java.com/en/download/manual.jsp and download Windows 7, XP Offline installation file.
After downloading it, double click on the file to install Java.

Log in or Sign up

Solved Tim's Vista Laptop can't access Internet

tvjohns Inactive Thread Starter

broni Moderator Malware Analyst

tvjohns Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

tvjohns Inactive Thread Starter

broni Moderator Malware Analyst

tvjohns Inactive Thread Starter

tvjohns Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

tvjohns Inactive Thread Starter

broni Moderator Malware Analyst

tvjohns Inactive Thread Starter

tvjohns Inactive Thread Starter

tvjohns Inactive Thread Starter

tvjohns Inactive Thread Starter

broni Moderator Malware Analyst

tvjohns Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Tim's Vista Laptop can't access Internet

tvjohns Inactive Thread Starter

broni Moderator Malware Analyst

tvjohns Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

tvjohns Inactive Thread Starter

broni Moderator Malware Analyst

tvjohns Inactive Thread Starter

tvjohns Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

tvjohns Inactive Thread Starter

broni Moderator Malware Analyst

tvjohns Inactive Thread Starter

tvjohns Inactive Thread Starter

tvjohns Inactive Thread Starter

tvjohns Inactive Thread Starter

broni Moderator Malware Analyst

tvjohns Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches