Solved SAS is repeatedly finding Broken.FileAssociationh [1 items]

[Resolved] SAS is repeatedly finding Broken.FileAssociationh [1 items]

I should point out that my computer is running quite well actually except that it freezes sometimes if I have more than one Internet page open. The reason for my original post is because SuperAntiSpyware keeps displaying Broken.FileAssociation [items 1] every time I run it. It says it quarantines it but it never goes away, even when I delete it from the quarantine vault.

When I click on the plus sign beside Broken.AssociationFile [1 items] it expands to show the following:. 1- Registry Keys and 2 - HKCR\.exe

I use AVG Internet Security (Purchased version) and it has found no infections.

Here are the scans required where I had originally posted this topic under Windows XP earlier this evening:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6773

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

6/5/2011 12:45:02 AM
mbam-log-2011-06-05 (00-45-02).txt

Scan type: Quick scan
Objects scanned: 235225
Time elapsed: 1 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER 1.0.15.15640 - http://www.gmer.net
Rootkit quick scan 2011-06-04 22:33:48
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD5000AAKS-00A7B2 rev.01.03B01
Running: l85u6dlo.exe; Driver: C:\DOCUME~1\BERTBE~1.BER\LOCALS~1\Temp\kgldqkow.sys


---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs szkgfs.sys (STOPzilla Kernel Guard File System, x86-32 /iS3, Inc.)
AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \FileSystem\Fastfat \Fat szkgfs.sys (STOPzilla Kernel Guard File System, x86-32 /iS3, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

---- EOF - GMER 1.0.15 ----


GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-06-04 23:54:35
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD5000AAKS-00A7B2 rev.01.03B01
Running: l85u6dlo.exe; Driver: C:\DOCUME~1\BERTBE~1.BER\LOCALS~1\Temp\kgldqkow.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xBA3C1738]
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xABC36620]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xBA3C1878]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xBA3C1914]

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB90D1000, 0x29C9F0, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!CreateDialogParamW 7E41EA3B 5 Bytes JMP 02CE4D20 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 02CE4EA0 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9B01 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD125 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB5C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254664 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5117 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E5049 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E50B4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4F1A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4F7C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E517A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!TrackPopupMenu 7E46531E 5 Bytes JMP 02CE44A0 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4FDE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] USER32.dll!TrackPopupMenuEx 7E46CF62 5 Bytes JMP 02CE4600 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 3E2EDBB8 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3E547F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\program files\real\realplayer\update\realsched.exe[1708] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!CreateDialogParamW 7E41EA3B 5 Bytes JMP 02CE4D20 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 02CE4EA0 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9B01 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD125 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB5C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254664 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5117 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E5049 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E50B4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4F1A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4F7C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E517A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!TrackPopupMenu 7E46531E 5 Bytes JMP 02CE44A0 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4FDE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] USER32.dll!TrackPopupMenuEx 7E46CF62 5 Bytes JMP 02CE4600 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 3E2EDBB8 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3E547F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!CreateDialogParamW 7E41EA3B 5 Bytes JMP 02CE4D20 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 02CE4EA0 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9B01 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD125 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB5C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254664 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5117 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E5049 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E50B4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4F1A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4F7C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E517A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!TrackPopupMenu 7E46531E 5 Bytes JMP 02CE44A0 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4FDE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] USER32.dll!TrackPopupMenuEx 7E46CF62 5 Bytes JMP 02CE4600 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 3E2EDBB8 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3E547F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5552] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154BD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5552] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB5C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5552] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5117 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5552] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E5049 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5552] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E50B4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5552] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4F1A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5552] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4F7C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5552] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E517A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5552] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4FDE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[1120] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[1824] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[5516] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs szkgfs.sys (STOPzilla Kernel Guard File System, x86-32 /iS3, Inc.)
AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

Device \FileSystem\Udfs \UdfsCdRom CLBUDF.SYS (UDF File System Driver (Windows2000)/CyberLink Corporation.)
Device \FileSystem\Udfs \UdfsDisk CLBUDF.SYS (UDF File System Driver (Windows2000)/CyberLink Corporation.)

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat szkgfs.sys (STOPzilla Kernel Guard File System, x86-32 /iS3, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

Device \FileSystem\Cdfs \Cdfs CLBUDF.SYS (UDF File System Driver (Windows2000)/CyberLink Corporation.)

---- EOF - GMER 1.0.15 ----


.
DDS (Ver_2011-06-03.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Bert Bell at 0:28:43 on 2011-06-05
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2000 [GMT -4:00]
.
AV: AVG Internet Security 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Enabled*
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\AVG\AVG10\avgfws.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Macrium\Reflect\ReflectService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Fighters\SPAMfighter\sfus.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Fighters\FighterSuiteService.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\AVG\AVG10\avgam.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\Fighters\SPAMfighter\sfagent.exe
C:\program files\real\realplayer\update\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\l85u6dlo.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users.windows\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: STOPzilla Browser Helper Object: {e3215f20-3212-11d6-9f8b-00d0b743919d} - c:\program files\stopzilla!\SZIEBHO.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: {ba14329e-9550-4989-b3f2-9732e92d17cc} - No File
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [sfagent] c:\program files\fighters\spamfighter\sfagent.exe
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
IE: &ieSpell Options - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: Lookup on Merriam Webster - file://c:\program files\iespell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\iespell\wikipedia.HTM
IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{0B18911D-4EB5-4FD6-975C-09B7F4E70A7C} : DhcpNameServer = 192.168.2.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: PCANotify - PCANotify.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
LSA: Notification Packages = scecli scecli
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\bert bell.bert-143294ec7d\application data\mozilla\firefox\profiles\2pnsxzi9.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\all users.windows\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 32592]
R0 CLBStor;InstantBurn Storage Helper Driver;c:\windows\system32\drivers\CLBStor.sys [2011-1-15 10368]
R0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\drivers\pssnap.sys [2011-1-17 16024]
R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [2009-12-7 61328]
R0 szkgfs;szkgfs;c:\windows\system32\drivers\SZKGFS.sys [2010-5-12 59280]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-12-8 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34896]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-11-12 297168]
R1 AW_HOST;AW_HOST;c:\windows\system32\drivers\AW_HOST5.sys [2007-3-30 18232]
R1 awlegacy;awlegacy;c:\windows\system32\drivers\AWLEGACY.sys [2007-3-30 17848]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
R2 avgfws;AVG Firewall;c:\program files\avg\avg10\avgfws.exe [2011-3-9 2708024]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-4-18 7398752]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
R2 CLBUDF;CyberLink UDF Filesystem;c:\windows\system32\drivers\CLBUDF.sys [2011-1-17 182272]
R2 ReflectService;Macrium Reflect Image Mounting Service;c:\program files\macrium\reflect\ReflectService.exe [2011-1-17 220824]
R2 SPAMfighter Update Service;SPAMfighter Update Service;c:\program files\fighters\spamfighter\sfus.exe [2010-11-12 214664]
R2 Suite Service;Suite Service;c:\program files\fighters\FighterSuiteService.exe [2010-11-12 1145992]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [2009-4-6 37376]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2010-7-12 30432]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 27216]
S0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [2009-12-7 61328]
S1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-5-22 136176]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-5-6 947528]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2010-7-12 30432]
S3 awhost32;Symantec pcAnywhere Host Service;c:\program files\symantec\pcanywhere\awhost32.exe [2009-2-10 136568]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-5-22 136176]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
.
=============== Created Last 30 ================
.
2011-06-04 21:56:42 -------- d-----w- c:\program files\ieSpell
2011-06-04 18:01:05 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-06-04 18:01:05 -------- d-----w- c:\windows\system32\wbem\Repository
2011-06-04 18:00:56 -------- d-----w- c:\documents and settings\bert bell.bert-143294ec7d\application data\SUPERAntiSpyware.com
2011-06-04 07:22:59 -------- d-----w- c:\documents and settings\bert bell.bert-143294ec7d\application data\SUPERAntiSpyware(2).com
2011-06-04 07:22:54 -------- d-----w- c:\program files\SUPERAntiSpyware(2)
2011-06-04 05:46:43 -------- d-----w- c:\windows\LMI1F6.tmp
2011-06-01 22:13:01 -------- d-----w- c:\windows\LMI1F.tmp
2011-05-28 06:11:56 11776 -c--a-w- c:\program files\mozilla firefox\plugins\nprjplug.dll
2011-05-28 06:11:42 -------- dc----w- c:\program files\common files\xing shared
2011-05-28 06:11:32 150712 -c--a-w- c:\program files\mozilla firefox\plugins\nppl3260.dll
2011-05-28 06:11:24 105472 -c--a-w- c:\program files\mozilla firefox\plugins\nprpjplug.dll
2011-05-13 06:51:49 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-11 16:01:11 -------- d-----w- c:\program files\CCleaner
2011-05-06 15:52:26 -------- d-----w- c:\documents and settings\all users.windows\application data\AVG Security Toolbar
.
==================== Find3M ====================
.
2011-06-04 05:19:55 17480 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-05-29 13:11:30 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 13:11:20 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-28 06:11:17 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-04-15 01:28:42 134480 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys
2011-04-05 04:59:56 297168 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2011-03-16 20:03:20 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll
.
============= FINISH: 0:29:13.81 ===============


.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-03.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 1/15/2011 4:00:29 AM
System Uptime: 6/4/2011 2:01:39 PM (10 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | P5K
Processor: Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz | LGA775 | 2405/266mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 466 GiB total, 437.797 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 466 GiB total, 400.721 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318}
Description: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
Device ID: ACPI\PNP0303\4&1400782C&0
Manufacturer: (Standard keyboards)
Name: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
PNP Device ID: ACPI\PNP0303\4&1400782C&0
Service: i8042prt
.
==== System Restore Points ===================
.
RP1: 4/8/2011 3:15:27 PM - System Checkpoint
RP2: 4/9/2011 4:11:12 PM - System Checkpoint
RP3: 4/10/2011 4:26:47 PM - System Checkpoint
RP4: 4/11/2011 7:27:03 PM - System Checkpoint
RP5: 4/12/2011 7:32:09 PM - System Checkpoint
RP6: 4/13/2011 10:40:38 AM - Printer Driver Microsoft Office Document Image Writer Installed
RP7: 4/14/2011 12:30:08 AM - Software Distribution Service 3.0
RP8: 4/15/2011 12:46:15 AM - System Checkpoint
RP9: 4/15/2011 10:57:22 AM - Restore Operation
RP10: 4/15/2011 11:21:09 AM - Software Distribution Service 3.0
RP11: 4/16/2011 12:23:43 PM - System Checkpoint
RP12: 4/17/2011 12:24:05 PM - System Checkpoint
RP13: 4/18/2011 12:43:25 PM - System Checkpoint
RP14: 4/19/2011 12:43:50 PM - System Checkpoint
RP15: 4/20/2011 2:03:47 PM - System Checkpoint
RP16: 4/21/2011 2:43:37 PM - System Checkpoint
RP17: 4/22/2011 7:44:56 PM - System Checkpoint
RP18: 4/23/2011 9:05:56 PM - System Checkpoint
RP19: 4/24/2011 9:56:03 PM - System Checkpoint
RP20: 4/25/2011 10:36:07 PM - System Checkpoint
RP21: 4/26/2011 11:04:57 PM - System Checkpoint
RP22: 4/27/2011 12:43:26 PM - Software Distribution Service 3.0
RP23: 4/28/2011 12:43:58 PM - System Checkpoint
RP24: 4/28/2011 6:12:03 PM - Installed Microsoft Office FrontPage 2003
RP25: 4/28/2011 6:16:06 PM - Installed Microsoft Office Visio Professional 2003
RP26: 4/28/2011 6:20:55 PM - Installed Microsoft Office Project Professional 2003
RP27: 4/28/2011 6:23:07 PM - Installed Microsoft Office OneNote 2003
RP28: 4/29/2011 6:29:05 PM - System Checkpoint
RP29: 4/30/2011 7:41:51 PM - System Checkpoint
RP30: 5/1/2011 8:34:56 PM - System Checkpoint
RP31: 5/2/2011 9:16:09 PM - System Checkpoint
RP32: 5/3/2011 9:34:22 PM - System Checkpoint
RP33: 5/4/2011 9:40:25 PM - System Checkpoint
RP34: 5/5/2011 9:46:05 PM - System Checkpoint
RP35: 5/6/2011 11:51:23 AM - Installed AVG 2011
RP36: 5/6/2011 11:53:04 AM - Removed AVG 2011
RP37: 5/7/2011 12:32:08 PM - System Checkpoint
RP38: 5/8/2011 12:59:13 PM - System Checkpoint
RP39: 5/9/2011 1:15:58 PM - System Checkpoint
RP40: 5/10/2011 2:17:28 PM - System Checkpoint
RP41: 5/11/2011 11:58:42 AM - Revo Uninstaller's restore point - CCleaner
RP42: 5/11/2011 1:34:18 PM - Software Distribution Service 3.0
RP43: 5/12/2011 2:29:00 AM - Removed WinZip 15.0
RP44: 5/12/2011 2:29:08 AM - Installed WinZip 15.5
RP45: 5/13/2011 2:40:47 AM - System Checkpoint
RP46: 5/14/2011 4:25:09 AM - System Checkpoint
RP47: 5/15/2011 5:01:19 AM - System Checkpoint
RP48: 5/16/2011 9:21:17 AM - System Checkpoint
RP49: 5/17/2011 1:16:51 AM - Revo Uninstaller's restore point - Vuze Remote Toolbar
RP50: 5/18/2011 6:10:59 AM - System Checkpoint
RP51: 5/19/2011 7:37:34 AM - System Checkpoint
RP52: 5/20/2011 8:14:14 AM - System Checkpoint
RP53: 5/21/2011 8:49:39 AM - System Checkpoint
RP54: 5/22/2011 9:28:00 AM - System Checkpoint
RP55: 5/23/2011 10:02:29 AM - System Checkpoint
RP56: 5/24/2011 10:28:57 AM - System Checkpoint
RP57: 5/25/2011 10:30:00 AM - System Checkpoint
RP58: 5/26/2011 11:33:39 AM - System Checkpoint
RP59: 5/27/2011 12:28:30 PM - System Checkpoint
RP60: 5/28/2011 1:10:55 PM - System Checkpoint
RP61: 5/29/2011 2:39:26 PM - System Checkpoint
RP62: 5/29/2011 8:43:20 PM - Printer Driver Microsoft Office Document Image Writer Installed
RP63: 5/30/2011 9:12:17 PM - System Checkpoint
RP64: 5/31/2011 10:14:55 PM - System Checkpoint
RP65: 6/1/2011 10:22:12 PM - System Checkpoint
RP66: 6/2/2011 10:25:25 PM - System Checkpoint
RP67: 6/3/2011 11:17:20 PM - System Checkpoint
RP68: 6/4/2011 3:20:28 AM - Revo Uninstaller's restore point - SUPERAntiSpyware
RP69: 6/4/2011 1:58:20 PM - Restore Operation
.
==== Installed Programs ======================
.
3D Live Snooker
Adobe Acrobat X Pro - English, Français, Deutsch
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Stock Photos 1.0
Advanced Grammar in Use
Apple Application Support
Apple Software Update
ATI - Software Uninstall Utility
ATI AVIVO Codecs
ATI Catalyst Control Center
ATI Parental Control & Encoder
Attansic Ethernet Utility
Attansic L1 Gigabit Ethernet Driver
AVG 2011
Canon Camera Access Library
Canon DIGITAL CAMERA Solution Disk Software Guide
Canon MOV Decoder
Canon MOV Encoder
Canon MovieEdit Task for ZoomBrowser EX
Canon Personal Printing Guide
Canon Utilities CameraWindow
Canon Utilities CameraWindow DC
Canon Utilities CameraWindow DC 8
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
Canon Utilities Digital Photo Professional 3.7
Canon Utilities MyCamera
Canon Utilities MyCamera DC
Canon Utilities PhotoStitch
Canon Utilities RemoteCapture Task for ZoomBrowser EX
Canon Utilities ZoomBrowser EX
Canon ZoomBrowser EX Memory Card Utility
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Localization All
ccc-core-preinstall
ccc-core-static
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Italian
CCC Help Japanese
CCC Help Norwegian
CCC Help Spanish
CCC Help Swedish
CCleaner
Compatibility Pack for the 2007 Office system
Conduit Engine
CyberLink InstantBurn
Diskeeper Professional Edition
DVD Suite
EPSON Printer Software
Google Earth
Google Update Helper
Grammar Express
Hitman Pro 3.5
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB954550-v5)
ieSpell
Java Auto Updater
Java(TM) 6 Update 23
JMB36X Raid Configurer
LabelPrint 2.0
LiveUpdate 3.3 (Symantec Corporation)
Macrium Reflect - Free Edition
Malwarebytes' Anti-Malware version 1.51.0.1200
MediaShow 3.0
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Office FrontPage 2003
Microsoft Office OneNote 2003
Microsoft Office Professional Edition 2003
Microsoft Office Project Professional 2003
Microsoft Office Visio Professional 2003
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox 4.0 (x86 en-US)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
neroxml
PhotoNow! 1.0
Power2Go 5.0
PowerBackup 2.5
PowerDirector Express
PowerDVD
PowerDVD Copy 1.0
PowerProducer
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.1
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Skins
Sony Sound Forge 8.0
SPAMfighter
SPAMfighter Client
Spybot - Search & Destroy
STOPzilla
SUPERAntiSpyware
Symantec pcAnywhere
Unknown File Assistant
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB971029)
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
WinRAR archiver
WinZip 15.5
.
==== Event Viewer Messages From Past Week ========
.
6/4/2011 2:12:17 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx86 Avgmfx86 awlegacy AW_HOST Fips i8042prt intelppm ohci1394 SASDIFSV SASKUTIL
6/4/2011 2:06:23 PM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.
6/4/2011 2:04:16 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
6/4/2011 2:04:11 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Avgldx86 Avgmfx86 Avgtdix awlegacy AW_HOST Fips i8042prt intelppm IPSec MRxSmb NetBIOS NetBT ohci1394 RasAcd Rdbss SASDIFSV SASKUTIL Tcpip
6/4/2011 2:04:11 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
6/4/2011 2:04:11 AM, error: Service Control Manager [7001] - The LogMeIn Rescue (9bad6174-1468-4c66-bf03-856e6a792406) service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/4/2011 2:04:11 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/4/2011 2:04:11 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/4/2011 2:04:11 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
6/4/2011 2:04:09 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
6/4/2011 1:57:22 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx86 Avgmfx86 awlegacy AW_HOST Fips i8042prt intelppm ohci1394
5/31/2011 3:32:05 AM, error: Service Control Manager [7034] - The STOPzilla Service service terminated unexpectedly. It has done this 1 time(s).
.
==== End Of File ===========================

 

Thank you. Here is the MBRCheck log. Do I need to disconnect from the Internet and disable my AVG Security befor running the Rootkit Unhooker?

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001d

Kernel Drivers (total 145):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E5000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xBA0A8000 szkg.sys
0xBA0B8000 szkgfs.sys
0xB9F79000 ACPI.sys
0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB9F68000 pci.sys
0xBA0D8000 isapnp.sys
0xBA0E8000 ohci1394.sys
0xBA0F8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xBA670000 pciide.sys
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xBA108000 MountMgr.sys
0xB9F49000 ftdisk.sys
0xBA5AC000 dmload.sys
0xB9F23000 dmio.sys
0xBA330000 PartMgr.sys
0xBA118000 VolSnap.sys
0xB9F0B000 atapi.sys
0xBA128000 jraid.sys
0xB9EF3000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
0xBA138000 disk.sys
0xBA148000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9ED3000 fltMgr.sys
0xB9EC1000 sr.sys
0xBA4BC000 CLBStor.sys
0xB9EAA000 KSecDD.sys
0xB9E1D000 Ntfs.sys
0xB9DF0000 NDIS.sys
0xBA4C0000 Gernuwa.sys
0xBA338000 pssnap.sys
0xB9DD6000 Mup.sys
0xBA5AE000 JGOGO.sys
0xBA340000 avgrkx86.sys
0xBA4C4000 AVGIDSEH.Sys
0xBA2C8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xB8EA6000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
0xB8E92000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xBA580000 \SystemRoot\system32\drivers\aw_host5.sys
0xB8E6A000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xBA428000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB8E46000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA430000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xBA2E8000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xBA438000 \SystemRoot\system32\DRIVERS\fdc.sys
0xBA5C8000 \SystemRoot\system32\DRIVERS\ASACPI.sys
0xBA2F8000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA584000 \SystemRoot\system32\DRIVERS\serenum.sys
0xBA440000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xBA318000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA0C8000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xBA198000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB8E23000 \SystemRoot\system32\DRIVERS\ks.sys
0xBA448000 \SystemRoot\system32\DRIVERS\avgfwdx.sys
0xBA697000 \SystemRoot\system32\DRIVERS\audstub.sys
0xB95A4000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA590000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB8E0C000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xB9594000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xB9584000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBA450000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB8DFB000 \SystemRoot\system32\DRIVERS\psched.sys
0xB9574000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xBA458000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xBA460000 \SystemRoot\system32\DRIVERS\raspti.sys
0xB8DCB000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xB9564000 \SystemRoot\system32\DRIVERS\termdd.sys
0xBA468000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA5CA000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB8D45000 \SystemRoot\system32\DRIVERS\update.sys
0xB9DB2000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xB9554000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xACD08000 \SystemRoot\system32\drivers\AtiHdmi.sys
0xACCE4000 \SystemRoot\system32\drivers\portcls.sys
0xB9524000 \SystemRoot\system32\drivers\drmk.sys
0xB9514000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA5CE000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xAC188000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xBA398000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xBA278000 \SystemRoot\system32\DRIVERS\avgmfx86.sys
0xBA5F6000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBA7CD000 \SystemRoot\System32\Drivers\Null.SYS
0xBA5F8000 \SystemRoot\System32\Drivers\Beep.SYS
0xBA288000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xBA3B0000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xBA3B8000 \SystemRoot\System32\drivers\vga.sys
0xBA5FA000 \SystemRoot\system32\drivers\awechomd.sys
0xACBE2000 \SystemRoot\System32\Drivers\awlegacy.sys
0xBA5FC000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA5FE000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xBA3C0000 \SystemRoot\System32\Drivers\Msfs.SYS
0xBA3C8000 \SystemRoot\System32\Drivers\Npfs.SYS
0xB9D86000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xAAE2E000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xAADD5000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xAAD8E000 \SystemRoot\system32\DRIVERS\avgtdix.sys
0xBA298000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xBA2A8000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xAAD66000 \SystemRoot\system32\DRIVERS\netbt.sys
0xAAD44000 \SystemRoot\System32\drivers\afd.sys
0xBA2B8000 \SystemRoot\system32\DRIVERS\netbios.sys
0xAAD22000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
0xBA3D8000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0xAACF7000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xAAC87000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA308000 \SystemRoot\System32\Drivers\Fips.SYS
0xAAC4B000 \SystemRoot\system32\DRIVERS\avgldx86.sys
0xABEE3000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xACCD4000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xBA3F0000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xBA408000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xBA57C000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xACC94000 \SystemRoot\system32\drivers\usbaudio.sys
0xAAE71000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xACC74000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xAAAF3000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xBA61E000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xAAC0B000 \SystemRoot\System32\drivers\Dxapi.sys
0xBA418000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xBA772000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\ati2dvag.dll
0xBF060000 \SystemRoot\System32\ati2cqag.dll
0xBF12F000 \SystemRoot\System32\atikvmag.dll
0xBF1DE000 \SystemRoot\System32\atiok3x2.dll
0xBF259000 \SystemRoot\System32\ati3duag.dll
0xBF9C6000 \SystemRoot\System32\ativvaxx.dll
0xBF631000 \SystemRoot\System32\ATMFD.DLL
0xA7F25000 \SystemRoot\System32\Drivers\CLBUDF.SYS
0xA7EEC000 \SystemRoot\System32\Drivers\Udfs.SYS
0xA7F6A000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA7BB7000 \SystemRoot\system32\drivers\wdmaud.sys
0xA7FBA000 \SystemRoot\system32\drivers\sysaudio.sys
0xA7864000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xBA4B0000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
0xA76CC000 \SystemRoot\system32\DRIVERS\srv.sys
0xA7400000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xAAA8A000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
0xA7368000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
0xA6B1B000 \SystemRoot\System32\Drivers\HTTP.sys
0xA650D000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 45):
0 System Idle Process
4 System
932 C:\WINDOWS\system32\smss.exe
984 C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
1168 csrss.exe
1224 C:\WINDOWS\system32\winlogon.exe
1272 C:\WINDOWS\system32\services.exe
1284 C:\WINDOWS\system32\lsass.exe
1464 C:\WINDOWS\system32\ati2evxx.exe
1484 C:\WINDOWS\system32\svchost.exe
1580 svchost.exe
1704 C:\WINDOWS\system32\svchost.exe
1860 svchost.exe
1904 svchost.exe
128 C:\WINDOWS\system32\spoolsv.exe
284 C:\WINDOWS\system32\ati2evxx.exe
1352 C:\Program Files\Google\Update\GoogleUpdate.exe
1556 C:\WINDOWS\explorer.exe
324 C:\Program Files\AVG\AVG10\avgtray.exe
160 C:\Program Files\Fighters\SPAMfighter\sfagent.exe
472 C:\Program Files\Real\RealPlayer\Update\realsched.exe
492 C:\WINDOWS\system32\ctfmon.exe
500 C:\Program Files\Messenger\msmsgs.exe
640 svchost.exe
724 C:\Program Files\AVG\AVG10\avgfws.exe
780 C:\Program Files\AVG\AVG10\avgwdsvc.exe
808 C:\Program Files\Executive Software\Diskeeper\DkService.exe
1636 C:\Program Files\Java\jre6\bin\jqs.exe
2076 C:\Program Files\Macrium\Reflect\ReflectService.exe
2616 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
2680 C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2760 C:\Program Files\Fighters\SPAMfighter\sfus.exe
2844 C:\WINDOWS\system32\svchost.exe
2860 C:\Program Files\Fighters\FighterSuiteService.exe
3068 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
3264 C:\Program Files\Canon\CAL\CALMAIN.exe
3284 C:\Program Files\AVG\AVG10\avgam.exe
3476 C:\Program Files\AVG\AVG10\avgnsx.exe
4076 C:\Program Files\AVG\AVG10\avgemcx.exe
1432 C:\Program Files\AVG\AVG10\avgcsrvx.exe
584 C:\PROGRA~1\AVG\AVG10\avgrsx.exe
2068 C:\Program Files\AVG\AVG10\avgcsrvx.exe
5312 C:\Program Files\Internet Explorer\iexplore.exe
5280 C:\Program Files\Internet Explorer\iexplore.exe
4352 E:\My Documents\BBS files\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\E: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: WDCWD5000AAKS-00A7B2, Rev: 01.03B01
PhysicalDrive1 Model Number: ST3500418AS, Rev: CC37

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
465 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

 

RkU Version: 3.8.389.593, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #4
==============================================
>Drivers
==============================================
0xB8EA6000 C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 6742016 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Miniport Driver)
0xAC188000 C:\WINDOWS\system32\drivers\RtkHDAud.sys 4538368 bytes (Realtek Semiconductor Corp., Realtek(r) High Definition Audio Function Driver)
0xBF259000 C:\WINDOWS\System32\ati3duag.dll 4030464 bytes (ATI Technologies Inc. , ati3duag.dll)
0xBF9C6000 C:\WINDOWS\System32\ativvaxx.dll 2674688 bytes (Advanced Micro Devices, Inc. , Radeon Video Acceleration Universal Driver)
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2154496 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2154496 bytes
0x804D7000 RAW 2154496 bytes
0x804D7000 WMIxWDM 2154496 bytes
0xBF800000 Win32k 1859584 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xBF060000 C:\WINDOWS\System32\ati2cqag.dll 847872 bytes (ATI Technologies Inc., Central Memory Manager / Queue Server Module)
0xBF12F000 C:\WINDOWS\System32\atikvmag.dll 716800 bytes (ATI Technologies Inc., Virtual Command And Memory Manager)
0xB9E1D000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xBF1DE000 C:\WINDOWS\System32\atiok3x2.dll 503808 bytes (Advanced Micro Devices, Inc., Ring 0 x2 component)
0xAAC87000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xB8D45000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xAADD5000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xA76CC000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xBF012000 C:\WINDOWS\System32\ati2dvag.dll 319488 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Display Driver)
0xBF631000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xAAD8E000 C:\WINDOWS\system32\DRIVERS\avgtdix.sys 290816 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher)
0xA6B1B000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xAAC4B000 C:\WINDOWS\system32\DRIVERS\avgldx86.sys 245760 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver)
0xB8DCB000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
0xB9F79000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xA7F25000 C:\WINDOWS\System32\Drivers\CLBUDF.SYS 184320 bytes (CyberLink Corporation., UDF File System Driver (Windows2000))
0xA7864000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xB9DF0000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xA64A2000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xAACF7000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xB8E6A000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows (R) Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
0xAAD66000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xB9F23000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)
0xA7400000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xACCE4000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xB8E46000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xB8E23000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xAAD44000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xAAD22000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS)
0x806E5000 ACPI_HAL 134400 bytes
0x806E5000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xA7368000 C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys 131072 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Driver.)
0xB9ED3000 fltMgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xB9F49000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xACD08000 C:\WINDOWS\system32\drivers\AtiHdmi.sys 110592 bytes (ATI Research Inc., Ati High Definition Audio Function Driver)
0xB9DD6000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xB9F0B000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xAAAF3000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xB9EF3000 C:\WINDOWS\system32\DRIVERS\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)
0xB9EAA000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xB8E0C000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xA7BB7000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xB8E92000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xAAE2E000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xB9EC1000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xB9F68000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xB8DFB000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xA7EEC000 C:\WINDOWS\System32\Drivers\Udfs.SYS 69632 bytes (Microsoft Corporation, UDF File System Driver)
0xACC74000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xBA0C8000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xBA2E8000 C:\WINDOWS\system32\DRIVERS\nic1394.sys 65536 bytes (Microsoft Corporation, IEEE1394 Ndis Miniport and Call Manager)
0xBA0E8000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)
0xBA2F8000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xBA2A8000 C:\WINDOWS\system32\DRIVERS\arp1394.sys 61440 bytes (Microsoft Corporation, IP/1394 Arp Client)
0xB9524000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xBA198000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xA7FBA000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xACC94000 C:\WINDOWS\system32\drivers\usbaudio.sys 61440 bytes (Microsoft Corporation, USB Audio Class Driver)
0xB9514000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xBA0F8000 C:\WINDOWS\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)
0xA7D54000 C:\WINDOWS\system32\DRIVERS\l151x86.sys 57344 bytes (Atheros Communications, Inc., Atheros L1 Gigabit Ethernet Controller ndis miniport driver)
0xBA0A8000 szkg.sys 57344 bytes (iS3 Inc., szkg Device Driver)
0xBA148000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xBA288000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xB95A4000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xBA0B8000 szkgfs.sys 53248 bytes (iS3, Inc., STOPzilla Kernel Guard File System, x86-32 )
0xBA118000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xBA278000 C:\WINDOWS\system32\DRIVERS\avgmfx86.sys 49152 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver)
0xBA128000 jraid.sys 49152 bytes (JMicron Technology Corp., JMicron JMB36X RAID Driver)
0xB9584000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xBA308000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xBA318000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xBA108000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xB9594000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xBA0D8000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xB9554000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xB9564000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xA6720000 C:\WINDOWS\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
0xBA138000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xACCD4000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xBA2C8000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xB9574000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xBA2B8000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xBA298000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xBA3C8000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xBA408000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0xBA430000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xBA448000 C:\WINDOWS\system32\DRIVERS\avgfwdx.sys 28672 bytes (AVG Technologies CZ, s.r.o., AVG Firewall intermediate miniport driver)
0xBA340000 avgrkx86.sys 28672 bytes (AVG Technologies CZ, s.r.o., AVG Anti-Rootkit Driver)
0xBA438000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xBA3B0000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xBA328000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xBA338000 pssnap.sys 28672 bytes (Macrium Software, Backup image protection)
0xBA3F0000 C:\WINDOWS\system32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver)
0xBA440000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xBA468000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xBA3D8000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS)
0xBA428000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xBA3B8000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xAAA8A000 C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys 20480 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Filter Driver.)
0xBA4B0000 C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys 20480 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Loader Driver.)
0xBA398000 C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
0xBA3C0000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xBA330000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xBA458000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xBA460000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
0xBA450000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xBA418000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xBA4C4000 AVGIDSEH.Sys 16384 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Helper Driver.)
0xBA4C0000 Gernuwa.sys 16384 bytes (Symantec Corporation, pcAnywhere AWUNREG Driver)
0xAAE71000 C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xB9DB2000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xA7F6A000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xBA584000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xACBE2000 C:\WINDOWS\System32\Drivers\awlegacy.sys 12288 bytes (Symantec Corporation, pcAnywhere Legacy Driver Module)
0xBA580000 C:\WINDOWS\system32\drivers\aw_host5.sys 12288 bytes (Symantec Corporation, pcAnywhere Host Driver for Windows 2000/XP)
0xBA4B8000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xBA4BC000 CLBStor.sys 12288 bytes (Cyberlink Co.,Ltd., Cyberlink Storage Helper Driver (WindowsNT5.x))
0xAAC0B000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xABEE3000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xBA57C000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xBA590000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xB9D86000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xBA5C8000 C:\WINDOWS\system32\DRIVERS\ASACPI.sys 8192 bytes (-, ATK0110 ACPI Utility)
0xBA5FA000 C:\WINDOWS\system32\drivers\awechomd.sys 8192 bytes (Symantec Corporation, pcAnywhere Video Miniport Driver)
0xBA5F8000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xBA5AC000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
0xBA61E000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xBA5F6000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xBA5AE000 JGOGO.sys 8192 bytes (JMicron , SCSI Port upper filter driver)
0xBA5A8000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xBA5FC000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xBA5FE000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xBA5CA000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xBA5CE000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xBA5AA000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xBA697000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xBA772000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xBA7CD000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xBA670000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
==============================================
>Stealth
==============================================

 

After running Combofix I reinstalled my AVG Security 2011. Should I uninstall it again before proceeding with rKill?

 

I uninstalled AVG before running rKIll. These are to two logs you requested:

Can I reinstall AVG now?

ComboFix 11-06-05.02 - Bert Bell 06/05/2011 14:56:46.1.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2483 [GMT -4:00]
Running from: c:\documents and settings\Bert Bell.BERT-143294EC7D\Desktop\ComboFix.exe
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\1.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\a.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\b.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\c.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\d.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\e.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\f.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\g.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\h.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\i.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\J.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\k.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\l.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\m.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\n.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\o.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\p.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\q.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\r.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\s.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\t.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\u.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\v.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\w.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\x.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\y.xml
c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\PriceGong\Data\z.xml
E:\install.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-05-05 to 2011-06-05 )))))))))))))))))))))))))))))))
.
.
2011-06-05 18:52 . 2011-06-05 18:52 -------- d-----w- c:\windows\LastGood
2011-06-04 21:56 . 2011-06-04 21:56 -------- d-----w- c:\program files\ieSpell
2011-06-04 18:01 . 2011-06-04 18:01 -------- d-----w- c:\windows\system32\wbem\Repository
2011-06-04 18:00 . 2011-06-04 18:00 -------- d-----w- c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\SUPERAntiSpyware.com
2011-06-04 07:22 . 2011-06-04 18:00 -------- d-----w- c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\SUPERAntiSpyware(2).com
2011-06-04 07:22 . 2011-06-04 18:00 -------- d-----w- c:\program files\SUPERAntiSpyware(2)
2011-06-04 05:46 . 2011-06-04 18:02 -------- d-----w- c:\windows\LMI1F6.tmp
2011-06-01 22:13 . 2011-06-03 15:13 -------- d-----w- c:\windows\LMI1F.tmp
2011-05-28 06:11 . 2011-05-28 06:11 11776 -c--a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll
2011-05-28 06:11 . 2011-05-28 06:11 -------- dc----w- c:\program files\Common Files\xing shared
2011-05-28 06:11 . 2011-05-28 06:11 150712 -c--a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll
2011-05-28 06:11 . 2011-05-28 06:11 105472 -c--a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll
2011-05-18 04:21 . 2011-05-18 04:21 -------- d-----w- c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\Canon
2011-05-13 06:51 . 2011-05-13 06:51 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-11 16:01 . 2011-05-11 16:01 -------- d-----w- c:\program files\CCleaner
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-29 13:11 . 2011-01-14 22:56 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 13:11 . 2011-01-14 22:56 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-28 06:11 . 2003-10-17 21:44 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-03-18 17:53 . 2011-04-23 03:50 142296 -c--a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-12-09 17:21 3911776 -c--a-w- c:\program files\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{30F9B915-B755-4826-820B-08FBA6BD249D} "= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sfagent "= "c:\program files\Fighters\SPAMfighter\sfagent.exe" [2010-11-12 821384]
"TkBellExe "= "c:\program files\real\realplayer\update\realsched.exe" [2011-05-28 273544]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2010-12-25 421888]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL "= "start http:" [X]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 -c--a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]
2007-04-27 16:40 18744 ----a-w- c:\windows\system32\PCANotify.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk
backup=c:\windows\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Bert Bell.BERT-143294EC7D^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Bert Bell.BERT-143294EC7D\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\36X Raid Configurer]
2007-03-21 16:23 1953792 ------r- c:\windows\system32\xRaidSetup.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2011-01-30 15:45 821144 ----a-w- c:\program files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]
2011-01-30 15:45 36760 ----a-w- c:\program files\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-10-25 19:43 932288 -c--a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 18:43 69632 ------r- c:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
2008-05-19 13:24 91432 -c----r- c:\program files\CyberLink\Shared Files\brs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]
2004-10-04 23:53 176216 -c--a-w- c:\program files\Executive Software\Diskeeper\DkIcon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantBurn]
2006-09-01 00:21 733184 -c--a-w- c:\progra~1\CYBERL~1\INSTAN~1\Win2K\IBurn.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup]
2007-03-20 14:36 36864 ------r- c:\windows\RaidTool\xInsIDE.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 12:42 1695232 ------w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power2GoExpress]
2006-09-13 23:00 2441216 -c----w- c:\program files\CyberLink\Power2Go\Power2GoExpress.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-12-25 00:51 421888 -c--a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-03 04:24 32768 -c--a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-03-21 14:49 16126464 ------r- c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sfagent]
2010-11-12 09:31 821384 -c--a-w- c:\program files\Fighters\SPAMfighter\sfagent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 19:44 248552 -c--a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-05-24 05:58 2424192 -c--a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-05-28 06:11 273544 -c--a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride "=dword:00000001
"FirewallOverride "=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
"DisableNotifications "= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
.
R0 CLBStor;InstantBurn Storage Helper Driver;c:\windows\system32\drivers\CLBStor.sys [1/15/2011 10:28 PM 10368]
R0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\drivers\pssnap.sys [1/17/2011 8:32 PM 16024]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
R2 CLBUDF;CyberLink UDF Filesystem;c:\windows\system32\drivers\CLBUDF.sys [1/17/2011 5:40 AM 182272]
R2 ReflectService;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [1/17/2011 8:32 PM 220824]
R2 SPAMfighter Update Service;SPAMfighter Update Service;c:\program files\Fighters\SPAMfighter\sfus.exe [11/12/2010 5:31 AM 214664]
R2 Suite Service;Suite Service;c:\program files\Fighters\FighterSuiteService.exe [11/12/2010 5:31 AM 1145992]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [4/6/2009 10:40 AM 37376]
R4 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [7/12/2010 8:33 AM 30432]
R4 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys --> c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [?]
R4 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys --> c:\windows\system32\DRIVERS\AVGIDSEH.Sys [?]
R4 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys --> c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [?]
R4 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys --> c:\windows\system32\DRIVERS\AVGIDSShim.Sys [?]
R4 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys --> c:\windows\system32\DRIVERS\avgrkx86.sys [?]
R4 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys --> c:\windows\system32\DRIVERS\avgtdix.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/22/2010 9:08 AM 136176]
S3 BlackBox;BlackBox SR2; [x]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [5/22/2010 9:08 AM 136176]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - Avgldx86
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-22 13:08]
.
2011-06-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-22 13:08]
.
2011-06-05 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1343024091-115176313-682003330-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
2011-06-05 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1343024091-115176313-682003330-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\documents and settings\Bert Bell.BERT-143294EC7D\Application Data\Mozilla\Firefox\Profiles\2pnsxzi9.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
URLSearchHooks-{ba14329e-9550-4989-b3f2-9732e92d17cc} - (no file)
Toolbar-Locked - (no file)
Toolbar-{ba14329e-9550-4989-b3f2-9732e92d17cc} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
MSConfigStartUp-HitmanPro35 - c:\program files\Hitman Pro 3.5\HitmanPro35.exe
MSConfigStartUp-InCD - c:\program files\Nero\Nero 7\InCD\InCD.exe
MSConfigStartUp-LanguageShortcut - c:\program files\CyberLink\PowerDVD\Language\Language.exe
MSConfigStartUp-LGODDFU - c:\program files\lg_fwupdate\fwupdate.exe
MSConfigStartUp-NeroFilterCheck - c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
MSConfigStartUp-SecurDisc - c:\program files\Nero\Nero 7\InCD\NBHGui.exe
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-05 14:59
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"Licence0 "= "04F0D21-79D8-7A25-D702-433F "
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1224)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\PCANotify.dll
.
Completion time: 2011-06-05 15:00:41
ComboFix-quarantined-files.txt 2011-06-05 19:00
.
Pre-Run: 470,601,703,424 bytes free
Post-Run: 470,678,061,056 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 8BD7F92C7544AAEA2B6E58CE4DF82882

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 06/05/2011 at 15:47:45.
Operating System: Microsoft Windows XP


Processes terminated by Rkill or while it was running:


Rkill completed on 06/05/2011 at 15:47:48.

 

SAS is repeatedly finding Broken.FileAssociationh [1 items]

Can I reinstall my AVG? I'm nervous about being connected to the Internet with only the protection of Windows Firewall.

As you'll see rKill didn't find any malware, or so it seems to me. I didn't understand what you meant by-

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

 

Here is another rKill scan. I tried to run it in Safe Mode and put the rKill rogram in my Start Menu. When I got into Safe Mode it was no longer there, so I did it again, this time saving the rkill program in a folder in My Documents called New Poems. I mention this because it will explain on of the two things rKill found in the newest scan.

I don't know what the second thing it found in E Drive is. Here is the new scan:

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 06/05/2011 at 16:27:45.
Operating System: Microsoft Windows XP


Processes terminated by Rkill or while it was running:

E:\My Documents\_New Poems\rkill.scr
C:\WINDOWS\system32\verclsid.exe


Rkill completed on 06/05/2011 at 16:27:47.

 

My computer seems to be running quite well at the moment. It's not freezing now.
Here is the first OTL scan. Second to follow. They were tt large together:

OTL logfile created on: 6/5/2011 4:51:08 PM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.58 Gb Available Physical Memory | 85.92% Memory free
7.34 Gb Paging File | 7.11 Gb Available in Paging File | 96.91% Paging File free
Paging file location(s): C:\pagefile.sys 4606 9000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 438.11 Gb Free Space | 94.07% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 406.18 Gb Free Space | 87.21% Space Free | Partition Type: NTFS

Computer Name: BERT-143294EC7D | User Name: Bert Bell | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/05 16:47:36 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\OTL.exe
PRC - [2011/05/28 02:11:18 | 000,273,544 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2011/01/17 20:32:06 | 000,220,824 | ---- | M] () -- C:\Program Files\Macrium\Reflect\ReflectService.exe
PRC - [2010/11/12 05:31:52 | 001,145,992 | ---- | M] (SPAMfighter ApS) -- C:\Program Files\Fighters\FighterSuiteService.exe
PRC - [2010/11/12 05:31:30 | 000,214,664 | ---- | M] (SPAMfighter ApS) -- C:\Program Files\Fighters\SPAMfighter\sfus.exe
PRC - [2010/11/12 05:31:25 | 000,821,384 | ---- | M] (SPAMfighter ApS) -- C:\Program Files\Fighters\SPAMfighter\sfagent.exe
PRC - [2008/04/14 08:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/01/31 18:55:42 | 000,096,370 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2004/10/05 19:48:40 | 000,577,644 | ---- | M] (Executive Software International, Inc.) -- C:\Program Files\Executive Software\Diskeeper\DkService.exe


========== Modules (SafeList) ==========

MOD - [2011/06/05 16:47:36 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\OTL.exe
MOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (NMIndexingService)
SRV - [2011/02/25 19:02:48 | 000,062,928 | R--- | M] (iS3, Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe -- (szserver)
SRV - [2011/01/17 20:32:06 | 000,220,824 | ---- | M] () [Auto | Running] -- C:\Program Files\Macrium\Reflect\ReflectService.exe -- (ReflectService)
SRV - [2010/11/12 05:31:52 | 001,145,992 | ---- | M] (SPAMfighter ApS) [Auto | Running] -- C:\Program Files\Fighters\FighterSuiteService.exe -- (Suite Service)
SRV - [2010/11/12 05:31:30 | 000,214,664 | ---- | M] (SPAMfighter ApS) [Auto | Running] -- C:\Program Files\Fighters\SPAMfighter\sfus.exe -- (SPAMfighter Update Service)
SRV - [2009/02/10 12:40:00 | 000,136,568 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\pcAnywhere\awhost32.exe -- (awhost32)
SRV - [2008/06/30 17:06:35 | 003,093,872 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)
SRV - [2007/01/31 18:55:42 | 000,096,370 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2004/10/05 19:48:40 | 000,577,644 | ---- | M] (Executive Software International, Inc.) [Auto | Running] -- C:\Program Files\Executive Software\Diskeeper\DkService.exe -- (Diskeeper)


========== Driver Services (SafeList) ==========

DRV - [2011/01/26 23:34:32 | 006,406,656 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2011/01/17 20:32:36 | 000,016,024 | ---- | M] (Macrium Software) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\pssnap.sys -- (pssnap)
DRV - [2010/05/10 14:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/02/17 14:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/04/06 10:40:10 | 000,037,376 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\l151x86.sys -- (AtcL001)
DRV - [2009/02/25 19:40:10 | 000,099,856 | R--- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2009/01/31 00:33:32 | 000,542,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\blackbox.dll -- (BlackBox)
DRV - [2007/03/30 21:18:02 | 000,018,232 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AW_HOST5.sys -- (AW_HOST)
DRV - [2007/03/30 21:17:22 | 000,017,848 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\awlegacy.sys -- (awlegacy)
DRV - [2007/03/30 21:16:50 | 000,013,368 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\awechomd.sys -- (awecho)
DRV - [2007/03/30 21:14:22 | 000,020,536 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\GERNUWA.sys -- (Gernuwa)
DRV - [2007/03/26 15:21:06 | 004,395,008 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/03/24 07:20:24 | 000,046,208 | R--- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\jraid.sys -- (JRAID)
DRV - [2006/08/31 20:03:10 | 000,182,272 | ---- | M] (CyberLink Corporation.) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\CLBUDF.sys -- (CLBUDF)
DRV - [2006/08/31 20:03:10 | 000,010,368 | ---- | M] (Cyberlink Co.,Ltd.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\CLBStor.sys -- (CLBStor)
DRV - [2006/02/07 15:52:58 | 000,006,912 | R--- | M] (JMicron ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\JGOGO.sys -- (JGOGO)
DRV - [2004/08/13 14:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1343024091-115176313-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1343024091-115176313-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "about:blank "
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011/02/04 17:04:15 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/05/28 02:11:39 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/28 02:11:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/28 02:11:56 | 000,000,000 | ---D | M]

[2011/04/22 23:51:01 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Mozilla\Extensions
[2011/04/22 23:50:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
[2011/05/28 02:11:39 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\DOCUMENTS AND SETTINGS\ALL USERS.WINDOWS\APPLICATION DATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
File not found (No name found) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2011/01/14 06:26:27 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/01/14 18:22:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/03/18 13:53:24 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2009/12/16 13:29:40 | 000,000,839 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\jZipWebSearch.xml

O1 HOSTS File: ([2011/06/05 14:59:22 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\S-1-5-21-1343024091-115176313-682003330-1003\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [sfagent] C:\Program Files\Fighters\SPAMfighter\sfagent.exe (SPAMfighter ApS)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1343024091-115176313-682003330-1003\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-1343024091-115176313-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1343024091-115176313-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1343024091-115176313-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\PCANotify: DllName - PCANotify.dll - C:\WINDOWS\System32\PCANotify.dll (Symantec Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/05/21 22:41:53 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010/04/30 07:50:50 | 000,000,000 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.clmp3enc - C:\Program Files\CyberLink\Power2Go\CLMP3Enc.ACM (CyberLink Corp.)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17183584330711040)

========== Files/Folders - Created Within 30 Days ==========

[2011/06/05 16:47:35 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\OTL.exe
[2011/06/05 15:25:50 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/06/05 14:56:08 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/06/05 14:54:55 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/06/05 14:54:55 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/06/05 14:54:55 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/06/05 14:54:55 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/06/05 14:54:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/06/05 14:54:45 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/06/05 14:29:35 | 004,112,084 | R--- | C] (Swearware) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\ComboFix.exe
[2011/06/04 17:56:42 | 000,000,000 | ---D | C] -- C:\Program Files\ieSpell
[2011/06/04 14:00:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\SUPERAntiSpyware.com
[2011/06/04 13:49:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\My Documents\exe file association fix
[2011/06/04 03:22:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\SUPERAntiSpyware(2).com
[2011/06/04 03:22:54 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware(2)
[2011/06/01 02:39:07 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Recent
[2011/05/28 02:11:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\xing shared
[2011/05/19 01:25:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\_New Poems
[2011/05/18 00:21:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Canon
[2011/05/17 01:14:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\My Documents\My Received Files
[2011/05/12 02:29:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\WinZip
[2011/05/11 12:01:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\CCleaner
[2011/05/11 12:01:11 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/05 16:51:06 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1343024091-115176313-682003330-1003.job
[2011/06/05 16:51:06 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1343024091-115176313-682003330-1003.job
[2011/06/05 16:47:36 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\OTL.exe
[2011/06/05 16:30:25 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/06/05 16:30:13 | 000,000,888 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/05 16:30:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/06/05 16:11:16 | 001,007,108 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\rkill.scr
[2011/06/05 14:59:22 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/06/05 14:56:12 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/06/05 14:29:40 | 004,112,084 | R--- | M] (Swearware) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\ComboFix.exe
[2011/06/05 14:13:52 | 000,139,264 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\RKUnhookerLE.EXE
[2011/06/05 12:42:01 | 000,000,188 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\dictionary.reference.com.url
[2011/06/05 12:22:55 | 000,000,225 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Broken.FileAssociation - Tech Support Guy Forums.url
[2011/06/05 03:50:29 | 000,000,190 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\GotQuestions.org Statement of Faith.url
[2011/06/05 03:49:33 | 000,000,195 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Will there be sex in heaven.url
[2011/06/05 02:00:28 | 000,000,174 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Google.url
[2011/06/05 01:24:44 | 000,000,213 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\SAS is repeatedly finding Broken.FileAssociationh [1 items].url
[2011/06/04 22:11:21 | 000,002,515 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2003.lnk
[2011/06/04 03:47:59 | 000,000,331 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Sign In.url
[2011/06/03 20:46:07 | 000,000,150 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\David Freeman Biography - (b.1947), Maclean's, creeps, Creeps, Battering ram - Play, Creeps, Toronto, Canadian, Handicapped, and Won.url
[2011/06/03 19:19:34 | 000,000,167 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Daniel MacIvor - The Canadian Encyclopedia.url
[2011/06/03 01:39:00 | 000,000,892 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/02 20:57:38 | 000,481,340 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/06/02 20:57:38 | 000,087,068 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/06/01 21:34:33 | 000,023,040 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Backup of James.wbk
[2011/06/01 18:14:40 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/06/01 02:32:15 | 000,000,211 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Oxford Dictionaries Online - English Dictionary and Language Reference.url
[2011/06/01 01:44:31 | 000,000,119 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Oxford Dictionaries Online - English Dictionary and Language Reference.url
[2011/06/01 01:44:21 | 000,000,163 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Definition of favourite adjective from Cambridge Dictionary Online Free English Dictionary and Thesaurus.url
[2011/06/01 01:02:36 | 000,000,136 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\What's the Difference Between a Disciple and an Apostle.url
[2011/05/29 20:50:10 | 000,000,216 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Greek Alphabet - The 24 Letters of the Greek Alphabet.url
[2011/05/29 20:43:25 | 000,000,376 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2011/05/29 16:48:05 | 000,000,195 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Paraprosdokian encyclopedia topics Reference.com.url
[2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/28 07:15:26 | 000,000,229 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Black Swan (for w.r.) - Holly Blue - Open Salon.url
[2011/05/28 02:11:20 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\WINDOWS\System32\pncrt.dll
[2011/05/28 00:29:37 | 000,000,138 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\How do I password protect my files and folders in Windows.url
[2011/05/26 20:15:38 | 000,000,198 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\YouTube - Can You Lose Your Salvation.url
[2011/05/24 01:31:00 | 000,000,146 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Understanding 1 John 19 And Salvation Is Jesus Gives Life to The Dead.url
[2011/05/20 01:52:18 | 000,000,225 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\The Poetry of Robert Frost Study Guide Summary and Analysis of A Patch of Old Snow (1916) GradeSaver.url
[2011/05/19 02:46:11 | 000,000,221 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\A lesson in Dialogue - Writing.Com.url
[2011/05/17 18:30:36 | 000,000,160 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\mackeeper - Tech Support Guy Forums.url
[2011/05/14 15:22:17 | 000,000,225 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\SparkNotes Frost’s Early Poems “The Wood-Pile”.url
[2011/05/06 18:18:48 | 000,000,133 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Pardons Canada US Entry Waivers.url
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/05 16:11:16 | 001,007,108 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\rkill.scr
[2011/06/05 14:56:12 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/06/05 14:56:10 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/06/05 14:54:55 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/06/05 14:54:55 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/06/05 14:54:55 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/06/05 14:54:55 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/06/05 14:54:55 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/06/05 14:13:52 | 000,139,264 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\RKUnhookerLE.EXE
[2011/06/05 02:15:20 | 000,000,195 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Will there be sex in heaven.url
[2011/06/05 02:12:31 | 000,000,190 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\GotQuestions.org Statement of Faith.url
[2011/06/05 01:24:44 | 000,000,213 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\SAS is repeatedly finding Broken.FileAssociationh [1 items].url
[2011/06/04 19:39:41 | 000,000,225 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Broken.FileAssociation - Tech Support Guy Forums.url
[2011/06/03 20:46:07 | 000,000,150 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\David Freeman Biography - (b.1947), Maclean's, creeps, Creeps, Battering ram - Play, Creeps, Toronto, Canadian, Handicapped, and Won.url
[2011/06/03 19:19:34 | 000,000,167 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Daniel MacIvor - The Canadian Encyclopedia.url
[2011/06/01 21:13:09 | 000,023,040 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Backup of James.wbk
[2011/06/01 01:44:31 | 000,000,119 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Oxford Dictionaries Online - English Dictionary and Language Reference.url
[2011/06/01 01:44:21 | 000,000,163 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Definition of favourite adjective from Cambridge Dictionary Online Free English Dictionary and Thesaurus.url
[2011/06/01 01:41:21 | 000,000,211 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Oxford Dictionaries Online - English Dictionary and Language Reference.url
[2011/06/01 01:02:36 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\What's the Difference Between a Disciple and an Apostle.url
[2011/05/29 16:50:01 | 000,000,216 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Greek Alphabet - The 24 Letters of the Greek Alphabet.url
[2011/05/28 00:29:37 | 000,000,138 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\How do I password protect my files and folders in Windows.url
[2011/05/26 20:15:08 | 000,000,198 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\YouTube - Can You Lose Your Salvation.url
[2011/05/24 01:31:00 | 000,000,146 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Understanding 1 John 19 And Salvation Is Jesus Gives Life to The Dead.url
[2011/05/17 18:30:36 | 000,000,160 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\mackeeper - Tech Support Guy Forums.url
[2011/05/16 19:41:00 | 000,000,133 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Pardons Canada US Entry Waivers.url
[2011/04/22 23:50:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011/04/07 15:27:07 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Local Settings\Application Data\housecall.guid.cache
[2011/04/06 11:29:18 | 000,001,460 | -HS- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Local Settings\Application Data\h1ak21a17g2b8yl770cwuriv0x1r5e
[2011/04/06 11:29:18 | 000,001,460 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Application Data\h1ak21a17g2b8yl770cwuriv0x1r5e
[2011/04/03 19:20:39 | 000,000,988 | -HS- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Local Settings\Application Data\j638u7q3443b5j
[2011/04/03 19:20:39 | 000,000,988 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Application Data\j638u7q3443b5j
[2011/02/02 22:01:02 | 000,005,120 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/26 15:42:10 | 000,207,360 | ---- | C] () -- C:\WINDOWS\System32\oestore.dll
[2011/01/17 03:22:26 | 000,000,052 | ---- | C] () -- C:\WINDOWS\mvPCinfo.ini
[2011/01/15 05:14:45 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2011/01/15 05:06:37 | 000,015,444 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini
[2011/01/15 05:06:12 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2011/01/15 05:05:59 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2011/01/15 03:36:54 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/01/15 03:31:54 | 000,023,348 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011/01/15 02:27:47 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2011/01/15 02:22:09 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2011/01/15 02:21:59 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2011/01/15 02:21:58 | 000,227,587 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2011/01/15 02:21:58 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2011/01/14 22:02:51 | 000,015,121 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2011/01/14 19:58:46 | 000,000,000 | ---- | C] () -- C:\WINDOWS\lgfwup.ini
[2011/01/14 19:17:14 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011/01/14 19:15:43 | 000,236,760 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/01/14 06:42:48 | 000,000,066 | ---- | C] () -- C:\WINDOWS\ESPR200.ini
[2011/01/14 06:30:33 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/07/17 02:56:19 | 000,726,024 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/05/22 05:05:34 | 000,000,058 | ---- | C] () -- C:\WINDOWS\System32\EAL32.INI
[2008/04/14 08:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2008/04/14 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/04/14 08:00:00 | 000,481,340 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008/04/14 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/04/14 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/04/14 08:00:00 | 000,087,068 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008/04/14 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/04/14 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/04/14 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/04/14 08:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2008/04/14 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008/04/14 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003/01/07 19:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2010/05/24 19:19:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/10/31 18:16:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2010/10/31 18:14:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2010/10/31 18:09:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2010/10/29 19:09:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2010/07/18 04:06:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Common Toolkit Suite
[2010/09/28 20:12:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Driver Whiz
[2010/11/03 19:15:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Fighters
[2010/10/31 18:09:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2010/11/04 22:15:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2010/09/13 03:25:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PCPitstop
[2010/12/31 03:18:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2011/01/06 13:16:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Systweak
[2010/05/24 19:26:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/12/16 02:26:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2010/05/31 02:45:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/11/03 19:15:52 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{6FFECD61-BD8C-4A6E-96EE-4E677D84BA25}
[2010/07/27 14:02:27 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
[2011/06/05 15:44:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\AVG10
[2011/02/26 19:09:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\CitrixLogs
[2011/01/14 05:50:30 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Common Files
[2011/01/14 16:41:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Fighters
[2011/02/02 18:37:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Macrium
[2011/06/05 15:44:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\MFAData
[2011/02/19 12:57:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\NCH Swift Sound
[2011/01/14 22:32:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Drivers HeadQuarters
[2011/02/04 17:05:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\regid.1986-12.com.adobe
[2011/06/05 14:47:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\STOPzilla!
[2011/05/12 02:29:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\WinZip
[2011/01/14 16:42:03 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\{553764F8-6599-495D-B99E-4797D3DFC558}
[2010/10/31 18:17:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\AVG10
[2010/05/27 13:30:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\AVG9
[2010/07/16 22:27:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\Canon
[2010/11/01 04:57:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\CheckPoint
[2010/07/18 04:06:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\Common Toolkit Suite
[2010/07/18 04:06:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\Fighters
[2010/05/25 02:18:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\Leadertech
[2010/11/04 22:04:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\NCH Swift Sound
[2010/11/04 21:57:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\Recordpad
[2010/12/17 19:45:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\Sony
[2011/01/06 13:34:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\Systweak
[2011/06/05 15:44:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\AVG10
[2011/03/10 20:14:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Azureus
[2011/05/18 00:21:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Canon
[2011/02/14 09:53:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\EPSON
[2011/01/14 16:41:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Fighters
[2011/02/03 12:08:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\FinalMediaPlayer
[2011/04/03 02:03:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\FreshDiagnose
[2011/01/14 06:44:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Leadertech
[2011/02/19 12:57:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\NCH Swift Sound
[2011/01/17 03:29:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Publish Providers
[2011/02/19 12:57:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Recordpad
[2011/03/06 16:26:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Shareaza
[2011/01/17 03:29:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Sony
[2011/06/04 14:00:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\SUPERAntiSpyware(2).com
[2011/01/14 16:42:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\Fighters

========== Purity Check ==========



========== Custom Scans ==========


< >

< %SYSTEMDRIVE%\*.* >
[2010/05/21 22:41:53 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2011/06/01 18:14:40 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/06/05 14:56:12 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2011/06/05 15:00:41 | 000,018,301 | ---- | M] () -- C:\ComboFix.txt
[2010/05/21 22:41:53 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/05/21 22:41:53 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/05/21 22:41:53 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/04/14 08:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/04/14 08:00:00 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2011/06/05 16:30:06 | 534,773,759 | -HS- | M] () -- C:\pagefile.sys
[2011/06/05 16:27:47 | 000,000,431 | ---- | M] () -- C:\rkill.log
[2011/04/03 22:05:18 | 000,039,416 | ---- | M] () -- C:\TDSSKiller.2.4.21.0_03.04.2011_22.05.02_log.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 19:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 18:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 19:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 18:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2011/02/02 16:06:01 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2010/07/26 14:12:54 | 000,052,080 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\GoToPrintProcessor.dll
[2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 06:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2011/01/14 20:46:29 | 000,262,144 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2011/01/15 04:38:25 | 000,262,144 | ---- | M] () -- C:\WINDOWS\system32\config\security.sav
[2011/01/14 20:46:29 | 011,272,192 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2011/01/14 20:46:29 | 003,670,016 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2011/01/15 04:58:34 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/06/01 01:44:21 | 000,000,163 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Definition of favourite adjective from Cambridge Dictionary Online Free English Dictionary and Thesaurus.url
[2011/02/02 16:06:35 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2011/06/05 12:42:01 | 000,000,188 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\dictionary.reference.com.url
[2011/06/05 02:00:28 | 000,000,174 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Google.url
[2011/06/01 01:44:31 | 000,000,119 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Oxford Dictionaries Online - English Dictionary and Language Reference.url
[2011/01/15 03:45:05 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/06/05 14:29:40 | 004,112,084 | R--- | M] (Swearware) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\ComboFix.exe
[2011/06/05 16:47:36 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\OTL.exe
[2011/06/05 14:13:52 | 000,139,264 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\RKUnhookerLE.EXE

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >
[2011/02/26 19:09:27 | 007,053,264 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\gosetup.exe
[2011/03/02 12:54:23 | 001,062,984 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\gotomypc_540.exe

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2011/02/02 16:06:35 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/06/05 16:51:04 | 000,196,608 | -HS- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2009/01/30 21:40:22 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe
[2006/06/23 18:48:54 | 000,032,768 | R--- | M] (AsusTek Inc.) -- C:\WINDOWS\inf\UpdateUSB.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/14 08:00:00 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2008/04/14 08:00:00 | 000,004,821 | R--- | M] () -- C:\Program Files\Messenger\logowin.gif
[2007/04/03 02:37:24 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 10:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/14 02:00:30 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/14 08:42:30 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2008/04/14 08:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2008/04/14 08:00:00 | 000,018,052 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2008/04/14 08:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2007/04/03 02:37:28 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2007/04/03 03:34:02 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMPFC5A2B2

< End of report >

 

Here is the Extras scan:

OTL Extras logfile created on: 6/5/2011 4:51:08 PM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.58 Gb Available Physical Memory | 85.92% Memory free
7.34 Gb Paging File | 7.11 Gb Available in Paging File | 96.91% Paging File free
Paging file location(s): C:\pagefile.sys 4606 9000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 438.11 Gb Free Space | 94.07% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 406.18 Gb Free Space | 87.21% Space Free | Partition Type: NTFS

Computer Name: BERT-143294EC7D | User Name: Bert Bell | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*

[HKEY_USERS\S-1-5-21-1343024091-115176313-682003330-1003\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Digital Photo Professional] -- C:\Program Files\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{12518183-866A-11D3-97DF-0000F8D8F2E9}" = Symantec pcAnywhere
"{187F0827-9A10-4EA6-BBF8-4C5E9DDF9243}" = Catalyst Control Center - Branding
"{19C64880-BBCA-11D4-9EEE-0004ACDDDB3B}" = CyberLink InstantBurn
"{1D0AB230-E7BC-41CB-A50C-F282273E897B}" = SPAMfighter Client
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F698102-5739-441E-96F0-74F4EA540F06}" = Attansic Ethernet Utility
"{1FBCA76A-8E9F-E9A7-573B-DB855E7986FC}" = CCC Help Japanese
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
"{1FF35021-504D-4514-DAAB-D9E99E4E659A}" = Catalyst Control Center Graphics Full Existing
"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"{26A24AE4-039D-4CA4-87B4-2F83216023FF}" = Java(TM) 6 Update 23
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2A8B660F-3CD3-A8F4-B533-A4516286F400}" = Catalyst Control Center Localization All
"{2D21ECE2-6EB6-3DBA-4CE7-097B86862BE1}" = CCC Help French
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36BFAE56-22B2-F3AD-57B7-6873031D9581}" = CCC Help Spanish
"{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMB36X Raid Configurer
"{3C72635B-C30C-3B65-78D5-A3DDC6AA0492}" = ccc-core-static
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 5.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5598882D-E157-2A09-AF94-213D8D065949}" = Catalyst Control Center Core Implementation
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{57B3F6BD-7393-9188-69E2-16156E972211}" = CCC Help Chinese Standard
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{767572FD-4D01-4FA3-B0A6-4B09FB2CFC37}" = Sony Sound Forge 8.0
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0
"{85E85E42-9AB6-1AE7-0E44-D3384AA87B12}" = CCC Help English
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{8DB6BDDB-2416-4F39-BF40-2C004D2F68BB}" = Macrium Reflect - Free Edition
"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90170409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003
"{903B0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Project Professional 2003
"{90510409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
"{90A10409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office OneNote 2003
"{911738A5-773B-DF4A-3DB0-18445E243F44}" = CCC Help Italian
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-1033-F400-7760-000000000005}" = Adobe Acrobat X Pro - English, Français, Deutsch
"{ADD5DB49-72CF-11D8-9D75-000129760D75}" = PowerBackup 2.5
"{B56C065D-C00B-3134-A4A0-8E3793C786FC}" = ccc-utility
"{B62DB90E-2159-9273-FACC-280B00C8A5D3}" = CCC Help Chinese Traditional
"{B74D4E10-1033-0000-0000-000000000001}" = Adobe Bridge 1.0
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{B7C7D5BF-DB34-DA4E-75F2-6B83B9FA34ED}" = Catalyst Control Center Graphics Full New
"{B8CA6544-4D0E-FD24-3F37-02269E8BDD74}" = CCC Help German
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint 2.0
"{C768790F-04FB-11E0-9B2C-001AA037B01E}" = Google Earth
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD6D6CFE-D1B2-FA06-E0AB-F42D8C10DEF9}" = Skins
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C2}" = WinZip 15.5
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE7FF72E-4F23-8A13-3210-AA20BA9875D0}" = CCC Help Swedish
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow! 1.0
"{D5A9B7C0-8751-11D8-9D75-000129760D75}" = MediaShow 3.0
"{D5DC19AF-EEC3-DE49-B75B-2EC6311D59AB}" = CCC Help Norwegian
"{DF1C9D74-624E-B474-0159-F7A6014B47CE}" = CCC Help Finnish
"{E234E6EB-3907-166B-3DA0-4930B639FB4B}" = CCC Help Danish
"{E27BABF1-E5D8-985E-AB29-0AD6E464E2F1}" = Catalyst Control Center Graphics Light
"{E3D04529-6EDB-11D8-A372-0050BAE317E1}" = PowerDVD Copy 1.0
"{E50ADD4B-4721-4304-EFAA-051D66C988C6}" = ccc-core-preinstall
"{E87BE7F8-3077-40C1-8592-956F649A2781}" = Diskeeper Professional Edition
"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0
"{EDE721EC-870A-11D8-9D75-000129760D75}" = PowerDirector Express
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1D6C1FD-ECC9-25DE-53FF-6CB0854BFBDE}" = CCC Help Dutch
"3D Live Snooker_is1" = 3D Live Snooker
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"Advanced Grammar in Use" = Advanced Grammar in Use
"All ATI Software" = ATI - Software Uninstall Utility
"AtcL1" = Attansic L1 Gigabit Ethernet Driver
"CAL" = Canon Camera Access Library
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDC8" = Canon Utilities CameraWindow DC 8
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"Canon MOV Decoder" = Canon MOV Decoder
"Canon MOV Encoder" = Canon MOV Encoder
"CCleaner" = CCleaner
"conduitEngine" = Conduit Engine
"DPP" = Canon Utilities Digital Photo Professional 3.7
"EPSON Printer and Utilities" = EPSON Printer Software
"Grammar Express" = Grammar Express
"ie8" = Windows Internet Explorer 8
"ieSpell" = ieSpell
"LiveUpdate" = LiveUpdate 3.3 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.0.1200
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox 4.0 (x86 en-US)" = Mozilla Firefox 4.0 (x86 en-US)
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"Personal Printing Guide" = Canon Personal Printing Guide
"PhotoStitch" = Canon Utilities PhotoStitch
"RealPlayer 12.0" = RealPlayer
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"Software Guide" = Canon DIGITAL CAMERA Solution Disk Software Guide
"SPAMfighter" = SPAMfighter
"Trusted Software Assistant_is1" = Unknown File Assistant
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR archiver
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1343024091-115176313-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/24/2011 1:11:24 AM | Computer Name = BERT-143294EC7D | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/31/2011 3:27:05 AM | Computer Name = BERT-143294EC7D | Source = Application Error | ID = 1000
Description = Faulting application SZServer.exe, version 5.0.84.5, faulting module
SZSnsrSv.dll, version 5.0.84.5, fault address 0x00020247.

Error - 6/1/2011 9:55:41 PM | Computer Name = BERT-143294EC7D | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/2/2011 1:44:46 AM | Computer Name = BERT-143294EC7D | Source = Application Hang | ID = 1002
Description = Hanging application msimn.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/3/2011 7:00:58 PM | Computer Name = BERT-143294EC7D | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/3/2011 7:00:59 PM | Computer Name = BERT-143294EC7D | Source = Application Hang | ID = 1001
Description = Fault bucket 1180947459.

Error - 6/4/2011 12:51:04 AM | Computer Name = BERT-143294EC7D | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/4/2011 3:23:02 AM | Computer Name = BERT-143294EC7D | Source = Application Error | ID = 1000
Description = Faulting application superantispyware.exe, version 4.53.0.1000, faulting
module superantispyware.exe, version 4.53.0.1000, fault address 0x0006de68.

Error - 6/5/2011 2:39:55 AM | Computer Name = BERT-143294EC7D | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/5/2011 2:39:58 AM | Computer Name = BERT-143294EC7D | Source = Application Hang | ID = 1001
Description = Fault bucket 1180947459.

[ System Events ]
Error - 6/5/2011 4:27:07 PM | Computer Name = BERT-143294EC7D | Source = Service Control Manager | ID = 7001
Description = The DNS Client service depends on the TCP/IP Protocol Driver service
which failed to start because of the following error: %%31

Error - 6/5/2011 4:27:07 PM | Computer Name = BERT-143294EC7D | Source = Service Control Manager | ID = 7001
Description = The TCP/IP NetBIOS Helper service depends on the AFD service which
failed to start because of the following error: %%31

Error - 6/5/2011 4:27:07 PM | Computer Name = BERT-143294EC7D | Source = Service Control Manager | ID = 7001
Description = The IPSEC Services service depends on the IPSEC driver service which
failed to start because of the following error: %%31

Error - 6/5/2011 4:27:07 PM | Computer Name = BERT-143294EC7D | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD awlegacy AW_HOST Fips i8042prt intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SASDIFSV
SASKUTIL
Tcpip

Error - 6/5/2011 4:27:08 PM | Computer Name = BERT-143294EC7D | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 6/5/2011 4:27:09 PM | Computer Name = BERT-143294EC7D | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 6/5/2011 4:27:10 PM | Computer Name = BERT-143294EC7D | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 6/5/2011 4:28:00 PM | Computer Name = BERT-143294EC7D | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 6/5/2011 4:28:41 PM | Computer Name = BERT-143294EC7D | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 6/5/2011 4:29:17 PM | Computer Name = BERT-143294EC7D | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}


< End of report >

 

The new OTL scan is too large so I'll post it in two posts, this being the first of 2:

OTL logfile created on: 6/5/2011 5:44:06 PM - Run 2
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.32 Gb Available Physical Memory | 77.24% Memory free
7.34 Gb Paging File | 6.80 Gb Available in Paging File | 92.62% Paging File free
Paging file location(s): C:\pagefile.sys 4606 9000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 437.31 Gb Free Space | 93.89% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 406.18 Gb Free Space | 87.21% Space Free | Partition Type: NTFS

Computer Name: BERT-143294EC7D | User Name: Bert Bell | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/05 16:47:36 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\OTL.exe
PRC - [2011/05/28 02:11:18 | 000,273,544 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2011/04/18 17:40:08 | 002,334,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgtray.exe
PRC - [2011/04/18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2011/04/14 05:36:42 | 001,080,672 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2011/03/28 03:00:52 | 000,351,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgcsrvx.exe
PRC - [2011/03/16 16:05:14 | 000,656,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2011/03/09 19:24:44 | 002,708,024 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgfws.exe
PRC - [2011/02/10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2011/02/08 05:33:20 | 000,658,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2011/02/08 05:32:42 | 000,750,432 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgam.exe
PRC - [2011/01/17 20:32:06 | 000,220,824 | ---- | M] () -- C:\Program Files\Macrium\Reflect\ReflectService.exe
PRC - [2010/11/12 05:31:52 | 001,145,992 | ---- | M] (SPAMfighter ApS) -- C:\Program Files\Fighters\FighterSuiteService.exe
PRC - [2010/11/12 05:31:30 | 000,214,664 | ---- | M] (SPAMfighter ApS) -- C:\Program Files\Fighters\SPAMfighter\sfus.exe
PRC - [2010/11/12 05:31:25 | 000,821,384 | ---- | M] (SPAMfighter ApS) -- C:\Program Files\Fighters\SPAMfighter\sfagent.exe
PRC - [2008/04/14 08:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/01/31 18:55:42 | 000,096,370 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2004/10/05 19:48:40 | 000,577,644 | ---- | M] (Executive Software International, Inc.) -- C:\Program Files\Executive Software\Diskeeper\DkService.exe


========== Modules (SafeList) ==========

MOD - [2011/06/05 16:47:36 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\OTL.exe
MOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (NMIndexingService)
SRV - [2011/05/30 11:33:54 | 001,025,352 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe -- (AVG Security Toolbar Service)
SRV - [2011/04/18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/03/09 19:24:44 | 002,708,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgfws.exe -- (avgfws)
SRV - [2011/02/25 19:02:48 | 000,062,928 | R--- | M] (iS3, Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe -- (szserver)
SRV - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2011/01/17 20:32:06 | 000,220,824 | ---- | M] () [Auto | Running] -- C:\Program Files\Macrium\Reflect\ReflectService.exe -- (ReflectService)
SRV - [2010/11/12 05:31:52 | 001,145,992 | ---- | M] (SPAMfighter ApS) [Auto | Running] -- C:\Program Files\Fighters\FighterSuiteService.exe -- (Suite Service)
SRV - [2010/11/12 05:31:30 | 000,214,664 | ---- | M] (SPAMfighter ApS) [Auto | Running] -- C:\Program Files\Fighters\SPAMfighter\sfus.exe -- (SPAMfighter Update Service)
SRV - [2007/01/31 18:55:42 | 000,096,370 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2004/10/05 19:48:40 | 000,577,644 | ---- | M] (Executive Software International, Inc.) [Auto | Running] -- C:\Program Files\Executive Software\Diskeeper\DkService.exe -- (Diskeeper)


========== Driver Services (SafeList) ==========

DRV - [2011/04/14 21:28:42 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011/04/05 00:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011/03/16 16:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/03/01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/02/22 08:13:02 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2011/02/10 07:53:54 | 000,027,216 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011/02/10 07:53:52 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011/01/26 23:34:32 | 006,406,656 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2011/01/17 20:32:36 | 000,016,024 | ---- | M] (Macrium Software) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\pssnap.sys -- (pssnap)
DRV - [2011/01/07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2010/07/12 08:33:54 | 000,030,432 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avgfwdx.sys -- (Avgfwfd)
DRV - [2010/07/12 08:33:54 | 000,030,432 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgfwdx.sys -- (Avgfwdx)
DRV - [2010/05/10 14:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/02/17 14:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/04/06 10:40:10 | 000,037,376 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\l151x86.sys -- (AtcL001)
DRV - [2009/02/25 19:40:10 | 000,099,856 | R--- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2009/01/31 00:33:32 | 000,542,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\blackbox.dll -- (BlackBox)
DRV - [2007/03/26 15:21:06 | 004,395,008 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/03/24 07:20:24 | 000,046,208 | R--- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\jraid.sys -- (JRAID)
DRV - [2006/08/31 20:03:10 | 000,182,272 | ---- | M] (CyberLink Corporation.) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\CLBUDF.sys -- (CLBUDF)
DRV - [2006/08/31 20:03:10 | 000,010,368 | ---- | M] (Cyberlink Co.,Ltd.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\CLBStor.sys -- (CLBStor)
DRV - [2006/02/07 15:52:58 | 000,006,912 | R--- | M] (JMicron ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\JGOGO.sys -- (JGOGO)
DRV - [2004/08/13 14:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1343024091-115176313-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1343024091-115176313-682003330-1003\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-21-1343024091-115176313-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "about:blank "
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011/02/04 17:04:15 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/05/28 02:11:39 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/06/05 17:10:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared [2011/06/05 17:11:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/28 02:11:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/28 02:11:56 | 000,000,000 | ---D | M]

[2011/04/22 23:51:01 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Mozilla\Extensions
[2011/04/22 23:50:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
[2011/05/28 02:11:39 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\DOCUMENTS AND SETTINGS\ALL USERS.WINDOWS\APPLICATION DATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2011/06/05 17:10:32 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2011/01/14 06:26:27 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/01/14 18:22:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/03/18 13:53:24 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2009/12/16 13:29:40 | 000,000,839 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\jZipWebSearch.xml

O1 HOSTS File: ([2011/06/05 14:59:22 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKU\S-1-5-21-1343024091-115176313-682003330-1003\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\S-1-5-21-1343024091-115176313-682003330-1003\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [sfagent] C:\Program Files\Fighters\SPAMfighter\sfagent.exe (SPAMfighter ApS)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1343024091-115176313-682003330-1003\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-1343024091-115176313-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1343024091-115176313-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1343024091-115176313-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/05/21 22:41:53 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010/04/30 07:50:50 | 000,000,000 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.clmp3enc - C:\Program Files\CyberLink\Power2Go\CLMP3Enc.ACM (CyberLink Corp.)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17183584330711040)

========== Files/Folders - Created Within 30 Days ==========

[2011/06/05 17:11:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\AVG Security Toolbar
[2011/06/05 17:11:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\AVG 2011
[2011/06/05 17:10:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\AVG
[2011/06/05 16:47:35 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\OTL.exe
[2011/06/05 15:25:50 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/06/05 14:56:08 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/06/05 14:54:55 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/06/05 14:54:55 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/06/05 14:54:55 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/06/05 14:54:55 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/06/05 14:54:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/06/05 14:54:45 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/06/05 14:29:35 | 004,112,084 | R--- | C] (Swearware) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\ComboFix.exe
[2011/06/04 17:56:42 | 000,000,000 | ---D | C] -- C:\Program Files\ieSpell
[2011/06/04 14:00:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\SUPERAntiSpyware.com
[2011/06/04 13:49:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\My Documents\exe file association fix
[2011/06/04 03:22:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\SUPERAntiSpyware(2).com
[2011/06/04 03:22:54 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware(2)
[2011/06/01 02:39:07 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Recent
[2011/05/28 02:11:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\xing shared
[2011/05/19 01:25:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\_New Poems
[2011/05/18 00:21:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Canon
[2011/05/17 01:14:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\My Documents\My Received Files
[2011/05/12 02:29:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\WinZip
[2011/05/11 12:01:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\CCleaner
[2011/05/11 12:01:11 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/05 17:44:13 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1343024091-115176313-682003330-1003.job
[2011/06/05 17:44:13 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1343024091-115176313-682003330-1003.job
[2011/06/05 17:35:42 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/06/05 17:35:18 | 000,000,888 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/05 17:35:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/06/05 17:17:22 | 117,308,668 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/06/05 17:17:22 | 000,654,320 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavifw.avm
[2011/06/05 17:14:43 | 000,002,515 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2003.lnk
[2011/06/05 17:11:03 | 000,000,690 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\AVG 2011.lnk
[2011/06/05 16:47:36 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\OTL.exe
[2011/06/05 16:11:16 | 001,007,108 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\rkill.scr
[2011/06/05 14:59:22 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/06/05 14:56:12 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/06/05 14:29:40 | 004,112,084 | R--- | M] (Swearware) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\ComboFix.exe
[2011/06/05 14:13:52 | 000,139,264 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\RKUnhookerLE.EXE
[2011/06/05 12:42:01 | 000,000,188 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\dictionary.reference.com.url
[2011/06/05 12:22:55 | 000,000,225 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Broken.FileAssociation - Tech Support Guy Forums.url
[2011/06/05 03:50:29 | 000,000,190 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\GotQuestions.org Statement of Faith.url
[2011/06/05 03:49:33 | 000,000,195 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Will there be sex in heaven.url
[2011/06/05 02:00:28 | 000,000,174 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Google.url
[2011/06/05 01:24:44 | 000,000,213 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\SAS is repeatedly finding Broken.FileAssociationh [1 items].url
[2011/06/04 03:47:59 | 000,000,331 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Sign In.url
[2011/06/03 20:46:07 | 000,000,150 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\David Freeman Biography - (b.1947), Maclean's, creeps, Creeps, Battering ram - Play, Creeps, Toronto, Canadian, Handicapped, and Won.url
[2011/06/03 19:19:34 | 000,000,167 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Daniel MacIvor - The Canadian Encyclopedia.url
[2011/06/03 01:39:00 | 000,000,892 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/02 20:57:38 | 000,481,340 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/06/02 20:57:38 | 000,087,068 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/06/01 21:34:33 | 000,023,040 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Backup of James.wbk
[2011/06/01 18:14:40 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/06/01 02:32:15 | 000,000,211 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Oxford Dictionaries Online - English Dictionary and Language Reference.url
[2011/06/01 01:44:31 | 000,000,119 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Oxford Dictionaries Online - English Dictionary and Language Reference.url
[2011/06/01 01:44:21 | 000,000,163 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Definition of favourite adjective from Cambridge Dictionary Online Free English Dictionary and Thesaurus.url
[2011/06/01 01:02:36 | 000,000,136 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\What's the Difference Between a Disciple and an Apostle.url
[2011/05/29 20:50:10 | 000,000,216 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Greek Alphabet - The 24 Letters of the Greek Alphabet.url
[2011/05/29 20:43:25 | 000,000,376 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2011/05/29 16:48:05 | 000,000,195 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Paraprosdokian encyclopedia topics Reference.com.url
[2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/28 07:15:26 | 000,000,229 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Black Swan (for w.r.) - Holly Blue - Open Salon.url
[2011/05/28 02:11:20 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\WINDOWS\System32\pncrt.dll
[2011/05/28 00:29:37 | 000,000,138 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\How do I password protect my files and folders in Windows.url
[2011/05/26 20:15:38 | 000,000,198 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\YouTube - Can You Lose Your Salvation.url
[2011/05/24 01:31:00 | 000,000,146 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Understanding 1 John 19 And Salvation Is Jesus Gives Life to The Dead.url
[2011/05/20 01:52:18 | 000,000,225 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\The Poetry of Robert Frost Study Guide Summary and Analysis of A Patch of Old Snow (1916) GradeSaver.url
[2011/05/19 02:46:11 | 000,000,221 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\A lesson in Dialogue - Writing.Com.url
[2011/05/17 18:30:36 | 000,000,160 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\mackeeper - Tech Support Guy Forums.url
[2011/05/14 15:22:17 | 000,000,225 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\SparkNotes Frost’s Early Poems “The Wood-Pile”.url
[2011/05/06 18:18:48 | 000,000,133 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Pardons Canada US Entry Waivers.url
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/05 17:17:22 | 117,308,668 | ---- | C] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/06/05 17:17:22 | 000,654,320 | ---- | C] () -- C:\WINDOWS\System32\drivers\AVG\iavifw.avm
[2011/06/05 17:11:03 | 000,000,690 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\AVG 2011.lnk
[2011/06/05 16:11:16 | 001,007,108 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\rkill.scr
[2011/06/05 14:56:12 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/06/05 14:56:10 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/06/05 14:54:55 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/06/05 14:54:55 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/06/05 14:54:55 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/06/05 14:54:55 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/06/05 14:54:55 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/06/05 14:13:52 | 000,139,264 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\RKUnhookerLE.EXE
[2011/06/05 02:15:20 | 000,000,195 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Will there be sex in heaven.url
[2011/06/05 02:12:31 | 000,000,190 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\GotQuestions.org Statement of Faith.url
[2011/06/05 01:24:44 | 000,000,213 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\SAS is repeatedly finding Broken.FileAssociationh [1 items].url
[2011/06/04 19:39:41 | 000,000,225 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Broken.FileAssociation - Tech Support Guy Forums.url
[2011/06/03 20:46:07 | 000,000,150 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\David Freeman Biography - (b.1947), Maclean's, creeps, Creeps, Battering ram - Play, Creeps, Toronto, Canadian, Handicapped, and Won.url
[2011/06/03 19:19:34 | 000,000,167 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Daniel MacIvor - The Canadian Encyclopedia.url
[2011/06/01 21:13:09 | 000,023,040 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Backup of James.wbk
[2011/06/01 01:44:31 | 000,000,119 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Oxford Dictionaries Online - English Dictionary and Language Reference.url
[2011/06/01 01:44:21 | 000,000,163 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Definition of favourite adjective from Cambridge Dictionary Online Free English Dictionary and Thesaurus.url
[2011/06/01 01:41:21 | 000,000,211 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Oxford Dictionaries Online - English Dictionary and Language Reference.url
[2011/06/01 01:02:36 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\What's the Difference Between a Disciple and an Apostle.url

 

OTL scan no. 2

[2011/05/29 16:50:01 | 000,000,216 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Greek Alphabet - The 24 Letters of the Greek Alphabet.url
[2011/05/28 00:29:37 | 000,000,138 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\How do I password protect my files and folders in Windows.url
[2011/05/26 20:15:08 | 000,000,198 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\YouTube - Can You Lose Your Salvation.url
[2011/05/24 01:31:00 | 000,000,146 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Understanding 1 John 19 And Salvation Is Jesus Gives Life to The Dead.url
[2011/05/17 18:30:36 | 000,000,160 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\mackeeper - Tech Support Guy Forums.url
[2011/05/16 19:41:00 | 000,000,133 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\Pardons Canada US Entry Waivers.url
[2011/04/22 23:50:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011/04/07 15:27:07 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Local Settings\Application Data\housecall.guid.cache
[2011/04/06 11:29:18 | 000,001,460 | -HS- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Local Settings\Application Data\h1ak21a17g2b8yl770cwuriv0x1r5e
[2011/04/06 11:29:18 | 000,001,460 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Application Data\h1ak21a17g2b8yl770cwuriv0x1r5e
[2011/04/03 19:20:39 | 000,000,988 | -HS- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Local Settings\Application Data\j638u7q3443b5j
[2011/04/03 19:20:39 | 000,000,988 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Application Data\j638u7q3443b5j
[2011/02/02 22:01:02 | 000,005,120 | ---- | C] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/26 15:42:10 | 000,207,360 | ---- | C] () -- C:\WINDOWS\System32\oestore.dll
[2011/01/17 03:22:26 | 000,000,052 | ---- | C] () -- C:\WINDOWS\mvPCinfo.ini
[2011/01/15 05:14:45 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2011/01/15 05:06:37 | 000,015,444 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini
[2011/01/15 05:06:12 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2011/01/15 05:05:59 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2011/01/15 03:36:54 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/01/15 03:31:54 | 000,023,348 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011/01/15 02:27:47 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2011/01/15 02:22:09 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2011/01/15 02:21:59 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2011/01/15 02:21:58 | 000,227,587 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2011/01/15 02:21:58 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2011/01/14 22:02:51 | 000,015,121 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2011/01/14 19:58:46 | 000,000,000 | ---- | C] () -- C:\WINDOWS\lgfwup.ini
[2011/01/14 19:17:14 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011/01/14 19:15:43 | 000,236,760 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/01/14 06:42:48 | 000,000,066 | ---- | C] () -- C:\WINDOWS\ESPR200.ini
[2011/01/14 06:30:33 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/07/17 02:56:19 | 000,726,024 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/05/22 05:05:34 | 000,000,058 | ---- | C] () -- C:\WINDOWS\System32\EAL32.INI
[2008/04/14 08:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2008/04/14 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/04/14 08:00:00 | 000,481,340 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008/04/14 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/04/14 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/04/14 08:00:00 | 000,087,068 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008/04/14 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/04/14 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/04/14 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/04/14 08:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2008/04/14 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008/04/14 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003/01/07 19:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2010/05/24 19:19:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/10/31 18:16:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2010/10/31 18:14:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2010/10/31 18:09:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2010/10/29 19:09:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2010/07/18 04:06:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Common Toolkit Suite
[2010/09/28 20:12:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Driver Whiz
[2010/11/03 19:15:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Fighters
[2010/10/31 18:09:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2010/11/04 22:15:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2010/09/13 03:25:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PCPitstop
[2010/12/31 03:18:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2011/01/06 13:16:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Systweak
[2010/05/24 19:26:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/12/16 02:26:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2010/05/31 02:45:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/11/03 19:15:52 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{6FFECD61-BD8C-4A6E-96EE-4E677D84BA25}
[2010/07/27 14:02:27 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
[2011/06/05 17:17:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\AVG Security Toolbar
[2011/06/05 17:11:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\AVG10
[2011/02/26 19:09:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\CitrixLogs
[2011/01/14 05:50:30 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Common Files
[2011/01/14 16:41:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Fighters
[2011/02/02 18:37:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Macrium
[2011/06/05 17:10:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\MFAData
[2011/02/19 12:57:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\NCH Swift Sound
[2011/01/14 22:32:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Drivers HeadQuarters
[2011/02/04 17:05:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\regid.1986-12.com.adobe
[2011/06/05 14:47:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\STOPzilla!
[2011/05/12 02:29:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\WinZip
[2011/01/14 16:42:03 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\{553764F8-6599-495D-B99E-4797D3DFC558}
[2010/10/31 18:17:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\AVG10
[2010/05/27 13:30:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\AVG9
[2010/07/16 22:27:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\Canon
[2010/11/01 04:57:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\CheckPoint
[2010/07/18 04:06:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\Common Toolkit Suite
[2010/07/18 04:06:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\Fighters
[2010/05/25 02:18:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\Leadertech
[2010/11/04 22:04:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\NCH Swift Sound
[2010/11/04 21:57:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\Recordpad
[2010/12/17 19:45:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\Sony
[2011/01/06 13:34:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell\Application Data\Systweak
[2011/06/05 15:44:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\AVG10
[2011/03/10 20:14:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Azureus
[2011/05/18 00:21:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Canon
[2011/02/14 09:53:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\EPSON
[2011/01/14 16:41:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Fighters
[2011/02/03 12:08:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\FinalMediaPlayer
[2011/04/03 02:03:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\FreshDiagnose
[2011/01/14 06:44:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Leadertech
[2011/02/19 12:57:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\NCH Swift Sound
[2011/01/17 03:29:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Publish Providers
[2011/02/19 12:57:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Recordpad
[2011/03/06 16:26:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Shareaza
[2011/01/17 03:29:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Sony
[2011/06/04 14:00:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\SUPERAntiSpyware(2).com
[2011/01/14 16:42:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\Fighters

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/05/21 22:41:53 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2011/06/01 18:14:40 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/06/05 14:56:12 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2011/06/05 15:00:41 | 000,018,301 | ---- | M] () -- C:\ComboFix.txt
[2010/05/21 22:41:53 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/05/21 22:41:53 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/05/21 22:41:53 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/04/14 08:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/04/14 08:00:00 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2011/06/05 17:35:09 | 534,773,759 | -HS- | M] () -- C:\pagefile.sys
[2011/06/05 16:27:47 | 000,000,431 | ---- | M] () -- C:\rkill.log
[2011/04/03 22:05:18 | 000,039,416 | ---- | M] () -- C:\TDSSKiller.2.4.21.0_03.04.2011_22.05.02_log.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 19:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 18:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 19:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 18:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2011/02/02 16:06:01 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2010/07/26 14:12:54 | 000,052,080 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\GoToPrintProcessor.dll
[2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 06:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2011/01/14 20:46:29 | 000,262,144 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2011/01/15 04:38:25 | 000,262,144 | ---- | M] () -- C:\WINDOWS\system32\config\security.sav
[2011/01/14 20:46:29 | 011,272,192 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2011/01/14 20:46:29 | 003,670,016 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2011/01/15 04:58:34 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/06/01 01:44:21 | 000,000,163 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Definition of favourite adjective from Cambridge Dictionary Online Free English Dictionary and Thesaurus.url
[2011/02/02 16:06:35 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2011/06/05 12:42:01 | 000,000,188 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\dictionary.reference.com.url
[2011/06/05 02:00:28 | 000,000,174 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Google.url
[2011/06/01 01:44:31 | 000,000,119 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Oxford Dictionaries Online - English Dictionary and Language Reference.url
[2011/01/15 03:45:05 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/06/05 14:29:40 | 004,112,084 | R--- | M] (Swearware) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\ComboFix.exe
[2011/06/05 16:47:36 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\OTL.exe
[2011/06/05 14:13:52 | 000,139,264 | ---- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Desktop\RKUnhookerLE.EXE

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >
[2011/02/26 19:09:27 | 007,053,264 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\gosetup.exe
[2011/03/02 12:54:23 | 001,062,984 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\gotomypc_540.exe

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2011/02/02 16:06:35 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/06/05 17:44:11 | 000,196,608 | -HS- | M] () -- C:\Documents and Settings\Bert Bell.BERT-143294EC7D\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2009/01/30 21:40:22 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe
[2006/06/23 18:48:54 | 000,032,768 | R--- | M] (AsusTek Inc.) -- C:\WINDOWS\inf\UpdateUSB.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/14 08:00:00 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2008/04/14 08:00:00 | 000,004,821 | R--- | M] () -- C:\Program Files\Messenger\logowin.gif
[2007/04/03 02:37:24 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 10:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/14 02:00:30 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/14 08:42:30 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2008/04/14 08:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2008/04/14 08:00:00 | 000,018,052 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2008/04/14 08:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2007/04/03 02:37:28 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2007/04/03 03:34:02 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMPFC5A2B2

< End of report >

 

Security Check scan:

Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
AVG 2011
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 23
Out of date Java installed!
Adobe Flash Player 10.2.159.1
Mozilla Firefox (x86 en-US..) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
``````````End of Log````````````