1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Internet Explorer Crashes

Discussion in 'Malware and Virus Removal Archive' started by Ken, 2011/07/31.

Page 2 of 3
  1. 2011/08/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    We have to reset your MBR.

    Restart computer
    When you reboot you will see an option to boot into the Recovery Console or the normal Windows installation.
    You have to use the up/down arrows to choose the Recovery Console. Then press Enter but you only have 2 seconds by default.
    If you find this hard to do then you can go into Control Panel, System, Advanced, Startup and Recovery, Settings. Where it says Time to Display List of Operating Systems, change it to 10 or more seconds. OK Then reboot.

    You should get a black screen with a C:\> prompt. Type with an Enter after each line:

    fixmbr

    (If it asks you if you are sure then say "Y ".)

    exit

    Reboot computer.

    Post fresh aswMBR log.
     
    broni,
    #21
  2. 2011/08/05
    Ken

    Ken Well-Known Member Thread Starter

    Joined:
    2006/01/10
    Messages:
    241
    Likes Received:
    0
    The casualties continue to mount. The AIO printer wouldn't fax and now it won't print; spooler problem. Paint gets stuck launching. IE6 disappeared, but I intend to replace it anyway.
    I fixed printer by uninstalling and reinstalling. Also turned on spooling service.
    Ran MBR.
    aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software
    Run date: 2011-08-05 09:36:36
    -----------------------------
    09:36:36.531 OS Version: Windows 5.1.2600 Service Pack 3
    09:36:36.531 Number of processors: 1 586 0x401
    09:36:36.531 ComputerName: KGBNEW UserName:
    09:36:41.375 Initialize success
    09:36:46.406 AVAST engine defs: 11080500
    09:36:52.921 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
    09:36:52.921 Disk 0 Vendor: ST380011A 8.16 Size: 76293MB BusType: 3
    09:36:52.968 Disk 0 MBR read successfully
    09:36:52.968 Disk 0 MBR scan
    09:36:52.968 Disk 0 Windows XP default MBR code
    09:36:53.031 Disk 0 scanning sectors +156232125
    09:36:53.296 Disk 0 scanning C:\WINDOWS\system32\drivers
    09:37:31.671 Service scanning
    09:37:35.906 Modules scanning
    09:38:09.859 Disk 0 trace - called modules:
    09:38:09.890 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys
    09:38:09.890 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82fcfab8]
    09:38:09.890 3 CLASSPNP.SYS[f86b7fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x82fd2d98]
    09:38:11.734 AVAST engine scan C:\WINDOWS
    09:38:46.656 AVAST engine scan C:\WINDOWS\system32
    09:45:46.421 AVAST engine scan C:\WINDOWS\system32\drivers
    09:46:18.531 AVAST engine scan C:\Documents and Settings\Kenneth
    10:00:58.203 AVAST engine scan C:\Documents and Settings\All Users
    10:03:43.468 Scan finished successfully
    10:07:50.687 Disk 0 MBR has been saved successfully to "C:\System Cleaners\aswMBR\MBR.dat "
    10:07:50.687 The log file has been saved successfully to "C:\System Cleaners\aswMBR\aswMBR2.txt "
     
    Last edited: 2011/08/05
    Ken,
    #22


  3. to hide this advert.

  4. 2011/08/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    It looks good now :)

    We'll see what we can do regarding those side effects little bit later.
    IE6 is a very outdated program, so you'll have to update it to version 8 anyway.

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
    broni,
    #23
  5. 2011/08/06
    Ken

    Ken Well-Known Member Thread Starter

    Joined:
    2006/01/10
    Messages:
    241
    Likes Received:
    0
    Ran OTL.
    OTL logfile created on: 8/6/2011 8:02:13 AM - Run 1
    OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\Kenneth\Desktop
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.5512)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    509.98 Mb Total Physical Memory | 282.04 Mb Available Physical Memory | 55.30% Memory free
    1.22 Gb Paging File | 0.91 Gb Available in Paging File | 74.78% Paging File free
    Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 71.46 Gb Total Space | 46.44 Gb Free Space | 64.99% Space Free | Partition Type: NTFS

    Computer Name: KGBNEW | User Name: Kenneth | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011/08/06 07:59:36 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\OTL.exe
    PRC - [2011/07/06 19:52:38 | 000,449,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    PRC - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    PRC - [2011/07/04 07:43:54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    PRC - [2011/07/04 07:43:51 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    PRC - [2011/05/20 11:28:44 | 000,273,544 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
    PRC - [2010/08/23 21:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    PRC - [2009/05/21 10:55:32 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    PRC - [2008/08/13 19:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2007/01/16 23:36:48 | 000,304,624 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 944\memcard.exe
    PRC - [2007/01/16 23:36:28 | 000,431,600 | ---- | M] (Dell) -- C:\Program Files\Dell Photo AIO Printer 944\dlcdmon.exe
    PRC - [2007/01/16 23:34:36 | 000,538,096 | ---- | M] ( ) -- C:\WINDOWS\system32\dlcdcoms.exe


    ========== Modules (SafeList) ==========

    MOD - [2011/08/06 07:59:36 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\OTL.exe
    MOD - [2011/07/04 07:43:51 | 000,199,792 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll
    MOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [Disabled | Stopped] -- -- (HidServ)
    SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
    SRV - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
    SRV - [2011/07/04 07:43:51 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
    SRV - [2010/08/23 21:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
    SRV - [2008/08/13 19:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
    SRV - [2007/03/07 15:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
    SRV - [2007/01/16 23:34:36 | 000,538,096 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\dlcdcoms.exe -- (dlcd_device)
    SRV - [2006/12/11 22:16:32 | 000,064,248 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe -- (Roxio UPnP Renderer 9)
    SRV - [2006/12/11 22:16:28 | 000,301,816 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe -- (Roxio Upnp Server 9)


    ========== Driver Services (SafeList) ==========

    DRV - [2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
    DRV - [2011/07/04 07:36:43 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
    DRV - [2011/07/04 07:36:32 | 000,309,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
    DRV - [2011/07/04 07:35:23 | 000,043,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
    DRV - [2011/07/04 07:35:12 | 000,102,616 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
    DRV - [2011/07/04 07:32:32 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
    DRV - [2011/07/04 07:32:13 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
    DRV - [2011/07/04 07:32:12 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV - [2010/02/11 08:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
    DRV - [2007/02/25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
    DRV - [2006/10/05 16:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
    DRV - [2005/04/07 17:18:34 | 000,003,840 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\BANTExt.sys -- (BANTExt)
    DRV - [2004/09/17 16:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
    DRV - [2004/06/16 05:52:40 | 000,061,157 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC53.sys -- (IntelC53)
    DRV - [2004/03/06 06:15:34 | 000,647,929 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC52.sys -- (IntelC52)
    DRV - [2004/03/06 06:14:42 | 001,233,525 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC51.sys -- (IntelC51)
    DRV - [2004/03/06 06:13:38 | 000,037,048 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mohfilt.sys -- (mohfilt)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://www.google.com/ig/dell?hl=en



    IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en
    IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = AB 4E EA 0C 33 31 8E 48 A7 2D 02 F8 4E BF B8 A8 [binary data]
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en
    IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = AB 4E EA 0C 33 31 8E 48 A7 2D 02 F8 4E BF B8 A8 [binary data]
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = AB 4E EA 0C 33 31 8E 48 A7 2D 02 F8 4E BF B8 A8 [binary data]

    IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = AB 4E EA 0C 33 31 8E 48 A7 2D 02 F8 4E BF B8 A8 [binary data]

    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = AB 4E EA 0C 33 31 8E 48 A7 2D 02 F8 4E BF B8 A8 [binary data]
    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1

    ========== FireFox ==========


    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
    FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.647: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.647: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/05/20 11:29:44 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/29 09:27:17 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
    FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.2\extensions\\Components: C:\Program Files\SeaMonkey\components [2011/07/22 07:42:32 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.2\extensions\\Plugins: C:\Program Files\SeaMonkey\plugins [2011/07/22 07:42:32 | 000,000,000 | ---D | M]

    [2009/11/02 18:57:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kenneth\Application Data\Mozilla\Extensions
    [2009/11/02 18:57:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kenneth\Application Data\Mozilla\Extensions\{92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
    [2011/08/03 08:38:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kenneth\Application Data\Mozilla\Firefox\Profiles\8wzp06h5.default\extensions
    [2011/07/23 08:28:55 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kenneth\Application Data\Mozilla\SeaMonkey\Profiles\1d93tk2p.default\extensions
    [2011/07/29 09:27:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    File not found (No name found) --
    [2010/05/26 08:36:25 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
    [2009/09/01 20:34:32 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
    [2011/07/08 03:16:28 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
    [2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

    O1 HOSTS File: ([2011/08/03 08:39:48 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (SBCONVERT Class) - {3017FB3E-9A77-4396-88C5-0EC9548FB42F} - C:\Program Files\SpeedBit Video Downloader\TBUB2\tbcore3.dll ()
    O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
    O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
    O2 - BHO: (SearchPredictObj Class) - {389943B0-C3A2-4E69-82CB-8596A84CB3DC} - C:\Program Files\SearchPredict\SearchPredict.dll (Speedbit Ltd.)
    O2 - BHO: (Softonic-Eng7 Toolbar) - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
    O2 - BHO: (SBCONVERT Class) - {A1056498-D09A-41E4-864B-505EDD640D9E} - C:\Program Files\SpeedBit Video Downloader\Toolbar\SpeedBitVideoDownloader.dll ()
    O2 - BHO: (no name) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - No CLSID value found.
    O2 - BHO: (GrabberObj Class) - {FF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\SpeedBit Video Downloader\TBUB2\Grabber.dll (Speedbit Ltd.)
    O3 - HKLM\..\Toolbar: (SpeedBit Video Downloader) - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - C:\Program Files\SpeedBit Video Downloader\TBUB2\tbcore3.dll ()
    O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
    O3 - HKLM\..\Toolbar: (Softonic-Eng7 Toolbar) - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    O3 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..\Toolbar\ShellBrowser: (SpeedBit Video Downloader) - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - C:\Program Files\SpeedBit Video Downloader\TBUB2\tbcore3.dll ()
    O3 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..\Toolbar\ShellBrowser: (Softonic-Eng7 Toolbar) - {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    O3 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..\Toolbar\WebBrowser: (SpeedBit Video Downloader) - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - C:\Program Files\SpeedBit Video Downloader\TBUB2\tbcore3.dll ()
    O3 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..\Toolbar\WebBrowser: (Softonic-Eng7 Toolbar) - {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
    O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
    O4 - HKLM..\Run: [DLCDCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCDtime.DLL ()
    O4 - HKLM..\Run: [dlcdmon.exe] C:\Program Files\Dell Photo AIO Printer 944\dlcdmon.exe (Dell)
    O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
    O4 - HKLM..\Run: [KernelFaultCheck] File not found
    O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
    O4 - HKLM..\Run: [MemoryCardManager] C:\Program Files\Dell Photo AIO Printer 944\memcard.exe ()
    O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
    O4 - Startup: C:\Documents and Settings\Kenneth\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKU\##aswSnx private storage\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O15 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..Trusted Domains: aol.com ([free] http in Trusted sites)
    O15 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
    O15 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..Trusted Domains: turbotax.com ([]https in Trusted sites)
    O16 - DPF: {4EC99A0B-E57C-4FBE-B9C4-8428424FBF88} http://supportcenter.verizon.net/euserv/jsp/VOLAWeb.cab (McciUtilsSpecialFolder Class)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {DB0474CC-8EF6-47FC-905B-23FC58A70817} https://download.verizon.net/sfp/Cabs/hst/webinstall/HstWebInstall.cab (RegPropsCtrl Class)
    O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
    O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2005/12/31 12:35:41 | 000,000,018 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O32 - AutoRun File - [2004/08/10 15:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BIT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: AppMgmt - File not found
    NetSvcs: HidServ - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
    Drivers32: wave - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/08/06 07:59:16 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\OTL.exe
    [2011/08/05 13:57:33 | 000,437,248 | ---- | C] (Microsoft Corporation) -- C:\Program Files\mspaint.exe
    [2011/08/05 13:19:05 | 000,413,696 | ---- | C] (Dell) -- C:\WINDOWS\System32\dlcddrs.dll
    [2011/08/05 13:19:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Dell Printers
    [2011/08/05 13:18:59 | 000,000,000 | ---D | C] -- C:\Program Files\Dell Photo AIO Printer 944
    [2011/08/05 13:18:18 | 000,323,584 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdhcp.dll
    [2011/08/05 13:18:17 | 000,413,696 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdinpa.dll
    [2011/08/05 13:18:17 | 000,397,312 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdiesc.dll
    [2011/08/05 13:18:15 | 001,224,704 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdserv.dll
    [2011/08/05 13:18:15 | 000,991,232 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdusb1.dll
    [2011/08/05 13:18:14 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdprox.dll
    [2011/08/05 13:18:14 | 000,094,208 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdpplc.dll
    [2011/08/05 13:18:13 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdpmui.dll
    [2011/08/05 13:18:12 | 000,585,728 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdlmpm.dll
    [2011/08/05 13:18:10 | 000,386,544 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdih.exe
    [2011/08/05 13:18:09 | 000,696,320 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdhbn3.dll
    [2011/08/05 13:18:07 | 000,538,096 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdcoms.exe
    [2011/08/05 13:18:06 | 000,421,888 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdcomm.dll
    [2011/08/05 13:18:05 | 000,684,032 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdcomc.dll
    [2011/08/05 13:18:05 | 000,382,448 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdcfg.exe
    [2011/08/05 07:05:03 | 000,000,000 | ---D | C] -- C:\spoolerlogs
    [2011/08/04 18:39:15 | 000,083,968 | ---- | C] (eSage Lab) -- C:\Documents and Settings\Kenneth\Desktop\remover.exe
    [2011/08/04 18:38:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip
    [2011/08/04 16:26:32 | 000,000,000 | ---D | C] -- C:\Program Files\Carbonite
    [2011/08/04 16:26:32 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
    [2011/08/04 16:26:31 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ODBC
    [2011/08/04 16:26:31 | 000,000,000 | ---D | C] -- C:\Program Files\ComPlus Applications
    [2011/08/04 16:26:28 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
    [2011/08/04 16:26:28 | 000,000,000 | ---D | C] -- C:\Program Files\MSN
    [2011/08/04 16:26:28 | 000,000,000 | ---D | C] -- C:\Program Files\Motive
    [2011/08/04 16:26:27 | 000,000,000 | -H-D | C] -- C:\Program Files\Uninstall Information
    [2011/08/04 16:26:27 | 000,000,000 | ---D | C] -- C:\Program Files\Users
    [2011/08/04 16:26:27 | 000,000,000 | ---D | C] -- C:\Program Files\The Weather Channel FW
    [2011/08/04 09:12:47 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
    [2011/08/03 14:42:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\FxsTmp
    [2011/08/03 10:01:52 | 000,000,000 | -HSD | C] -- C:\RECYCLER
    [2011/08/03 08:54:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kenneth\Application Data\PriceGong
    [2011/08/03 08:12:08 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2011/08/03 08:07:12 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2011/08/03 08:07:12 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2011/08/03 08:07:12 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2011/08/03 08:07:12 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2011/08/03 08:06:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2011/08/03 08:06:35 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/08/03 08:04:40 | 004,163,262 | R--- | C] (Swearware) -- C:\Documents and Settings\Kenneth\Desktop\ComboFix.exe
    [2011/07/31 19:41:37 | 000,000,000 | ---D | C] -- C:\System Cleaners
    [2011/07/30 16:20:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kenneth\Application Data\Malwarebytes
    [2011/07/30 16:20:50 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2011/07/30 16:20:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2011/07/30 16:20:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2011/07/30 16:20:45 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2011/07/30 16:20:44 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2011/07/29 09:27:15 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
    [2011/07/20 10:09:52 | 000,000,000 | ---D | C] -- C:\ftm
    [2011/07/19 19:29:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie7updates
    [2011/07/19 19:26:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\WBEM
    [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2011/08/06 08:11:03 | 000,000,888 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2011/08/06 07:59:36 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\OTL.exe
    [2011/08/06 06:50:59 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2216002632-2257328244-1610888821-1006.job
    [2011/08/06 06:50:46 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2011/08/06 06:49:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2011/08/06 06:49:44 | 534,827,008 | -HS- | M] () -- C:\hiberfil.sys
    [2011/08/05 17:34:30 | 000,000,082 | ---- | M] () -- C:\WINDOWS\MPLAYER.INI
    [2011/08/05 15:17:30 | 000,000,608 | ---- | M] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to notepad.lnk
    [2011/08/05 14:05:16 | 000,000,584 | ---- | M] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\mspaint.lnk
    [2011/08/05 14:02:20 | 000,001,010 | ---- | M] () -- C:\WINDOWS\Ulead32.ini
    [2011/08/05 13:22:32 | 000,014,679 | ---- | M] () -- C:\WINDOWS\System32\LexFiles.ulf
    [2011/08/05 09:30:57 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2011/08/04 17:07:43 | 000,000,290 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2216002632-2257328244-1610888821-1006.job
    [2011/08/04 16:33:06 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2011/08/03 19:55:12 | 000,039,605 | ---- | M] () -- C:\Documents and Settings\Kenneth\Desktop\bootkit_remover.rar
    [2011/08/03 16:02:30 | 000,001,071 | ---- | M] () -- C:\WINDOWS\AWMODEM.INF
    [2011/08/03 14:43:01 | 000,477,832 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2011/08/03 14:43:01 | 000,086,740 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2011/08/03 14:42:50 | 000,001,066 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf
    [2011/08/03 14:36:12 | 000,003,690 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2011/08/03 08:39:48 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2011/08/03 08:05:08 | 004,163,262 | R--- | M] (Swearware) -- C:\Documents and Settings\Kenneth\Desktop\ComboFix.exe
    [2011/07/30 16:20:50 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2011/07/30 15:49:08 | 000,000,230 | ---- | M] () -- C:\WINDOWS\System32\spupdsvc.inf
    [2011/07/29 09:27:21 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2011/07/29 09:27:20 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
    [2011/07/27 21:19:10 | 000,000,068 | ---- | M] () -- C:\WINDOWS\System32\1917917430
    [2011/07/19 17:53:08 | 000,250,288 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2011/07/19 16:21:58 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
    [2011/07/19 16:11:19 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2011/08/05 15:17:30 | 000,000,608 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to notepad.lnk
    [2011/08/05 13:19:48 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlcdvs.dll
    [2011/08/05 13:19:40 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\dlcdcoin.dll
    [2011/08/05 13:19:19 | 000,126,059 | ---- | C] () -- C:\WINDOWS\System32\dlcdceip.chm
    [2011/08/05 13:19:04 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\dlcdcnv4.dll
    [2011/08/05 13:18:18 | 000,274,432 | ---- | C] () -- C:\WINDOWS\System32\dlcdinst.dll
    [2011/08/05 13:18:16 | 000,434,176 | ---- | C] () -- C:\WINDOWS\System32\dlcdutil.dll
    [2011/08/05 13:18:12 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\dlcdjswr.dll
    [2011/08/05 13:18:11 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\dlcdinsb.dll
    [2011/08/05 13:18:11 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\dlcdinsr.dll
    [2011/08/05 13:18:10 | 000,257,112 | ---- | C] () -- C:\WINDOWS\System32\dlcdhelp.chm
    [2011/08/05 13:18:10 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\dlcdins.dll
    [2011/08/05 13:18:08 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dlcdcub.dll
    [2011/08/05 13:18:07 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\dlcdcu.dll
    [2011/08/05 13:18:07 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\dlcdcur.dll
    [2011/08/05 13:18:04 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\dlcdcfg.dll
    [2011/08/05 13:18:04 | 000,002,123 | ---- | C] () -- C:\WINDOWS\System32\dlcd.loc
    [2011/08/03 19:55:09 | 000,039,605 | ---- | C] () -- C:\Documents and Settings\Kenneth\Desktop\bootkit_remover.rar
    [2011/08/03 14:42:24 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
    [2011/08/03 14:42:24 | 000,001,361 | ---- | C] () -- C:\WINDOWS\System32\fxscount.h
    [2011/08/03 08:12:21 | 000,000,211 | ---- | C] () -- C:\Boot.bak
    [2011/08/03 08:12:19 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2011/08/03 08:07:12 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2011/08/03 08:07:12 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2011/08/03 08:07:12 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2011/08/03 08:07:12 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2011/08/03 08:07:12 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2011/07/30 16:20:50 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2011/07/30 15:49:08 | 000,000,230 | ---- | C] () -- C:\WINDOWS\System32\spupdsvc.inf
    [2011/07/29 09:27:21 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2011/07/29 09:27:20 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
    [2011/07/29 09:27:20 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
    [2011/07/27 21:19:08 | 000,000,068 | ---- | C] () -- C:\WINDOWS\System32\1917917430
    [2009/06/08 07:47:10 | 000,118,784 | ---- | C] () -- C:\WINDOWS\GREUninstall.exe
    [2008/03/05 09:09:33 | 000,003,072 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\DMX.bmk
    [2007/05/18 14:39:36 | 000,000,184 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
    [2007/02/05 16:27:01 | 000,000,088 | RHS- | C] () -- C:\WINDOWS\System32\2F2E35F313.sys
    [2006/07/16 18:51:35 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
    [2006/07/15 14:56:49 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
    [2006/02/12 17:13:29 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\PFP120JPR.{PB
    [2006/02/12 17:13:29 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\PFP120JCM.{PB
    [2006/02/08 19:38:30 | 000,011,776 | ---- | C] () -- C:\Documents and Settings\Kenneth\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2006/02/07 12:33:28 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\Kenneth\Local Settings\Application Data\fusioncache.dat
    [2006/02/06 18:44:22 | 000,002,560 | ---- | C] () -- C:\WINDOWS\_MSRSTRT.EXE
    [2006/02/01 09:19:03 | 000,000,031 | ---- | C] () -- C:\WINDOWS\MSBACKUP.INI
    [2006/01/17 12:52:38 | 000,000,024 | ---- | C] () -- C:\WINDOWS\SOL.INI
    [2006/01/11 18:38:37 | 000,001,010 | ---- | C] () -- C:\WINDOWS\Ulead32.ini
    [2006/01/10 16:11:03 | 000,000,225 | ---- | C] () -- C:\WINDOWS\netscape.INI
    [2006/01/10 10:05:46 | 000,634,087 | ---- | C] () -- C:\WINDOWS\cd32.exe
    [2006/01/05 16:45:56 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
    [2006/01/04 19:42:46 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Kenneth\Local Settings\Application Data\FASTWiz.html
    [2006/01/03 16:34:13 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\CNMVS3m.DLL
    [2006/01/02 16:53:44 | 000,000,825 | ---- | C] () -- C:\WINDOWS\Solitaire.ini
    [2005/12/31 16:28:59 | 000,003,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\BANTExt.sys
    [2005/12/31 09:58:19 | 000,019,446 | ---- | C] () -- C:\WINDOWS\mozver.dat
    [2005/12/30 20:29:15 | 000,000,104 | RHS- | C] () -- C:\WINDOWS\System32\13F3352E2F.sys
    [2005/12/30 20:29:14 | 000,004,184 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
    [2005/12/29 14:56:56 | 000,000,082 | ---- | C] () -- C:\WINDOWS\MPLAYER.INI
    [2005/12/26 15:38:13 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2005/12/26 15:31:00 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
    [2005/12/26 15:24:56 | 000,000,552 | ---- | C] () -- C:\WINDOWS\wininit.ini
    [2005/12/26 15:23:19 | 000,060,564 | ---- | C] () -- C:\WINDOWS\nsreg.dat
    [2005/12/26 15:00:02 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
    [2005/12/26 14:59:44 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
    [2005/12/26 14:59:42 | 000,000,392 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
    [2005/05/19 19:05:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
    [2004/08/10 15:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
    [2004/08/10 15:07:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
    [2004/08/10 15:02:15 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
    [2004/08/10 14:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2004/08/10 14:57:15 | 000,250,288 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2004/08/10 14:51:22 | 000,088,064 | ---- | C] () -- C:\WINDOWS\System32\msn17289.dll
    [2004/08/10 14:51:21 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
    [2004/08/10 14:51:20 | 000,477,832 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
    [2004/08/10 14:51:20 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
    [2004/08/10 14:51:20 | 000,086,740 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
    [2004/08/10 14:51:20 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
    [2004/08/10 14:51:18 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
    [2004/08/10 14:51:17 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
    [2004/08/10 14:51:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
    [2004/08/10 14:51:12 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
    [2004/08/10 14:51:11 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
    [2004/08/10 14:51:05 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
    [2004/08/10 14:50:56 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
    [1996/12/09 01:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
    [1996/12/09 01:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL

    ========== LOP Check ==========

    [2006/01/02 17:08:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\Bot Productions
    [2005/12/29 18:48:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\Leadertech
    [2007/04/01 13:56:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\MSNInstaller
    [2006/01/21 16:55:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\MyFamily.com
    [2010/09/24 19:18:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\NCH Swift Sound
    [2005/12/31 09:51:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\Netscape
    [2011/08/04 17:07:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\PriceGong
    [2010/10/19 17:36:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\Toolbar4
    [2010/09/12 08:33:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
    [2010/09/24 19:18:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
    [2005/12/29 14:45:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Netscape Internet Service
    [2010/12/11 20:08:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SpeedBit
    [2008/01/31 09:04:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
    [2005/12/26 15:24:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
    [2007/08/05 07:27:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\YAHOO
    [2010/10/01 09:39:01 | 000,000,286 | ---- | M] () -- C:\WINDOWS\Tasks\wavepadShakeIcon.job

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2005/12/31 12:35:41 | 000,000,018 | ---- | M] () -- C:\AUTOEXEC.BAT
    [2004/08/10 15:04:08 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BIT
    [2007/07/04 07:51:58 | 000,000,211 | ---- | M] () -- C:\Boot.bak
    [2011/08/05 09:30:57 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
    [2004/08/10 15:04:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2009/03/10 20:15:24 | 001,742,629 | ---- | M] () -- C:\Correct_Way_to_Arrest_a_Terrorist-1.wmv
    [2005/12/26 15:04:14 | 000,005,499 | RH-- | M] () -- C:\dell.sdr
    [2011/08/05 13:01:53 | 000,161,983 | ---- | M] () -- C:\dlcd.log
    [2011/08/05 12:29:05 | 000,182,774 | ---- | M] () -- C:\dlcdscan.log
    [2011/08/06 06:49:44 | 534,827,008 | -HS- | M] () -- C:\hiberfil.sys
    [2006/01/03 12:17:17 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
    [2004/08/10 15:04:08 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
    [2005/12/26 15:24:40 | 000,000,831 | -H-- | M] () -- C:\IPH.PH
    [2004/08/10 15:04:08 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
    [2004/08/04 07:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2008/09/04 10:52:45 | 000,250,048 | RHS- | M] () -- C:\ntldr
    [2011/08/06 06:49:33 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys
    [2005/12/26 15:24:52 | 000,000,087 | ---- | M] () -- C:\SystemInfo.ini
    [2007/07/02 19:13:47 | 000,005,202 | ---- | M] () -- C:\tasklist.txt
    [2007/08/06 07:23:19 | 000,000,150 | ---- | M] () -- C:\YServer.txt

    < %systemroot%\Fonts\*.com >
    [2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
    [2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
    [2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
    [2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2004/08/10 15:03:42 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2002/02/12 00:00:00 | 000,013,824 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD3m.DLL
    [2002/02/12 00:00:00 | 000,043,008 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP3m.DLL
    [2006/11/27 05:09:18 | 000,118,272 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\dlcdPP5C.DLL
    [2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
    [2008/07/06 06:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [2011/07/04 07:43:53 | 000,040,112 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
    [1997/06/20 16:04:18 | 000,011,264 | ---- | M] (Ulead Systems, Inc.) -- C:\WINDOWS\Ulead iPhoto Express.SCR
    [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2011/08/05 13:57:40 | 000,437,248 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mspaint.exe

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2004/08/10 14:56:48 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
    [2004/08/10 14:56:46 | 000,634,880 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
    [2004/08/10 14:56:46 | 000,872,448 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2009/03/26 09:48:21 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2009/03/26 09:59:32 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
    [2004/08/10 15:08:38 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >
    [2011/08/03 08:05:08 | 004,163,262 | R--- | M] (Swearware) -- C:\Documents and Settings\Kenneth\Desktop\ComboFix.exe
    [2011/08/06 07:59:36 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\OTL.exe
    [2010/09/01 15:33:49 | 000,083,968 | ---- | M] (eSage Lab) -- C:\Documents and Settings\Kenneth\Desktop\remover.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >
    [2004/08/04 08:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\ADDINS\fxsext.ecf

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2009/03/26 09:59:32 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Kenneth\Favorites\Desktop.ini
    [2006/03/22 11:05:59 | 000,000,409 | ---- | M] () -- C:\Documents and Settings\Kenneth\Favorites\My Documents.lnk
    [2010/09/24 19:18:24 | 000,000,236 | ---- | M] () -- C:\Documents and Settings\Kenneth\Favorites\NCH Audio and Telephony Software.lnk

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >
    [1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2011/07/22 11:02:09 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\Kenneth\Cookies\desktop.ini
    [2011/08/06 06:49:53 | 000,360,448 | ---- | M] () -- C:\Documents and Settings\Kenneth\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2004/09/15 14:27:54 | 000,192,512 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2008/04/13 20:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2004/08/04 03:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2004/08/04 03:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2008/05/02 10:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2008/04/13 13:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2008/04/13 20:12:28 | 001,695,232 | -HS- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
    [2004/08/04 03:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2004/08/04 03:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2004/08/04 03:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
    [2004/08/04 03:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
    [2004/08/04 03:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    < End of report >
     
    Ken,
    #24
  6. 2011/08/06
    Ken

    Ken Well-Known Member Thread Starter

    Joined:
    2006/01/10
    Messages:
    241
    Likes Received:
    0
    Ran OTL.
    OTL logfile created on: 8/6/2011 8:02:13 AM - Run 1
    OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\Kenneth\Desktop
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.5512)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    509.98 Mb Total Physical Memory | 282.04 Mb Available Physical Memory | 55.30% Memory free
    1.22 Gb Paging File | 0.91 Gb Available in Paging File | 74.78% Paging File free
    Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 71.46 Gb Total Space | 46.44 Gb Free Space | 64.99% Space Free | Partition Type: NTFS

    Computer Name: KGBNEW | User Name: Kenneth | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011/08/06 07:59:36 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\OTL.exe
    PRC - [2011/07/06 19:52:38 | 000,449,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    PRC - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    PRC - [2011/07/04 07:43:54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    PRC - [2011/07/04 07:43:51 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    PRC - [2011/05/20 11:28:44 | 000,273,544 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
    PRC - [2010/08/23 21:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    PRC - [2009/05/21 10:55:32 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    PRC - [2008/08/13 19:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2007/01/16 23:36:48 | 000,304,624 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 944\memcard.exe
    PRC - [2007/01/16 23:36:28 | 000,431,600 | ---- | M] (Dell) -- C:\Program Files\Dell Photo AIO Printer 944\dlcdmon.exe
    PRC - [2007/01/16 23:34:36 | 000,538,096 | ---- | M] ( ) -- C:\WINDOWS\system32\dlcdcoms.exe


    ========== Modules (SafeList) ==========

    MOD - [2011/08/06 07:59:36 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\OTL.exe
    MOD - [2011/07/04 07:43:51 | 000,199,792 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll
    MOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [Disabled | Stopped] -- -- (HidServ)
    SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
    SRV - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
    SRV - [2011/07/04 07:43:51 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
    SRV - [2010/08/23 21:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
    SRV - [2008/08/13 19:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
    SRV - [2007/03/07 15:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
    SRV - [2007/01/16 23:34:36 | 000,538,096 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\dlcdcoms.exe -- (dlcd_device)
    SRV - [2006/12/11 22:16:32 | 000,064,248 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe -- (Roxio UPnP Renderer 9)
    SRV - [2006/12/11 22:16:28 | 000,301,816 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe -- (Roxio Upnp Server 9)


    ========== Driver Services (SafeList) ==========

    DRV - [2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
    DRV - [2011/07/04 07:36:43 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
    DRV - [2011/07/04 07:36:32 | 000,309,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
    DRV - [2011/07/04 07:35:23 | 000,043,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
    DRV - [2011/07/04 07:35:12 | 000,102,616 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
    DRV - [2011/07/04 07:32:32 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
    DRV - [2011/07/04 07:32:13 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
    DRV - [2011/07/04 07:32:12 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV - [2010/02/11 08:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
    DRV - [2007/02/25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
    DRV - [2006/10/05 16:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
    DRV - [2005/04/07 17:18:34 | 000,003,840 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\BANTExt.sys -- (BANTExt)
    DRV - [2004/09/17 16:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
    DRV - [2004/06/16 05:52:40 | 000,061,157 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC53.sys -- (IntelC53)
    DRV - [2004/03/06 06:15:34 | 000,647,929 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC52.sys -- (IntelC52)
    DRV - [2004/03/06 06:14:42 | 001,233,525 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC51.sys -- (IntelC51)
    DRV - [2004/03/06 06:13:38 | 000,037,048 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mohfilt.sys -- (mohfilt)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://www.google.com/ig/dell?hl=en



    IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en
    IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = AB 4E EA 0C 33 31 8E 48 A7 2D 02 F8 4E BF B8 A8 [binary data]
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en
    IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = AB 4E EA 0C 33 31 8E 48 A7 2D 02 F8 4E BF B8 A8 [binary data]
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = AB 4E EA 0C 33 31 8E 48 A7 2D 02 F8 4E BF B8 A8 [binary data]

    IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = AB 4E EA 0C 33 31 8E 48 A7 2D 02 F8 4E BF B8 A8 [binary data]

    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = AB 4E EA 0C 33 31 8E 48 A7 2D 02 F8 4E BF B8 A8 [binary data]
    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1

    ========== FireFox ==========


    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
    FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.647: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.647: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/05/20 11:29:44 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/29 09:27:17 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
    FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.2\extensions\\Components: C:\Program Files\SeaMonkey\components [2011/07/22 07:42:32 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.2\extensions\\Plugins: C:\Program Files\SeaMonkey\plugins [2011/07/22 07:42:32 | 000,000,000 | ---D | M]

    [2009/11/02 18:57:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kenneth\Application Data\Mozilla\Extensions
    [2009/11/02 18:57:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kenneth\Application Data\Mozilla\Extensions\{92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
    [2011/08/03 08:38:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kenneth\Application Data\Mozilla\Firefox\Profiles\8wzp06h5.default\extensions
    [2011/07/23 08:28:55 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kenneth\Application Data\Mozilla\SeaMonkey\Profiles\1d93tk2p.default\extensions
    [2011/07/29 09:27:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    File not found (No name found) --
    [2010/05/26 08:36:25 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
    [2009/09/01 20:34:32 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
    [2011/07/08 03:16:28 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
    [2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

    O1 HOSTS File: ([2011/08/03 08:39:48 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (SBCONVERT Class) - {3017FB3E-9A77-4396-88C5-0EC9548FB42F} - C:\Program Files\SpeedBit Video Downloader\TBUB2\tbcore3.dll ()
    O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
    O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
    O2 - BHO: (SearchPredictObj Class) - {389943B0-C3A2-4E69-82CB-8596A84CB3DC} - C:\Program Files\SearchPredict\SearchPredict.dll (Speedbit Ltd.)
    O2 - BHO: (Softonic-Eng7 Toolbar) - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
    O2 - BHO: (SBCONVERT Class) - {A1056498-D09A-41E4-864B-505EDD640D9E} - C:\Program Files\SpeedBit Video Downloader\Toolbar\SpeedBitVideoDownloader.dll ()
    O2 - BHO: (no name) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - No CLSID value found.
    O2 - BHO: (GrabberObj Class) - {FF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\SpeedBit Video Downloader\TBUB2\Grabber.dll (Speedbit Ltd.)
    O3 - HKLM\..\Toolbar: (SpeedBit Video Downloader) - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - C:\Program Files\SpeedBit Video Downloader\TBUB2\tbcore3.dll ()
    O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
    O3 - HKLM\..\Toolbar: (Softonic-Eng7 Toolbar) - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    O3 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..\Toolbar\ShellBrowser: (SpeedBit Video Downloader) - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - C:\Program Files\SpeedBit Video Downloader\TBUB2\tbcore3.dll ()
    O3 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..\Toolbar\ShellBrowser: (Softonic-Eng7 Toolbar) - {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    O3 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..\Toolbar\WebBrowser: (SpeedBit Video Downloader) - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - C:\Program Files\SpeedBit Video Downloader\TBUB2\tbcore3.dll ()
    O3 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..\Toolbar\WebBrowser: (Softonic-Eng7 Toolbar) - {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
    O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
    O4 - HKLM..\Run: [DLCDCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCDtime.DLL ()
    O4 - HKLM..\Run: [dlcdmon.exe] C:\Program Files\Dell Photo AIO Printer 944\dlcdmon.exe (Dell)
    O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
    O4 - HKLM..\Run: [KernelFaultCheck] File not found
    O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
    O4 - HKLM..\Run: [MemoryCardManager] C:\Program Files\Dell Photo AIO Printer 944\memcard.exe ()
    O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
    O4 - Startup: C:\Documents and Settings\Kenneth\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKU\##aswSnx private storage\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O15 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..Trusted Domains: aol.com ([free] http in Trusted sites)
    O15 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
    O15 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..Trusted Domains: turbotax.com ([]https in Trusted sites)
    O16 - DPF: {4EC99A0B-E57C-4FBE-B9C4-8428424FBF88} http://supportcenter.verizon.net/euserv/jsp/VOLAWeb.cab (McciUtilsSpecialFolder Class)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {DB0474CC-8EF6-47FC-905B-23FC58A70817} https://download.verizon.net/sfp/Cabs/hst/webinstall/HstWebInstall.cab (RegPropsCtrl Class)
    O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
    O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2005/12/31 12:35:41 | 000,000,018 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O32 - AutoRun File - [2004/08/10 15:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BIT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: AppMgmt - File not found
    NetSvcs: HidServ - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
    Drivers32: wave - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/08/06 07:59:16 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\OTL.exe
    [2011/08/05 13:57:33 | 000,437,248 | ---- | C] (Microsoft Corporation) -- C:\Program Files\mspaint.exe
    [2011/08/05 13:19:05 | 000,413,696 | ---- | C] (Dell) -- C:\WINDOWS\System32\dlcddrs.dll
    [2011/08/05 13:19:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Dell Printers
    [2011/08/05 13:18:59 | 000,000,000 | ---D | C] -- C:\Program Files\Dell Photo AIO Printer 944
    [2011/08/05 13:18:18 | 000,323,584 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdhcp.dll
    [2011/08/05 13:18:17 | 000,413,696 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdinpa.dll
    [2011/08/05 13:18:17 | 000,397,312 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdiesc.dll
    [2011/08/05 13:18:15 | 001,224,704 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdserv.dll
    [2011/08/05 13:18:15 | 000,991,232 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdusb1.dll
    [2011/08/05 13:18:14 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdprox.dll
    [2011/08/05 13:18:14 | 000,094,208 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdpplc.dll
    [2011/08/05 13:18:13 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdpmui.dll
    [2011/08/05 13:18:12 | 000,585,728 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdlmpm.dll
    [2011/08/05 13:18:10 | 000,386,544 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdih.exe
    [2011/08/05 13:18:09 | 000,696,320 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdhbn3.dll
    [2011/08/05 13:18:07 | 000,538,096 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdcoms.exe
    [2011/08/05 13:18:06 | 000,421,888 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdcomm.dll
    [2011/08/05 13:18:05 | 000,684,032 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdcomc.dll
    [2011/08/05 13:18:05 | 000,382,448 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdcfg.exe
    [2011/08/05 07:05:03 | 000,000,000 | ---D | C] -- C:\spoolerlogs
    [2011/08/04 18:39:15 | 000,083,968 | ---- | C] (eSage Lab) -- C:\Documents and Settings\Kenneth\Desktop\remover.exe
    [2011/08/04 18:38:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip
    [2011/08/04 16:26:32 | 000,000,000 | ---D | C] -- C:\Program Files\Carbonite
    [2011/08/04 16:26:32 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
    [2011/08/04 16:26:31 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ODBC
    [2011/08/04 16:26:31 | 000,000,000 | ---D | C] -- C:\Program Files\ComPlus Applications
    [2011/08/04 16:26:28 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
    [2011/08/04 16:26:28 | 000,000,000 | ---D | C] -- C:\Program Files\MSN
    [2011/08/04 16:26:28 | 000,000,000 | ---D | C] -- C:\Program Files\Motive
    [2011/08/04 16:26:27 | 000,000,000 | -H-D | C] -- C:\Program Files\Uninstall Information
    [2011/08/04 16:26:27 | 000,000,000 | ---D | C] -- C:\Program Files\Users
    [2011/08/04 16:26:27 | 000,000,000 | ---D | C] -- C:\Program Files\The Weather Channel FW
    [2011/08/04 09:12:47 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
    [2011/08/03 14:42:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\FxsTmp
    [2011/08/03 10:01:52 | 000,000,000 | -HSD | C] -- C:\RECYCLER
    [2011/08/03 08:54:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kenneth\Application Data\PriceGong
    [2011/08/03 08:12:08 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2011/08/03 08:07:12 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2011/08/03 08:07:12 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2011/08/03 08:07:12 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2011/08/03 08:07:12 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2011/08/03 08:06:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2011/08/03 08:06:35 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/08/03 08:04:40 | 004,163,262 | R--- | C] (Swearware) -- C:\Documents and Settings\Kenneth\Desktop\ComboFix.exe
    [2011/07/31 19:41:37 | 000,000,000 | ---D | C] -- C:\System Cleaners
    [2011/07/30 16:20:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kenneth\Application Data\Malwarebytes
    [2011/07/30 16:20:50 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2011/07/30 16:20:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2011/07/30 16:20:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2011/07/30 16:20:45 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2011/07/30 16:20:44 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2011/07/29 09:27:15 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
    [2011/07/20 10:09:52 | 000,000,000 | ---D | C] -- C:\ftm
    [2011/07/19 19:29:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie7updates
    [2011/07/19 19:26:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\WBEM
    [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2011/08/06 08:11:03 | 000,000,888 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2011/08/06 07:59:36 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\OTL.exe
    [2011/08/06 06:50:59 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2216002632-2257328244-1610888821-1006.job
    [2011/08/06 06:50:46 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2011/08/06 06:49:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2011/08/06 06:49:44 | 534,827,008 | -HS- | M] () -- C:\hiberfil.sys
    [2011/08/05 17:34:30 | 000,000,082 | ---- | M] () -- C:\WINDOWS\MPLAYER.INI
    [2011/08/05 15:17:30 | 000,000,608 | ---- | M] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to notepad.lnk
    [2011/08/05 14:05:16 | 000,000,584 | ---- | M] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\mspaint.lnk
    [2011/08/05 14:02:20 | 000,001,010 | ---- | M] () -- C:\WINDOWS\Ulead32.ini
    [2011/08/05 13:22:32 | 000,014,679 | ---- | M] () -- C:\WINDOWS\System32\LexFiles.ulf
    [2011/08/05 09:30:57 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2011/08/04 17:07:43 | 000,000,290 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2216002632-2257328244-1610888821-1006.job
    [2011/08/04 16:33:06 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2011/08/03 19:55:12 | 000,039,605 | ---- | M] () -- C:\Documents and Settings\Kenneth\Desktop\bootkit_remover.rar
    [2011/08/03 16:02:30 | 000,001,071 | ---- | M] () -- C:\WINDOWS\AWMODEM.INF
    [2011/08/03 14:43:01 | 000,477,832 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2011/08/03 14:43:01 | 000,086,740 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2011/08/03 14:42:50 | 000,001,066 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf
    [2011/08/03 14:36:12 | 000,003,690 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2011/08/03 08:39:48 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2011/08/03 08:05:08 | 004,163,262 | R--- | M] (Swearware) -- C:\Documents and Settings\Kenneth\Desktop\ComboFix.exe
    [2011/07/30 16:20:50 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2011/07/30 15:49:08 | 000,000,230 | ---- | M] () -- C:\WINDOWS\System32\spupdsvc.inf
    [2011/07/29 09:27:21 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2011/07/29 09:27:20 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
    [2011/07/27 21:19:10 | 000,000,068 | ---- | M] () -- C:\WINDOWS\System32\1917917430
    [2011/07/19 17:53:08 | 000,250,288 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2011/07/19 16:21:58 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
    [2011/07/19 16:11:19 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2011/08/05 15:17:30 | 000,000,608 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to notepad.lnk
    [2011/08/05 13:19:48 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlcdvs.dll
    [2011/08/05 13:19:40 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\dlcdcoin.dll
    [2011/08/05 13:19:19 | 000,126,059 | ---- | C] () -- C:\WINDOWS\System32\dlcdceip.chm
    [2011/08/05 13:19:04 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\dlcdcnv4.dll
    [2011/08/05 13:18:18 | 000,274,432 | ---- | C] () -- C:\WINDOWS\System32\dlcdinst.dll
    [2011/08/05 13:18:16 | 000,434,176 | ---- | C] () -- C:\WINDOWS\System32\dlcdutil.dll
    [2011/08/05 13:18:12 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\dlcdjswr.dll
    [2011/08/05 13:18:11 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\dlcdinsb.dll
    [2011/08/05 13:18:11 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\dlcdinsr.dll
    [2011/08/05 13:18:10 | 000,257,112 | ---- | C] () -- C:\WINDOWS\System32\dlcdhelp.chm
    [2011/08/05 13:18:10 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\dlcdins.dll
    [2011/08/05 13:18:08 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dlcdcub.dll
    [2011/08/05 13:18:07 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\dlcdcu.dll
    [2011/08/05 13:18:07 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\dlcdcur.dll
    [2011/08/05 13:18:04 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\dlcdcfg.dll
    [2011/08/05 13:18:04 | 000,002,123 | ---- | C] () -- C:\WINDOWS\System32\dlcd.loc
    [2011/08/03 19:55:09 | 000,039,605 | ---- | C] () -- C:\Documents and Settings\Kenneth\Desktop\bootkit_remover.rar
    [2011/08/03 14:42:24 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
    [2011/08/03 14:42:24 | 000,001,361 | ---- | C] () -- C:\WINDOWS\System32\fxscount.h
    [2011/08/03 08:12:21 | 000,000,211 | ---- | C] () -- C:\Boot.bak
    [2011/08/03 08:12:19 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2011/08/03 08:07:12 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2011/08/03 08:07:12 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2011/08/03 08:07:12 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2011/08/03 08:07:12 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2011/08/03 08:07:12 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2011/07/30 16:20:50 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2011/07/30 15:49:08 | 000,000,230 | ---- | C] () -- C:\WINDOWS\System32\spupdsvc.inf
    [2011/07/29 09:27:21 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2011/07/29 09:27:20 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
    [2011/07/29 09:27:20 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
    [2011/07/27 21:19:08 | 000,000,068 | ---- | C] () -- C:\WINDOWS\System32\1917917430
    [2009/06/08 07:47:10 | 000,118,784 | ---- | C] () -- C:\WINDOWS\GREUninstall.exe
    [2008/03/05 09:09:33 | 000,003,072 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\DMX.bmk
    [2007/05/18 14:39:36 | 000,000,184 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
    [2007/02/05 16:27:01 | 000,000,088 | RHS- | C] () -- C:\WINDOWS\System32\2F2E35F313.sys
    [2006/07/16 18:51:35 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
    [2006/07/15 14:56:49 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
    [2006/02/12 17:13:29 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\PFP120JPR.{PB
    [2006/02/12 17:13:29 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\PFP120JCM.{PB
    [2006/02/08 19:38:30 | 000,011,776 | ---- | C] () -- C:\Documents and Settings\Kenneth\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2006/02/07 12:33:28 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\Kenneth\Local Settings\Application Data\fusioncache.dat
    [2006/02/06 18:44:22 | 000,002,560 | ---- | C] () -- C:\WINDOWS\_MSRSTRT.EXE
    [2006/02/01 09:19:03 | 000,000,031 | ---- | C] () -- C:\WINDOWS\MSBACKUP.INI
    [2006/01/17 12:52:38 | 000,000,024 | ---- | C] () -- C:\WINDOWS\SOL.INI
    [2006/01/11 18:38:37 | 000,001,010 | ---- | C] () -- C:\WINDOWS\Ulead32.ini
    [2006/01/10 16:11:03 | 000,000,225 | ---- | C] () -- C:\WINDOWS\netscape.INI
    [2006/01/10 10:05:46 | 000,634,087 | ---- | C] () -- C:\WINDOWS\cd32.exe
    [2006/01/05 16:45:56 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
    [2006/01/04 19:42:46 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Kenneth\Local Settings\Application Data\FASTWiz.html
    [2006/01/03 16:34:13 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\CNMVS3m.DLL
    [2006/01/02 16:53:44 | 000,000,825 | ---- | C] () -- C:\WINDOWS\Solitaire.ini
    [2005/12/31 16:28:59 | 000,003,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\BANTExt.sys
    [2005/12/31 09:58:19 | 000,019,446 | ---- | C] () -- C:\WINDOWS\mozver.dat
    [2005/12/30 20:29:15 | 000,000,104 | RHS- | C] () -- C:\WINDOWS\System32\13F3352E2F.sys
    [2005/12/30 20:29:14 | 000,004,184 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
    [2005/12/29 14:56:56 | 000,000,082 | ---- | C] () -- C:\WINDOWS\MPLAYER.INI
    [2005/12/26 15:38:13 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2005/12/26 15:31:00 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
    [2005/12/26 15:24:56 | 000,000,552 | ---- | C] () -- C:\WINDOWS\wininit.ini
    [2005/12/26 15:23:19 | 000,060,564 | ---- | C] () -- C:\WINDOWS\nsreg.dat
    [2005/12/26 15:00:02 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
    [2005/12/26 14:59:44 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
    [2005/12/26 14:59:42 | 000,000,392 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
    [2005/05/19 19:05:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
    [2004/08/10 15:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
    [2004/08/10 15:07:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
    [2004/08/10 15:02:15 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
    [2004/08/10 14:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2004/08/10 14:57:15 | 000,250,288 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2004/08/10 14:51:22 | 000,088,064 | ---- | C] () -- C:\WINDOWS\System32\msn17289.dll
    [2004/08/10 14:51:21 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
    [2004/08/10 14:51:20 | 000,477,832 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
    [2004/08/10 14:51:20 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
    [2004/08/10 14:51:20 | 000,086,740 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
    [2004/08/10 14:51:20 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
    [2004/08/10 14:51:18 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
    [2004/08/10 14:51:17 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
    [2004/08/10 14:51:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
    [2004/08/10 14:51:12 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
    [2004/08/10 14:51:11 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
    [2004/08/10 14:51:05 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
    [2004/08/10 14:50:56 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
    [1996/12/09 01:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
    [1996/12/09 01:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL

    ========== LOP Check ==========

    [2006/01/02 17:08:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\Bot Productions
    [2005/12/29 18:48:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\Leadertech
    [2007/04/01 13:56:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\MSNInstaller
    [2006/01/21 16:55:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\MyFamily.com
    [2010/09/24 19:18:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\NCH Swift Sound
    [2005/12/31 09:51:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\Netscape
    [2011/08/04 17:07:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\PriceGong
    [2010/10/19 17:36:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\Toolbar4
    [2010/09/12 08:33:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
    [2010/09/24 19:18:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
    [2005/12/29 14:45:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Netscape Internet Service
    [2010/12/11 20:08:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SpeedBit
    [2008/01/31 09:04:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
    [2005/12/26 15:24:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
    [2007/08/05 07:27:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\YAHOO
    [2010/10/01 09:39:01 | 000,000,286 | ---- | M] () -- C:\WINDOWS\Tasks\wavepadShakeIcon.job

    ========== Purity Check ==========
     
    Ken,
    #25
  7. 2011/08/06
    Ken

    Ken Well-Known Member Thread Starter

    Joined:
    2006/01/10
    Messages:
    241
    Likes Received:
    0
    More OTL.txt
    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2005/12/31 12:35:41 | 000,000,018 | ---- | M] () -- C:\AUTOEXEC.BAT
    [2004/08/10 15:04:08 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BIT
    [2007/07/04 07:51:58 | 000,000,211 | ---- | M] () -- C:\Boot.bak
    [2011/08/05 09:30:57 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
    [2004/08/10 15:04:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2009/03/10 20:15:24 | 001,742,629 | ---- | M] () -- C:\Correct_Way_to_Arrest_a_Terrorist-1.wmv
    [2005/12/26 15:04:14 | 000,005,499 | RH-- | M] () -- C:\dell.sdr
    [2011/08/05 13:01:53 | 000,161,983 | ---- | M] () -- C:\dlcd.log
    [2011/08/05 12:29:05 | 000,182,774 | ---- | M] () -- C:\dlcdscan.log
    [2011/08/06 06:49:44 | 534,827,008 | -HS- | M] () -- C:\hiberfil.sys
    [2006/01/03 12:17:17 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
    [2004/08/10 15:04:08 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
    [2005/12/26 15:24:40 | 000,000,831 | -H-- | M] () -- C:\IPH.PH
    [2004/08/10 15:04:08 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
    [2004/08/04 07:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2008/09/04 10:52:45 | 000,250,048 | RHS- | M] () -- C:\ntldr
    [2011/08/06 06:49:33 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys
    [2005/12/26 15:24:52 | 000,000,087 | ---- | M] () -- C:\SystemInfo.ini
    [2007/07/02 19:13:47 | 000,005,202 | ---- | M] () -- C:\tasklist.txt
    [2007/08/06 07:23:19 | 000,000,150 | ---- | M] () -- C:\YServer.txt

    < %systemroot%\Fonts\*.com >
    [2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
    [2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
    [2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
    [2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2004/08/10 15:03:42 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2002/02/12 00:00:00 | 000,013,824 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD3m.DLL
    [2002/02/12 00:00:00 | 000,043,008 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP3m.DLL
    [2006/11/27 05:09:18 | 000,118,272 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\dlcdPP5C.DLL
    [2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
    [2008/07/06 06:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [2011/07/04 07:43:53 | 000,040,112 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
    [1997/06/20 16:04:18 | 000,011,264 | ---- | M] (Ulead Systems, Inc.) -- C:\WINDOWS\Ulead iPhoto Express.SCR
    [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2011/08/05 13:57:40 | 000,437,248 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mspaint.exe

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2004/08/10 14:56:48 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
    [2004/08/10 14:56:46 | 000,634,880 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
    [2004/08/10 14:56:46 | 000,872,448 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2009/03/26 09:48:21 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2009/03/26 09:59:32 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
    [2004/08/10 15:08:38 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >
    [2011/08/03 08:05:08 | 004,163,262 | R--- | M] (Swearware) -- C:\Documents and Settings\Kenneth\Desktop\ComboFix.exe
    [2011/08/06 07:59:36 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\OTL.exe
    [2010/09/01 15:33:49 | 000,083,968 | ---- | M] (eSage Lab) -- C:\Documents and Settings\Kenneth\Desktop\remover.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >
    [2004/08/04 08:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\ADDINS\fxsext.ecf

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2009/03/26 09:59:32 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Kenneth\Favorites\Desktop.ini
    [2006/03/22 11:05:59 | 000,000,409 | ---- | M] () -- C:\Documents and Settings\Kenneth\Favorites\My Documents.lnk
    [2010/09/24 19:18:24 | 000,000,236 | ---- | M] () -- C:\Documents and Settings\Kenneth\Favorites\NCH Audio and Telephony Software.lnk

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >
    [1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2011/07/22 11:02:09 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\Kenneth\Cookies\desktop.ini
    [2011/08/06 06:49:53 | 000,360,448 | ---- | M] () -- C:\Documents and Settings\Kenneth\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2004/09/15 14:27:54 | 000,192,512 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2008/04/13 20:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2004/08/04 03:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2004/08/04 03:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2008/05/02 10:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2008/04/13 13:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2008/04/13 20:12:28 | 001,695,232 | -HS- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
    [2004/08/04 03:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2004/08/04 03:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2004/08/04 03:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
    [2004/08/04 03:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
    [2004/08/04 03:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    < End of report >
     
    Ken,
    #26
  8. 2011/08/06
    Ken

    Ken Well-Known Member Thread Starter

    Joined:
    2006/01/10
    Messages:
    241
    Likes Received:
    0
    Extras.txt

    OTL Extras logfile created on: 8/6/2011 8:02:14 AM - Run 1
    OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\Kenneth\Desktop
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.5512)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    509.98 Mb Total Physical Memory | 282.04 Mb Available Physical Memory | 55.30% Memory free
    1.22 Gb Paging File | 0.91 Gb Available in Paging File | 74.78% Paging File free
    Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 71.46 Gb Total Space | 46.44 Gb Free Space | 64.99% Space Free | Partition Type: NTFS

    Computer Name: KGBNEW | User Name: Kenneth | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
    .url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

    [HKEY_USERS\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Classes\<extension>]
    .html [@ = SeaMonkeyHTML] -- C:\Program Files\SeaMonkey\seamonkey.exe (mozilla.org)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
    exefile [open] -- "%1" %*
    htmlfile [edit] -- Reg Error: Key error.
    https [open] -- C:\PROGRA~1\NETSCAPE\NETSCAPE\NETSCP.EXE -url "%1 "
    InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1 "
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22008

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL
    "C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL
    "C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe" = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Jukebox -- (Yahoo! Inc.)
    "C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax -- (Intuit, Inc.)
    "C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager -- (Intuit, Inc.)
    "C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe" = C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe:LocalSubNet:Disabled:Intuit Update Shared Downloads Server -- (Intuit Inc.)
    "C:\WINDOWS\system32\fxsclnt.exe" = C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console -- (Microsoft Corporation)
    "C:\WINDOWS\system32\dlcdcoms.exe" = C:\WINDOWS\system32\dlcdcoms.exe:*:Enabled:Dell 944 Server -- ( )


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{03DF638A-D61C-4893-B8B9-845900C03163}" = TurboTax 2010 wnyiper
    "{05BDC796-3451-4F81-B91D-E98F7ADA76C2}" = TurboTax 2010 WinPerTaxSupport
    "{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data
    "{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0
    "{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
    "{105CFC7C-6992-11D5-BD9D-000102C10FD8}" = DjVu Browser Plug-in 3.5
    "{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
    "{17334AAF-C9E7-483B-9F45-E3FCAF07FFA7}" = Intel(R) PROSet for Wired Connections
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD LE
    "{25EF00A1-F17B-11D6-88EA-000476CD2443}" = Verizon Online Support Center
    "{25EF00BE-F17B-11D6-88EA-000476CD2443}" = Verizon Online
    "{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 21
    "{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
    "{29521505-F489-4822-ADFA-32C6DEE4F114}" = TurboTax 2008 WinPerUserEducation
    "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
    "{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
    "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
    "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
    "{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{3782EC09-4000-475E-8A59-9CABD6F03B4C}" = TurboTax 2010 WinPerFedFormset
    "{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset
    "{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine
    "{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport
    "{3B8186F0-EAA2-012B-AE69-000000000000}" = TurboTax 2009 wnyiper
    "{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper
    "{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Google AFE
    "{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = Modem On Hold
    "{4192EAC0-6B36-4723-B216-D0E86E7757AC}" = Jasc Paint Shop Photo Album 5
    "{4F2FCCCF-29F3-44B9-886F-6D16F8417522}" = TurboTax 2010 wrapper
    "{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
    "{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon
    "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.5
    "{6D5FCA42-1486-4E32-AFE8-1B7E2AA59D33}" = Digital Content Portal
    "{6E179C77-7335-458D-9537-4F4EAC0181ED}" = Photo Click
    "{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
    "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
    "{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
    "{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
    "{7570F1CA-016D-46AC-B586-CD74645EFB52}" = TurboTax 2008 WinPerFedFormset
    "{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility
    "{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
    "{78C496B9-5A6B-4692-8C2E-AFFFC34E4961}" = Jasc Paint Shop Pro Studio, Dell Editon
    "{7A0EFAFB-AC4B-4B88-8C6B-6731BE88DB68}" = Modem Event Monitor
    "{7DD9A065-2C86-4A9F-A5FF-796EC1B99DCA}" = AnswerWorks 4.0 Runtime - English
    "{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
    "{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
    "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    "{88214092-836F-4E22-A5AC-569AC9EE6A0F}" = TurboTax 2008 WinPerReleaseEngine
    "{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
    "{8A9B8148-DDD7-448F-BD6C-358386D32354}" = Corel Photo Album 6
    "{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
    "{90AF0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office PowerPoint Viewer 2003
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    "{9E5A03E3-6246-4920-9630-0527D5DA9B07}" = AnswerWorks 5.0 English Runtime
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A525E00B-6609-442E-9DCD-64453C233E8D}" = TurboTax 2010 WinPerReleaseEngine
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{A9F6CFB0-806D-11E0-8EA1-B8AC6F97B88E}" = Google Earth Plug-in
    "{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio module
    "{AC0EE5B0-A8FB-4D0A-AF03-2EDC518F841B}" = Roxio Media Experience
    "{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.0)
    "{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
    "{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
    "{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy
    "{B1DB1AD8-C07E-4052-81A1-D2930232BA70}" = TurboTax 2008 wrapper
    "{B23726CF-68BF-41A6-A4EB-72F12F87FE05}" = TurboTax 2008 WinPerTaxSupport
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{C3DE07CB-036F-45BC-85BD-D6FFC5D33603}" = TurboTax 2008 wnyiper
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
    "{E6D9BC25-0DBC-4368-8E4A-7DEE80661CD9}" = TurboTax 2008 WinPerProgramHelp
    "{EC3B8CA2-49B8-4D38-BE9C-ABD0F6029168}" = Yahoo! Music Jukebox
    "{F2F4C144-7D1A-47C4-9D53-395A57B0CD64}" = Family Tree Maker 2006
    "7-Zip" = 7-Zip 9.20
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "avast" = avast! Free Antivirus
    "Belarc Advisor 2.0" = Belarc Advisor 7.0
    "CodeStuff Starter" = CodeStuff Starter
    "conduitEngine" = Conduit Engine
    "Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
    "Dell Photo AIO Printer 944" = Dell Photo AIO Printer 944
    "Excel" = Microsoft Excel 97
    "FTP Explorer" = FTP Explorer
    "FTW" = Family Tree Maker
    "iCare Data Recovery_is1" = iCare Data Recovery 4.0
    "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
    "Intel(R) 537EP V9x DF PCI Modem" = Intel(R) 537EP V9x DF PCI Modem
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Mozilla Firefox 5.0.1 (x86 en-US)" = Mozilla Firefox 5.0.1 (x86 en-US)
    "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
    "PROSet" = Intel(R) PRO Network Adapters and Drivers
    "QuickTime" = QuickTime
    "RealPlayer 12.0" = RealPlayer
    "RegVac Registry Cleaner (Trial Version)_is1" = RegVac Registry Cleaner 5.01 (Trial Version)
    "SeaMonkey (2.2)" = SeaMonkey (2.2)
    "Softonic-Eng7 Toolbar" = Softonic-Eng7 Toolbar
    "SpeedBit Video Downloader" = SpeedBit Video Downloader
    "StreetPlugin" = Learn2 Player (Uninstall Only)
    "TurboTax 2008" = TurboTax 2008
    "TurboTax 2009" = TurboTax 2009
    "TurboTax 2010" = TurboTax 2010
    "TurboTax Deluxe 2007" = TurboTax Deluxe 2007
    "Verizon SmartCall" = Verizon SmartCall
    "ViewpointMediaPlayer" = Viewpoint Media Player
    "WavePad" = WavePad Sound Editor
    "WildTangent CDA" = WildTangent Web Driver
    "Windows Media Format Runtime" = Windows Media Format Runtime
    "Windows Media Player" = Windows Media Player 10
    "Windows XP Service Pack" = Windows XP Service Pack 3
    "Word8.0" = Microsoft Word 97

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-2216002632-2257328244-1610888821-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 8/4/2011 3:54:38 PM | Computer Name = KGBNEW | Source = Application Hang | ID = 1001
    Description = Fault bucket 127877766.

    Error - 8/5/2011 7:06:27 AM | Computer Name = KGBNEW | Source = Application Error | ID = 1000
    Description = Faulting application spoolsv.exe, version 5.1.2600.6024, faulting
    module dlcdHPEC.DLL, version 2.4.61.0, fault address 0x00014dc9.

    Error - 8/5/2011 7:55:28 AM | Computer Name = KGBNEW | Source = Application Error | ID = 1000
    Description = Faulting application spoolsv.exe, version 5.1.2600.6024, faulting
    module dlcdHPEC.DLL, version 2.4.61.0, fault address 0x00014dc9.

    Error - 8/5/2011 9:35:00 AM | Computer Name = KGBNEW | Source = Application Error | ID = 1000
    Description = Faulting application spoolsv.exe, version 5.1.2600.6024, faulting
    module dlcdHPEC.DLL, version 2.4.61.0, fault address 0x00014dc9.

    Error - 8/5/2011 9:35:24 AM | Computer Name = KGBNEW | Source = Application Error | ID = 1001
    Description = Fault bucket 2052986166.

    Error - 8/5/2011 11:43:54 AM | Computer Name = KGBNEW | Source = Application Error | ID = 1000
    Description = Faulting application winword.exe, version 8.0.0.3514, faulting module
    kernel32.dll, version 5.1.2600.5781, fault address 0x0000a308.

    Error - 8/5/2011 12:45:40 PM | Computer Name = KGBNEW | Source = Application Error | ID = 1000
    Description = Faulting application dlcdaiox.exe, version 3.57.0.10, faulting module
    dlcdscw.dll, version 3.96.0.0, fault address 0x0001449e.

    Error - 8/5/2011 1:24:59 PM | Computer Name = KGBNEW | Source = Application Hang | ID = 1002
    Description = Hanging application dlcdpswx.exe, version 2.63.0.0, hang module hungapp,
    version 0.0.0.0, hang address 0x00000000.

    Error - 8/5/2011 1:28:36 PM | Computer Name = KGBNEW | Source = Application Hang | ID = 1002
    Description = Hanging application dlcdaiox.exe, version 3.57.0.10, hang module hungapp,
    version 0.0.0.0, hang address 0x00000000.

    Error - 8/5/2011 1:39:04 PM | Computer Name = KGBNEW | Source = Application Hang | ID = 1002
    Description = Hanging application dlcdaiox.exe, version 3.57.0.10, hang module hungapp,
    version 0.0.0.0, hang address 0x00000000.

    [ System Events ]
    Error - 8/5/2011 12:42:46 PM | Computer Name = KGBNEW | Source = Print | ID = 22
    Description = Failed to ugrade printer settings for printer \\KGBNEW\Dell Photo
    AIO Printer 944,LocalOnly driver C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\dlcdUI5C.DLL
    error 1114.

    Error - 8/5/2011 1:12:19 PM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the Roxio Upnp Server 9 service
    to connect.

    Error - 8/5/2011 1:12:19 PM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the Windows Image Acquisition
    (WIA) service to connect.

    Error - 8/5/2011 1:12:19 PM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7000
    Description = The Windows Image Acquisition (WIA) service failed to start due to
    the following error: %%1053

    Error - 8/6/2011 6:39:27 AM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the Roxio Upnp Server 9 service
    to connect.

    Error - 8/6/2011 6:39:27 AM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the Fax service to connect.

    Error - 8/6/2011 6:39:27 AM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7000
    Description = The Fax service failed to start due to the following error: %%1053

    Error - 8/6/2011 6:46:54 AM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7011
    Description = Timeout (30000 milliseconds) waiting for a transaction response from
    the stisvc service.

    Error - 8/6/2011 6:53:53 AM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the Roxio Upnp Server 9 service
    to connect.

    Error - 8/6/2011 7:56:31 AM | Computer Name = KGBNEW | Source = Print | ID = 6161
    Description = The document Microsoft Word - Document1 owned by Kenneth failed to
    print on printer Dell Photo AIO Printer 944. Data type: LEMF. Size of the spool
    file in bytes: 284196. Number of bytes printed: 284196. Total number of pages in
    the document: 1. Number of pages printed: 0. Client machine: \\KGBNEW. Win32 error
    code returned by the print processor: 0 (0x0).


    < End of report >
     
    Ken,
    #27
  9. 2011/08/06
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    1. Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    2. Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    ==================================================

    Run OTL
    • Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following

      Code:
      :OTL
IE - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings:  "ProxyOverride" = 127.0.0.1
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
O2 - BHO: (no name) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - No CLSID value found.
O15 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKU\S-1-5-21-2216002632-2257328244-1610888821-1006\..Trusted Domains: turbotax.com ([]https in Trusted sites)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
[2011/08/04 16:26:32 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]
[2007/02/05 16:27:01 | 000,000,088 | RHS- | C] () -- C:\WINDOWS\System32\2F2E35F313.sys
[2005/12/30 20:29:15 | 000,000,104 | RHS- | C] () -- C:\WINDOWS\System32\13F3352E2F.sys
[2005/12/26 15:24:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    • Then click the [color= "#FF0000"]Run Fix[/color] button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    =================================================

    Last scans...

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
    broni,
    #28
  10. 2011/08/07
    Ken

    Ken Well-Known Member Thread Starter

    Joined:
    2006/01/10
    Messages:
    241
    Likes Received:
    0
    Ran OTL
    Rebooted when prompted.
    No report appeared afterwards.
    Searched for report, nothing found.
    Windows shut down and dumped memory.
     
    Ken,
    #29
  11. 2011/08/07
    Ken

    Ken Well-Known Member Thread Starter

    Joined:
    2006/01/10
    Messages:
    241
    Likes Received:
    0
    Security Check
    Results of screen317's Security Check version 0.99.7
    Windows XP Service Pack 3
    Internet Explorer 6 Out of date!
    ``````````````````````````````
    Antivirus/Firewall Check:
    Windows Firewall Enabled!
    avast! Free Antivirus
    ```````````````````````````````
    Anti-malware/Other Utilities Check:
    Malwarebytes' Anti-Malware
    RegVac Registry Cleaner 5.01 (Trial Version)
    Java(TM) 6 Update 26
    Java(TM) 6 Update 3
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    Java 2 Runtime Environment, SE v1.4.2_03
    Out of date Java installed!
    Adobe Flash Player 10.3.181.26
    Adobe Reader X (10.1.0)
    Mozilla Firefox (x86 en-US..) Firefox Out of Date!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent
    Malwarebytes' Anti-Malware mbamservice.exe
    Malwarebytes' Anti-Malware mbamgui.exe
    Alwil Software Avast5 AvastSvc.exe
    Alwil Software Avast5 avastUI.exe
    ``````````End of Log````````````
     
    Ken,
    #30
  12. 2011/08/07
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Re-run OTL fix one more time.
     
    broni,
    #31
  13. 2011/08/07
    Ken

    Ken Well-Known Member Thread Starter

    Joined:
    2006/01/10
    Messages:
    241
    Likes Received:
    0
    Ran TFC and rebooted.
    On to OTL
     
    Ken,
    #32
  14. 2011/08/07
    Ken

    Ken Well-Known Member Thread Starter

    Joined:
    2006/01/10
    Messages:
    241
    Likes Received:
    0
    Re-ran OTL
    Processing Complete
    No prompt for re-start
    No report.
     
    Ken,
    #33
  15. 2011/08/07
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Restart computer and see if any log will pop-up.
     
    broni,
    #34
  16. 2011/08/07
    Ken

    Ken Well-Known Member Thread Starter

    Joined:
    2006/01/10
    Messages:
    241
    Likes Received:
    0
    No log.
    Did ESET and it did take awhile, over 3 hrs.
    Found 13 items.
    C:\Documents and Settings\Kenneth\Application Data\Sun\Java\Deployment\cache\6.0\17\24432f51-291d78ee a variant of Java/TrojanDownloader.OpenConnection.MU trojan deleted - quarantined
    C:\Qoobox\Quarantine\C\Documents and Settings\Kenneth\Application Data\Mozilla\Firefox\Profiles\8wzp06h5.default\extensions\{c94bc0b6-1562-4d53-93d4-251ca8eecce9}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
    C:\Qoobox\Quarantine\C\Documents and Settings\Kenneth\Application Data\Mozilla\Firefox\Profiles\8wzp06h5.default\extensions\{c94bc0b6-1562-4d53-93d4-251ca8eecce9}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
    C:\Qoobox\Quarantine\C\WINDOWS\system32\jjkmp.bak1.vir Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined
    C:\Qoobox\Quarantine\C\WINDOWS\system32\jjkmp.bak2.vir Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1596\A0157482.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1596\A0157713.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1596\A0158704.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1597\A0158733.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1601\A0158999.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1602\A0159019.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1602\A0159294.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1605\A0163515.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
     
    Ken,
    #35
  17. 2011/08/07
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Re-run OTL "Quick scan" (no custom code) and post fresh log.
     
    broni,
    #36
  18. 2011/08/08
    Ken

    Ken Well-Known Member Thread Starter

    Joined:
    2006/01/10
    Messages:
    241
    Likes Received:
    0
    OTL.txt

    OTL logfile created on: 8/8/2011 8:42:57 AM - Run 1
    OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\Kenneth\Desktop
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.5512)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    509.98 Mb Total Physical Memory | 182.75 Mb Available Physical Memory | 35.84% Memory free
    1.22 Gb Paging File | 0.92 Gb Available in Paging File | 75.26% Paging File free
    Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 71.46 Gb Total Space | 46.18 Gb Free Space | 64.63% Space Free | Partition Type: NTFS

    Computer Name: KGBNEW | User Name: Kenneth | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011/08/06 07:59:36 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\OTL.exe
    PRC - [2011/07/06 19:52:38 | 000,449,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    PRC - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    PRC - [2011/07/04 07:43:54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    PRC - [2011/07/04 07:43:51 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    PRC - [2011/05/20 11:28:44 | 000,273,544 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
    PRC - [2010/08/23 21:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    PRC - [2009/05/21 10:55:32 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    PRC - [2008/08/13 19:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2007/01/16 23:36:48 | 000,304,624 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 944\memcard.exe
    PRC - [2007/01/16 23:36:28 | 000,431,600 | ---- | M] (Dell) -- C:\Program Files\Dell Photo AIO Printer 944\dlcdmon.exe
    PRC - [2007/01/16 23:34:36 | 000,538,096 | ---- | M] ( ) -- C:\WINDOWS\system32\dlcdcoms.exe


    ========== Modules (SafeList) ==========

    MOD - [2011/08/06 07:59:36 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\OTL.exe
    MOD - [2011/07/04 07:43:51 | 000,199,792 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll
    MOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [Disabled | Stopped] -- -- (HidServ)
    SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
    SRV - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
    SRV - [2011/07/04 07:43:51 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
    SRV - [2010/08/23 21:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
    SRV - [2008/08/13 19:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
    SRV - [2007/03/07 15:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
    SRV - [2007/01/16 23:34:36 | 000,538,096 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\dlcdcoms.exe -- (dlcd_device)
    SRV - [2006/12/11 22:16:32 | 000,064,248 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe -- (Roxio UPnP Renderer 9)
    SRV - [2006/12/11 22:16:28 | 000,301,816 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe -- (Roxio Upnp Server 9)


    ========== Driver Services (SafeList) ==========

    DRV - [2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
    DRV - [2011/07/04 07:36:43 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
    DRV - [2011/07/04 07:36:32 | 000,309,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
    DRV - [2011/07/04 07:35:23 | 000,043,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
    DRV - [2011/07/04 07:35:12 | 000,102,616 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
    DRV - [2011/07/04 07:32:32 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
    DRV - [2011/07/04 07:32:13 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
    DRV - [2011/07/04 07:32:12 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV - [2010/02/11 08:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
    DRV - [2007/02/25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
    DRV - [2006/10/05 16:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
    DRV - [2005/04/07 17:18:34 | 000,003,840 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\BANTExt.sys -- (BANTExt)
    DRV - [2004/09/17 16:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
    DRV - [2004/06/16 05:52:40 | 000,061,157 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC53.sys -- (IntelC53)
    DRV - [2004/03/06 06:15:34 | 000,647,929 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC52.sys -- (IntelC52)
    DRV - [2004/03/06 06:14:42 | 001,233,525 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC51.sys -- (IntelC51)
    DRV - [2004/03/06 06:13:38 | 000,037,048 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mohfilt.sys -- (mohfilt)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://www.google.com/ig/dell?hl=en

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = AB 4E EA 0C 33 31 8E 48 A7 2D 02 F8 4E BF B8 A8 [binary data]
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
    IE - HKCU\..\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1

    ========== FireFox ==========


    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
    FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.647: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.647: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/05/20 11:29:44 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/29 09:27:17 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
    FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.2\extensions\\Components: C:\Program Files\SeaMonkey\components [2011/07/22 07:42:32 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.2\extensions\\Plugins: C:\Program Files\SeaMonkey\plugins [2011/07/22 07:42:32 | 000,000,000 | ---D | M]

    [2009/11/02 18:57:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kenneth\Application Data\Mozilla\Extensions
    [2009/11/02 18:57:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kenneth\Application Data\Mozilla\Extensions\{92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
    [2011/08/03 08:38:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kenneth\Application Data\Mozilla\Firefox\Profiles\8wzp06h5.default\extensions
    [2011/07/23 08:28:55 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kenneth\Application Data\Mozilla\SeaMonkey\Profiles\1d93tk2p.default\extensions
    [2011/08/07 13:14:03 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2011/08/07 13:14:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
    File not found (No name found) --
    [2010/05/26 08:36:25 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
    [2009/09/01 20:34:32 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
    [2011/07/08 03:16:28 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
    [2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

    O1 HOSTS File: ([2011/08/03 08:39:48 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (SBCONVERT Class) - {3017FB3E-9A77-4396-88C5-0EC9548FB42F} - C:\Program Files\SpeedBit Video Downloader\TBUB2\tbcore3.dll ()
    O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
    O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
    O2 - BHO: (SearchPredictObj Class) - {389943B0-C3A2-4E69-82CB-8596A84CB3DC} - C:\Program Files\SearchPredict\SearchPredict.dll (Speedbit Ltd.)
    O2 - BHO: (Softonic-Eng7 Toolbar) - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
    O2 - BHO: (SBCONVERT Class) - {A1056498-D09A-41E4-864B-505EDD640D9E} - C:\Program Files\SpeedBit Video Downloader\Toolbar\SpeedBitVideoDownloader.dll ()
    O2 - BHO: (no name) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - No CLSID value found.
    O2 - BHO: (GrabberObj Class) - {FF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\SpeedBit Video Downloader\TBUB2\Grabber.dll (Speedbit Ltd.)
    O3 - HKLM\..\Toolbar: (SpeedBit Video Downloader) - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - C:\Program Files\SpeedBit Video Downloader\TBUB2\tbcore3.dll ()
    O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
    O3 - HKLM\..\Toolbar: (Softonic-Eng7 Toolbar) - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    O3 - HKCU\..\Toolbar\ShellBrowser: (SpeedBit Video Downloader) - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - C:\Program Files\SpeedBit Video Downloader\TBUB2\tbcore3.dll ()
    O3 - HKCU\..\Toolbar\ShellBrowser: (Softonic-Eng7 Toolbar) - {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    O3 - HKCU\..\Toolbar\WebBrowser: (SpeedBit Video Downloader) - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - C:\Program Files\SpeedBit Video Downloader\TBUB2\tbcore3.dll ()
    O3 - HKCU\..\Toolbar\WebBrowser: (Softonic-Eng7 Toolbar) - {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
    O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
    O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
    O4 - HKLM..\Run: [DLCDCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCDtime.DLL ()
    O4 - HKLM..\Run: [dlcdmon.exe] C:\Program Files\Dell Photo AIO Printer 944\dlcdmon.exe (Dell)
    O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
    O4 - HKLM..\Run: [KernelFaultCheck] File not found
    O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
    O4 - HKLM..\Run: [MemoryCardManager] C:\Program Files\Dell Photo AIO Printer 944\memcard.exe ()
    O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
    O4 - Startup: C:\Documents and Settings\Kenneth\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
    O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
    O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)
    O16 - DPF: {4EC99A0B-E57C-4FBE-B9C4-8428424FBF88} http://supportcenter.verizon.net/euserv/jsp/VOLAWeb.cab (McciUtilsSpecialFolder Class)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
    O16 - DPF: {DB0474CC-8EF6-47FC-905B-23FC58A70817} https://download.verizon.net/sfp/Cabs/hst/webinstall/HstWebInstall.cab (RegPropsCtrl Class)
    O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
    O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2005/12/31 12:35:41 | 000,000,018 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O32 - AutoRun File - [2004/08/10 15:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BIT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/08/07 15:52:27 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
    [2011/08/07 15:50:52 | 002,322,184 | ---- | C] (ESET) -- C:\Documents and Settings\Kenneth\Desktop\esetsmartinstaller_enu.exe
    [2011/08/07 14:55:37 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\TFC.exe
    [2011/08/06 07:59:16 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\OTL.exe
    [2011/08/05 13:57:33 | 000,437,248 | ---- | C] (Microsoft Corporation) -- C:\Program Files\mspaint.exe
    [2011/08/05 13:19:05 | 000,413,696 | ---- | C] (Dell) -- C:\WINDOWS\System32\dlcddrs.dll
    [2011/08/05 13:19:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Dell Printers
    [2011/08/05 13:18:59 | 000,000,000 | ---D | C] -- C:\Program Files\Dell Photo AIO Printer 944
    [2011/08/05 13:18:18 | 000,323,584 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdhcp.dll
    [2011/08/05 13:18:17 | 000,413,696 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdinpa.dll
    [2011/08/05 13:18:17 | 000,397,312 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdiesc.dll
    [2011/08/05 13:18:15 | 001,224,704 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdserv.dll
    [2011/08/05 13:18:15 | 000,991,232 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdusb1.dll
    [2011/08/05 13:18:14 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdprox.dll
    [2011/08/05 13:18:14 | 000,094,208 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdpplc.dll
    [2011/08/05 13:18:13 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdpmui.dll
    [2011/08/05 13:18:12 | 000,585,728 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdlmpm.dll
    [2011/08/05 13:18:10 | 000,386,544 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdih.exe
    [2011/08/05 13:18:09 | 000,696,320 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdhbn3.dll
    [2011/08/05 13:18:07 | 000,538,096 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdcoms.exe
    [2011/08/05 13:18:06 | 000,421,888 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdcomm.dll
    [2011/08/05 13:18:05 | 000,684,032 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdcomc.dll
    [2011/08/05 13:18:05 | 000,382,448 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcdcfg.exe
    [2011/08/05 07:05:03 | 000,000,000 | ---D | C] -- C:\spoolerlogs
    [2011/08/04 18:39:15 | 000,083,968 | ---- | C] (eSage Lab) -- C:\Documents and Settings\Kenneth\Desktop\remover.exe
    [2011/08/04 18:38:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip
    [2011/08/04 16:26:32 | 000,000,000 | ---D | C] -- C:\Program Files\Carbonite
    [2011/08/04 16:26:32 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
    [2011/08/04 16:26:31 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ODBC
    [2011/08/04 16:26:31 | 000,000,000 | ---D | C] -- C:\Program Files\ComPlus Applications
    [2011/08/04 16:26:28 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
    [2011/08/04 16:26:28 | 000,000,000 | ---D | C] -- C:\Program Files\MSN
    [2011/08/04 16:26:28 | 000,000,000 | ---D | C] -- C:\Program Files\Motive
    [2011/08/04 16:26:27 | 000,000,000 | -H-D | C] -- C:\Program Files\Uninstall Information
    [2011/08/04 16:26:27 | 000,000,000 | ---D | C] -- C:\Program Files\Users
    [2011/08/04 16:26:27 | 000,000,000 | ---D | C] -- C:\Program Files\The Weather Channel FW
    [2011/08/04 09:12:47 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
    [2011/08/03 14:42:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\FxsTmp
    [2011/08/03 10:01:52 | 000,000,000 | -HSD | C] -- C:\RECYCLER
    [2011/08/03 08:54:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kenneth\Application Data\PriceGong
    [2011/08/03 08:12:08 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2011/08/03 08:07:12 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2011/08/03 08:07:12 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2011/08/03 08:07:12 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2011/08/03 08:07:12 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2011/08/03 08:06:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2011/08/03 08:06:35 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/08/03 08:04:40 | 004,163,262 | R--- | C] (Swearware) -- C:\Documents and Settings\Kenneth\Desktop\ComboFix.exe
    [2011/07/31 19:41:37 | 000,000,000 | ---D | C] -- C:\System Cleaners
    [2011/07/30 16:20:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kenneth\Application Data\Malwarebytes
    [2011/07/30 16:20:50 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2011/07/30 16:20:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2011/07/30 16:20:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2011/07/30 16:20:45 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2011/07/30 16:20:44 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2011/07/29 09:27:15 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
    [2011/07/20 10:09:52 | 000,000,000 | ---D | C] -- C:\ftm
    [2011/07/19 19:29:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie7updates
    [2011/07/19 19:26:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\WBEM
    [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2011/08/08 08:11:00 | 000,000,888 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2011/08/08 06:46:58 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2216002632-2257328244-1610888821-1006.job
    [2011/08/08 06:46:39 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2011/08/08 06:45:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2011/08/08 06:45:18 | 534,827,008 | -HS- | M] () -- C:\hiberfil.sys
    [2011/08/07 15:51:01 | 002,322,184 | ---- | M] (ESET) -- C:\Documents and Settings\Kenneth\Desktop\esetsmartinstaller_enu.exe
    [2011/08/07 14:55:45 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\TFC.exe
    [2011/08/07 14:49:40 | 000,879,028 | ---- | M] () -- C:\Documents and Settings\Kenneth\Desktop\SecurityCheck.exe
    [2011/08/06 07:59:36 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kenneth\Desktop\OTL.exe
    [2011/08/05 17:34:30 | 000,000,082 | ---- | M] () -- C:\WINDOWS\MPLAYER.INI
    [2011/08/05 15:17:30 | 000,000,608 | ---- | M] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to notepad.lnk
    [2011/08/05 14:05:16 | 000,000,584 | ---- | M] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\mspaint.lnk
    [2011/08/05 14:02:20 | 000,001,010 | ---- | M] () -- C:\WINDOWS\Ulead32.ini
    [2011/08/05 13:22:32 | 000,014,679 | ---- | M] () -- C:\WINDOWS\System32\LexFiles.ulf
    [2011/08/05 09:30:57 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2011/08/04 17:07:43 | 000,000,290 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2216002632-2257328244-1610888821-1006.job
    [2011/08/04 16:33:06 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2011/08/03 19:55:12 | 000,039,605 | ---- | M] () -- C:\Documents and Settings\Kenneth\Desktop\bootkit_remover.rar
    [2011/08/03 16:02:30 | 000,001,071 | ---- | M] () -- C:\WINDOWS\AWMODEM.INF
    [2011/08/03 14:43:01 | 000,477,832 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2011/08/03 14:43:01 | 000,086,740 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2011/08/03 14:42:50 | 000,001,066 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf
    [2011/08/03 14:36:12 | 000,003,690 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2011/08/03 08:39:48 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2011/08/03 08:05:08 | 004,163,262 | R--- | M] (Swearware) -- C:\Documents and Settings\Kenneth\Desktop\ComboFix.exe
    [2011/07/30 16:20:50 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2011/07/30 15:49:08 | 000,000,230 | ---- | M] () -- C:\WINDOWS\System32\spupdsvc.inf
    [2011/07/29 09:27:21 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2011/07/29 09:27:20 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
    [2011/07/27 21:19:10 | 000,000,068 | ---- | M] () -- C:\WINDOWS\System32\1917917430
    [2011/07/19 17:53:08 | 000,250,288 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2011/07/19 16:21:58 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
    [2011/07/19 16:11:19 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2011/08/07 14:49:36 | 000,879,028 | ---- | C] () -- C:\Documents and Settings\Kenneth\Desktop\SecurityCheck.exe
    [2011/08/05 15:17:30 | 000,000,608 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to notepad.lnk
    [2011/08/05 13:19:48 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlcdvs.dll
    [2011/08/05 13:19:40 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\dlcdcoin.dll
    [2011/08/05 13:19:19 | 000,126,059 | ---- | C] () -- C:\WINDOWS\System32\dlcdceip.chm
    [2011/08/05 13:19:04 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\dlcdcnv4.dll
    [2011/08/05 13:18:18 | 000,274,432 | ---- | C] () -- C:\WINDOWS\System32\dlcdinst.dll
    [2011/08/05 13:18:16 | 000,434,176 | ---- | C] () -- C:\WINDOWS\System32\dlcdutil.dll
    [2011/08/05 13:18:12 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\dlcdjswr.dll
    [2011/08/05 13:18:11 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\dlcdinsb.dll
    [2011/08/05 13:18:11 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\dlcdinsr.dll
    [2011/08/05 13:18:10 | 000,257,112 | ---- | C] () -- C:\WINDOWS\System32\dlcdhelp.chm
    [2011/08/05 13:18:10 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\dlcdins.dll
    [2011/08/05 13:18:08 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dlcdcub.dll
    [2011/08/05 13:18:07 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\dlcdcu.dll
    [2011/08/05 13:18:07 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\dlcdcur.dll
    [2011/08/05 13:18:04 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\dlcdcfg.dll
    [2011/08/05 13:18:04 | 000,002,123 | ---- | C] () -- C:\WINDOWS\System32\dlcd.loc
    [2011/08/03 19:55:09 | 000,039,605 | ---- | C] () -- C:\Documents and Settings\Kenneth\Desktop\bootkit_remover.rar
    [2011/08/03 14:42:24 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
    [2011/08/03 14:42:24 | 000,001,361 | ---- | C] () -- C:\WINDOWS\System32\fxscount.h
    [2011/08/03 08:12:21 | 000,000,211 | ---- | C] () -- C:\Boot.bak
    [2011/08/03 08:12:19 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2011/08/03 08:07:12 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2011/08/03 08:07:12 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2011/08/03 08:07:12 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2011/08/03 08:07:12 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2011/08/03 08:07:12 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2011/07/30 16:20:50 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2011/07/30 15:49:08 | 000,000,230 | ---- | C] () -- C:\WINDOWS\System32\spupdsvc.inf
    [2011/07/29 09:27:21 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2011/07/29 09:27:20 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
    [2011/07/29 09:27:20 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
    [2011/07/27 21:19:08 | 000,000,068 | ---- | C] () -- C:\WINDOWS\System32\1917917430
    [2009/06/08 07:47:10 | 000,118,784 | ---- | C] () -- C:\WINDOWS\GREUninstall.exe
    [2008/03/05 09:09:33 | 000,003,072 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\DMX.bmk
    [2007/05/18 14:39:36 | 000,000,184 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
    [2007/02/05 16:27:01 | 000,000,088 | RHS- | C] () -- C:\WINDOWS\System32\2F2E35F313.sys
    [2006/07/16 18:51:35 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
    [2006/07/15 14:56:49 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
    [2006/02/12 17:13:29 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\PFP120JPR.{PB
    [2006/02/12 17:13:29 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\Kenneth\Application Data\PFP120JCM.{PB
    [2006/02/08 19:38:30 | 000,011,776 | ---- | C] () -- C:\Documents and Settings\Kenneth\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2006/02/07 12:33:28 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\Kenneth\Local Settings\Application Data\fusioncache.dat
    [2006/02/06 18:44:22 | 000,002,560 | ---- | C] () -- C:\WINDOWS\_MSRSTRT.EXE
    [2006/02/01 09:19:03 | 000,000,031 | ---- | C] () -- C:\WINDOWS\MSBACKUP.INI
    [2006/01/17 12:52:38 | 000,000,024 | ---- | C] () -- C:\WINDOWS\SOL.INI
    [2006/01/11 18:38:37 | 000,001,010 | ---- | C] () -- C:\WINDOWS\Ulead32.ini
    [2006/01/10 16:11:03 | 000,000,225 | ---- | C] () -- C:\WINDOWS\netscape.INI
    [2006/01/10 10:05:46 | 000,634,087 | ---- | C] () -- C:\WINDOWS\cd32.exe
    [2006/01/05 16:45:56 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
    [2006/01/04 19:42:46 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Kenneth\Local Settings\Application Data\FASTWiz.html
    [2006/01/03 16:34:13 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\CNMVS3m.DLL
    [2006/01/02 16:53:44 | 000,000,825 | ---- | C] () -- C:\WINDOWS\Solitaire.ini
    [2005/12/31 16:28:59 | 000,003,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\BANTExt.sys
    [2005/12/31 09:58:19 | 000,019,446 | ---- | C] () -- C:\WINDOWS\mozver.dat
    [2005/12/30 20:29:15 | 000,000,104 | RHS- | C] () -- C:\WINDOWS\System32\13F3352E2F.sys
    [2005/12/30 20:29:14 | 000,004,184 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
    [2005/12/29 14:56:56 | 000,000,082 | ---- | C] () -- C:\WINDOWS\MPLAYER.INI
    [2005/12/26 15:38:13 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2005/12/26 15:31:00 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
    [2005/12/26 15:24:56 | 000,000,552 | ---- | C] () -- C:\WINDOWS\wininit.ini
    [2005/12/26 15:23:19 | 000,060,564 | ---- | C] () -- C:\WINDOWS\nsreg.dat
    [2005/12/26 15:00:02 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
    [2005/12/26 14:59:44 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
    [2005/12/26 14:59:42 | 000,000,392 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
    [2005/05/19 19:05:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
    [2004/08/10 15:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
    [2004/08/10 15:07:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
    [2004/08/10 15:02:15 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
    [2004/08/10 14:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2004/08/10 14:57:15 | 000,250,288 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2004/08/10 14:51:22 | 000,088,064 | ---- | C] () -- C:\WINDOWS\System32\msn17289.dll
    [2004/08/10 14:51:21 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
    [2004/08/10 14:51:20 | 000,477,832 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
    [2004/08/10 14:51:20 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
    [2004/08/10 14:51:20 | 000,086,740 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
    [2004/08/10 14:51:20 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
    [2004/08/10 14:51:18 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
    [2004/08/10 14:51:17 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
    [2004/08/10 14:51:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
    [2004/08/10 14:51:12 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
    [2004/08/10 14:51:11 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
    [2004/08/10 14:51:05 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
    [2004/08/10 14:50:56 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
    [1996/12/09 01:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
    [1996/12/09 01:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL

    ========== LOP Check ==========

    [2006/01/02 17:08:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\Bot Productions
    [2005/12/29 18:48:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\Leadertech
    [2007/04/01 13:56:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\MSNInstaller
    [2006/01/21 16:55:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\MyFamily.com
    [2010/09/24 19:18:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\NCH Swift Sound
    [2005/12/31 09:51:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\Netscape
    [2011/08/04 17:07:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\PriceGong
    [2010/10/19 17:36:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kenneth\Application Data\Toolbar4
    [2010/09/12 08:33:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
    [2010/09/24 19:18:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
    [2005/12/29 14:45:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Netscape Internet Service
    [2010/12/11 20:08:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SpeedBit
    [2008/01/31 09:04:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
    [2005/12/26 15:24:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
    [2007/08/05 07:27:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\YAHOO
    [2010/10/01 09:39:01 | 000,000,286 | ---- | M] () -- C:\WINDOWS\Tasks\wavepadShakeIcon.job

    ========== Purity Check ==========



    < End of report >
     
    Ken,
    #37
  19. 2011/08/08
    Ken

    Ken Well-Known Member Thread Starter

    Joined:
    2006/01/10
    Messages:
    241
    Likes Received:
    0
    Extras.txt

    OTL Extras logfile created on: 8/8/2011 8:42:57 AM - Run 1
    OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\Kenneth\Desktop
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.5512)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    509.98 Mb Total Physical Memory | 182.75 Mb Available Physical Memory | 35.84% Memory free
    1.22 Gb Paging File | 0.92 Gb Available in Paging File | 75.26% Paging File free
    Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 71.46 Gb Total Space | 46.18 Gb Free Space | 64.63% Space Free | Partition Type: NTFS

    Computer Name: KGBNEW | User Name: Kenneth | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
    .url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

    [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
    .html [@ = SeaMonkeyHTML] -- C:\Program Files\SeaMonkey\seamonkey.exe (mozilla.org)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
    exefile [open] -- "%1" %*
    htmlfile [edit] -- Reg Error: Key error.
    https [open] -- C:\PROGRA~1\NETSCAPE\NETSCAPE\NETSCP.EXE -url "%1 "
    InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1 "
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22008

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL
    "C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL
    "C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe" = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Jukebox -- (Yahoo! Inc.)
    "C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax -- (Intuit, Inc.)
    "C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager -- (Intuit, Inc.)
    "C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe" = C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe:LocalSubNet:Disabled:Intuit Update Shared Downloads Server -- (Intuit Inc.)
    "C:\WINDOWS\system32\fxsclnt.exe" = C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console -- (Microsoft Corporation)
    "C:\WINDOWS\system32\dlcdcoms.exe" = C:\WINDOWS\system32\dlcdcoms.exe:*:Enabled:Dell 944 Server -- ( )


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{03DF638A-D61C-4893-B8B9-845900C03163}" = TurboTax 2010 wnyiper
    "{05BDC796-3451-4F81-B91D-E98F7ADA76C2}" = TurboTax 2010 WinPerTaxSupport
    "{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data
    "{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0
    "{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
    "{105CFC7C-6992-11D5-BD9D-000102C10FD8}" = DjVu Browser Plug-in 3.5
    "{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
    "{17334AAF-C9E7-483B-9F45-E3FCAF07FFA7}" = Intel(R) PROSet for Wired Connections
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD LE
    "{25EF00A1-F17B-11D6-88EA-000476CD2443}" = Verizon Online Support Center
    "{25EF00BE-F17B-11D6-88EA-000476CD2443}" = Verizon Online
    "{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 26
    "{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
    "{29521505-F489-4822-ADFA-32C6DEE4F114}" = TurboTax 2008 WinPerUserEducation
    "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
    "{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
    "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
    "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
    "{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{3782EC09-4000-475E-8A59-9CABD6F03B4C}" = TurboTax 2010 WinPerFedFormset
    "{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset
    "{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine
    "{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport
    "{3B8186F0-EAA2-012B-AE69-000000000000}" = TurboTax 2009 wnyiper
    "{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper
    "{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Google AFE
    "{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = Modem On Hold
    "{4192EAC0-6B36-4723-B216-D0E86E7757AC}" = Jasc Paint Shop Photo Album 5
    "{4F2FCCCF-29F3-44B9-886F-6D16F8417522}" = TurboTax 2010 wrapper
    "{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
    "{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon
    "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.5
    "{6D5FCA42-1486-4E32-AFE8-1B7E2AA59D33}" = Digital Content Portal
    "{6E179C77-7335-458D-9537-4F4EAC0181ED}" = Photo Click
    "{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
    "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
    "{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
    "{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
    "{7570F1CA-016D-46AC-B586-CD74645EFB52}" = TurboTax 2008 WinPerFedFormset
    "{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility
    "{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
    "{78C496B9-5A6B-4692-8C2E-AFFFC34E4961}" = Jasc Paint Shop Pro Studio, Dell Editon
    "{7A0EFAFB-AC4B-4B88-8C6B-6731BE88DB68}" = Modem Event Monitor
    "{7DD9A065-2C86-4A9F-A5FF-796EC1B99DCA}" = AnswerWorks 4.0 Runtime - English
    "{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
    "{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
    "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    "{88214092-836F-4E22-A5AC-569AC9EE6A0F}" = TurboTax 2008 WinPerReleaseEngine
    "{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
    "{8A9B8148-DDD7-448F-BD6C-358386D32354}" = Corel Photo Album 6
    "{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
    "{90AF0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office PowerPoint Viewer 2003
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    "{9E5A03E3-6246-4920-9630-0527D5DA9B07}" = AnswerWorks 5.0 English Runtime
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A525E00B-6609-442E-9DCD-64453C233E8D}" = TurboTax 2010 WinPerReleaseEngine
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{A9F6CFB0-806D-11E0-8EA1-B8AC6F97B88E}" = Google Earth Plug-in
    "{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio module
    "{AC0EE5B0-A8FB-4D0A-AF03-2EDC518F841B}" = Roxio Media Experience
    "{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.0)
    "{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
    "{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
    "{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy
    "{B1DB1AD8-C07E-4052-81A1-D2930232BA70}" = TurboTax 2008 wrapper
    "{B23726CF-68BF-41A6-A4EB-72F12F87FE05}" = TurboTax 2008 WinPerTaxSupport
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{C3DE07CB-036F-45BC-85BD-D6FFC5D33603}" = TurboTax 2008 wnyiper
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
    "{E6D9BC25-0DBC-4368-8E4A-7DEE80661CD9}" = TurboTax 2008 WinPerProgramHelp
    "{EC3B8CA2-49B8-4D38-BE9C-ABD0F6029168}" = Yahoo! Music Jukebox
    "{F2F4C144-7D1A-47C4-9D53-395A57B0CD64}" = Family Tree Maker 2006
    "7-Zip" = 7-Zip 9.20
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "avast" = avast! Free Antivirus
    "Belarc Advisor 2.0" = Belarc Advisor 7.0
    "CodeStuff Starter" = CodeStuff Starter
    "conduitEngine" = Conduit Engine
    "Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
    "Dell Photo AIO Printer 944" = Dell Photo AIO Printer 944
    "ESET Online Scanner" = ESET Online Scanner v3
    "Excel" = Microsoft Excel 97
    "FTP Explorer" = FTP Explorer
    "FTW" = Family Tree Maker
    "iCare Data Recovery_is1" = iCare Data Recovery 4.0
    "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
    "Intel(R) 537EP V9x DF PCI Modem" = Intel(R) 537EP V9x DF PCI Modem
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Mozilla Firefox 5.0.1 (x86 en-US)" = Mozilla Firefox 5.0.1 (x86 en-US)
    "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
    "PROSet" = Intel(R) PRO Network Adapters and Drivers
    "QuickTime" = QuickTime
    "RealPlayer 12.0" = RealPlayer
    "RegVac Registry Cleaner (Trial Version)_is1" = RegVac Registry Cleaner 5.01 (Trial Version)
    "SeaMonkey (2.2)" = SeaMonkey (2.2)
    "Softonic-Eng7 Toolbar" = Softonic-Eng7 Toolbar
    "SpeedBit Video Downloader" = SpeedBit Video Downloader
    "StreetPlugin" = Learn2 Player (Uninstall Only)
    "TurboTax 2008" = TurboTax 2008
    "TurboTax 2009" = TurboTax 2009
    "TurboTax 2010" = TurboTax 2010
    "TurboTax Deluxe 2007" = TurboTax Deluxe 2007
    "Verizon SmartCall" = Verizon SmartCall
    "ViewpointMediaPlayer" = Viewpoint Media Player
    "WavePad" = WavePad Sound Editor
    "WildTangent CDA" = WildTangent Web Driver
    "Windows Media Format Runtime" = Windows Media Format Runtime
    "Windows Media Player" = Windows Media Player 10
    "Windows XP Service Pack" = Windows XP Service Pack 3
    "Word8.0" = Microsoft Word 97

    ========== HKEY_CURRENT_USER Uninstall List ==========

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 8/5/2011 12:45:40 PM | Computer Name = KGBNEW | Source = Application Error | ID = 1000
    Description = Faulting application dlcdaiox.exe, version 3.57.0.10, faulting module
    dlcdscw.dll, version 3.96.0.0, fault address 0x0001449e.

    Error - 8/5/2011 1:24:59 PM | Computer Name = KGBNEW | Source = Application Hang | ID = 1002
    Description = Hanging application dlcdpswx.exe, version 2.63.0.0, hang module hungapp,
    version 0.0.0.0, hang address 0x00000000.

    Error - 8/5/2011 1:28:36 PM | Computer Name = KGBNEW | Source = Application Hang | ID = 1002
    Description = Hanging application dlcdaiox.exe, version 3.57.0.10, hang module hungapp,
    version 0.0.0.0, hang address 0x00000000.

    Error - 8/5/2011 1:39:04 PM | Computer Name = KGBNEW | Source = Application Hang | ID = 1002
    Description = Hanging application dlcdaiox.exe, version 3.57.0.10, hang module hungapp,
    version 0.0.0.0, hang address 0x00000000.

    Error - 8/6/2011 7:25:02 PM | Computer Name = KGBNEW | Source = Application Hang | ID = 1002
    Description = Hanging application seamonkey.exe, version 5.0.0.4204, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    Error - 8/7/2011 1:20:03 PM | Computer Name = KGBNEW | Source = Application Error | ID = 1000
    Description = Faulting application javara.exe, version 1.16.1.1763, faulting module
    ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

    Error - 8/7/2011 1:33:22 PM | Computer Name = KGBNEW | Source = Application Error | ID = 1000
    Description = Faulting application jusched.exe, version 2.0.5.1, faulting module
    user32.dll, version 5.1.2600.5512, fault address 0x000187f1.

    Error - 8/7/2011 2:31:44 PM | Computer Name = KGBNEW | Source = Application Error | ID = 1000
    Description = Faulting application jusched.exe, version 2.0.5.1, faulting module
    user32.dll, version 5.1.2600.5512, fault address 0x000187f1.

    Error - 8/7/2011 2:45:18 PM | Computer Name = KGBNEW | Source = Application Error | ID = 1000
    Description = Faulting application jusched.exe, version 2.0.5.1, faulting module
    user32.dll, version 5.1.2600.5512, fault address 0x000187f1.

    Error - 8/7/2011 8:58:21 PM | Computer Name = KGBNEW | Source = Application Error | ID = 1000
    Description = Faulting application jusched.exe, version 2.0.5.1, faulting module
    user32.dll, version 5.1.2600.5512, fault address 0x000187f1.

    [ System Events ]
    Error - 8/7/2011 2:42:52 PM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the Roxio Upnp Server 9 service
    to connect.

    Error - 8/7/2011 2:42:52 PM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the Fax service to connect.

    Error - 8/7/2011 2:42:52 PM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7000
    Description = The Fax service failed to start due to the following error: %%1053

    Error - 8/7/2011 3:08:27 PM | Computer Name = KGBNEW | Source = sr | ID = 1
    Description = The System Restore filter encountered the unexpected error '0xC0000243'
    while processing the file 'r127' on the volume 'HarddiskVolume2'. It has stopped
    monitoring the volume.

    Error - 8/7/2011 3:10:33 PM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the Roxio Upnp Server 9 service
    to connect.

    Error - 8/7/2011 3:10:33 PM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the Fax service to connect.

    Error - 8/7/2011 3:10:33 PM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7000
    Description = The Fax service failed to start due to the following error: %%1053

    Error - 8/8/2011 6:49:38 AM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the Roxio Upnp Server 9 service
    to connect.

    Error - 8/8/2011 6:49:38 AM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the Fax service to connect.

    Error - 8/8/2011 6:49:38 AM | Computer Name = KGBNEW | Source = Service Control Manager | ID = 7000
    Description = The Fax service failed to start due to the following error: %%1053


    < End of report >
     
    Last edited: 2011/08/08
    Ken,
    #38
  20. 2011/08/08
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Uninstall:
    Java(TM) 6 Update 3
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    Java 2 Runtime Environment, SE v1.4.2_03

    ==================================================

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current (including updating Internet Explorer to version 8!)

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. (Windows XP only) Run defrag at your convenience.

    11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    13. Please, let me know, how your computer is doing.
     
    broni,
    #39
  21. 2011/08/09
    Ken

    Ken Well-Known Member Thread Starter

    Joined:
    2006/01/10
    Messages:
    241
    Likes Received:
    0
    Java(TM) 6 Update 3 removed
    Java(TM) 6 Update 5 removed
    Java(TM) 6 Update 7 not on list
    Java 2 Runtime Environment, SE v1.4.2_03 Windows could not find a path to file
     
    Ken,
    #40
Page 2 of 3

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...