Solved Google Redirect (among other things)

TonyV84 · 2010/12/30

[Resolved] Google Redirect (among other things)

Home for the holidays, Mom picked up a ton of **** since I was home last. Used AVG/MBAM/SS&D to try and get rid of most. Noticed there were a few problems that SS&D couldn't get rid of because access to a HOSTS file was denied. Please Help!

Admin. · 2010/12/30

Hi,

Read this post as indicated at the top of this forum & follow the instructions.

TonyV84 · 2010/12/30

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5426

Windows 6.0.6001 Service Pack 1 (Safe Mode)
Internet Explorer 7.0.6001.18000

12/30/2010 5:49:23 PM
mbam-log-2010-12-30 (17-49-23).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 291169
Time elapsed: 36 minute(s), 23 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\karen vercellino\AppData\Local\Temp\tmp91E5.tmp (Spyware.Zbot) -> Quarantined and deleted successfully.

TonyV84 · 2010/12/30

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit quick scan 2010-12-30 19:39:06
Windows 6.0.6001 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD25 rev.01.0
Running: 0fsd1h59.exe; Driver: C:\Users\KARENV~1\AppData\Local\Temp\uwryqkog.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\tdx \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

---- EOF - GMER 1.0.15 ----

TonyV84 · 2010/12/30

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer: Dell Inc.
BIOS Manufacturer: Dell Inc.
System Manufacturer: Dell Inc.
System Product Name: Inspiron 1525
Logical Drives Mask: 0x0000003c

Kernel Drivers (total 164):
0x81E04000 \SystemRoot\system32\ntkrnlpa.exe
0x821BD000 \SystemRoot\system32\hal.dll
0x80401000 \SystemRoot\system32\kdcom.dll
0x80409000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x80469000 \SystemRoot\system32\PSHED.dll
0x8047A000 \SystemRoot\system32\BOOTVID.dll
0x80482000 \SystemRoot\system32\CLFS.SYS
0x804C3000 \SystemRoot\system32\CI.dll
0x805A3000 \SystemRoot\System32\drivers\xeelnhc.sys
0x80600000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8067C000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80689000 \SystemRoot\system32\drivers\acpi.sys
0x806CF000 \SystemRoot\system32\drivers\WMILIB.SYS
0x806D8000 \SystemRoot\system32\drivers\msisadrv.sys
0x806E0000 \SystemRoot\system32\drivers\pci.sys
0x80707000 \SystemRoot\System32\drivers\partmgr.sys
0x80716000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x80719000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x80723000 \SystemRoot\system32\drivers\volmgr.sys
0x80732000 \SystemRoot\System32\drivers\volmgrx.sys
0x8077C000 \SystemRoot\system32\DRIVERS\intelide.sys
0x80783000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x80791000 \SystemRoot\system32\drivers\pciide.sys
0x80798000 \SystemRoot\System32\drivers\mountmgr.sys
0x87C07000 \SystemRoot\system32\drivers\iastor.sys
0x87CCE000 \SystemRoot\system32\drivers\atapi.sys
0x87CD6000 \SystemRoot\system32\drivers\ataport.SYS
0x87CF4000 \SystemRoot\system32\DRIVERS\ntcdrdrv.sys
0x87CF8000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x87D1E000 \SystemRoot\system32\drivers\fltmgr.sys
0x87D50000 \SystemRoot\system32\drivers\fileinfo.sys
0x87D60000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x87D69000 \SystemRoot\System32\Drivers\ksecdd.sys
0x87E01000 \SystemRoot\system32\drivers\ndis.sys
0x87F0C000 \SystemRoot\system32\drivers\msrpc.sys
0x87F37000 \SystemRoot\system32\drivers\NETIO.SYS
0x8800F000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8811E000 \SystemRoot\system32\drivers\volsnap.sys
0x88157000 \SystemRoot\System32\Drivers\spldr.sys
0x8815F000 \SystemRoot\System32\Drivers\mup.sys
0x8816E000 \SystemRoot\System32\drivers\ecache.sys
0x88195000 \SystemRoot\system32\drivers\disk.sys
0x881A6000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x881C7000 \SystemRoot\system32\drivers\crcdisk.sys
0x881D0000 \SystemRoot\system32\DRIVERS\avgrkx86.sys
0x881D5000 \SystemRoot\system32\DRIVERS\AVGIDSEH.Sys
0x8B8D2000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8B8DD000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x8B8E6000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8C00C000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8C659000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8C6F8000 \SystemRoot\System32\drivers\watchdog.sys
0x8C705000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8C710000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8C74E000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8C75D000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8C76F000 \SystemRoot\system32\DRIVERS\yk60x86.sys
0x8B8F5000 \SystemRoot\system32\DRIVERS\bcmwl6.sys
0x8C7B5000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8C7C5000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8C7D3000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x8C7ED000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0x881EB000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0x87F71000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
0x87FC2000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x807A8000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0x8C000000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8B800000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x87FD5000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8B9F7000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0x8C7FC000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x88000000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x87DDA000 \SystemRoot\system32\DRIVERS\ngvpn.sys
0x87FED000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x805B1000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8C80B000 \SystemRoot\system32\DRIVERS\storport.sys
0x8C84C000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8C863000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8C86E000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8C891000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8C8A0000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8C8B4000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8C8C9000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8C8D9000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8C8DB000 \SystemRoot\system32\DRIVERS\ks.sys
0x8C905000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8C90F000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8C91C000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8C950000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8C961000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8CA06000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8CB08000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8CBBD000 \SystemRoot\system32\drivers\modem.sys
0x8CBCA000 \SystemRoot\system32\drivers\IntcHdmi.sys
0x8C99E000 \SystemRoot\system32\drivers\portcls.sys
0x8C9CB000 \SystemRoot\system32\drivers\drmk.sys
0x8CC02000 \SystemRoot\system32\drivers\stwrt.sys
0x8CC57000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8CC6E000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8CC70000 \SystemRoot\system32\DRIVERS\OEM02Dev.sys
0x8CCAA000 \SystemRoot\system32\DRIVERS\OEM02Vfx.sys
0x8CCAC000 \SystemRoot\system32\DRIVERS\avgmfx86.sys
0x8CCB8000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8CCC1000 \SystemRoot\System32\Drivers\Null.SYS
0x8CCC8000 \SystemRoot\System32\Drivers\Beep.SYS
0x8CCCF000 \SystemRoot\System32\drivers\vga.sys
0x8CCDB000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8CCFC000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8CD04000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8CD0C000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8CD17000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8CD25000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8DC0A000 \SystemRoot\System32\drivers\tcpip.sys
0x8DCF3000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8DD0E000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8DD24000 \SystemRoot\system32\DRIVERS\smb.sys
0x8DD38000 \SystemRoot\system32\DRIVERS\avgtdix.sys
0x8DD80000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8DDB2000 \SystemRoot\system32\drivers\afd.sys
0x8CD2E000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8CD44000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8CD52000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8CD65000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8DC00000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8CDA1000 \SystemRoot\System32\Drivers\dfsc.sys
0x8CDB8000 \SystemRoot\system32\DRIVERS\avgldx86.sys
0x8B80B000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x8CBEB000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8F60A000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x970D0000 \SystemRoot\System32\win32k.sys
0x8F6D1000 \SystemRoot\System32\drivers\Dxapi.sys
0x972F0000 \SystemRoot\System32\TSDDD.dll
0x97310000 \SystemRoot\System32\cdd.dll
0x8F6EA000 \SystemRoot\system32\drivers\luafv.sys
0x8F705000 \SystemRoot\system32\drivers\spsys.sys
0x8F7B4000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x8F7C4000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x8F7EE000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x8B821000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x8F600000 \SystemRoot\system32\DRIVERS\nglog.sys
0x8CDF4000 \SystemRoot\system32\DRIVERS\ngwfp.sys
0x8B834000 \SystemRoot\system32\drivers\HTTP.sys
0x8B8A1000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x807D4000 \SystemRoot\system32\DRIVERS\bowser.sys
0x805DF000 \SystemRoot\System32\drivers\mpsdrv.sys
0xAB40C000 \SystemRoot\system32\drivers\mrxdav.sys
0xAB42C000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xAB44B000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xAB484000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xAB49C000 \SystemRoot\System32\DRIVERS\srv2.sys
0xAB4C4000 \SystemRoot\System32\DRIVERS\srv.sys
0xAB52A000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
0xAB535000 \??\C:\Windows\system32\drivers\hardlock.sys
0xABC04000 \SystemRoot\System32\Drivers\fastfat.SYS
0xABC2C000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xABC30000 \SystemRoot\system32\drivers\peauth.sys
0xABD0E000 \SystemRoot\System32\Drivers\secdrv.SYS
0xABD18000 \SystemRoot\System32\drivers\tcpipreg.sys
0xABD24000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xABD2C000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
0xABD36000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
0xABD5E000 \SystemRoot\system32\DRIVERS\monitor.sys
0xABD6D000 \??\C:\Users\KARENV~1\AppData\Local\Temp\uwryqkog.sys
0x771A0000 \Windows\System32\ntdll.dll

Processes (total 62):
0 System Idle Process
4 System
476 C:\Windows\System32\smss.exe
708 csrss.exe
760 csrss.exe
768 C:\Windows\System32\wininit.exe
804 C:\Windows\System32\services.exe
816 C:\Windows\System32\lsass.exe
828 C:\Windows\System32\lsm.exe
876 C:\Windows\System32\winlogon.exe
1024 C:\Windows\System32\svchost.exe
1084 C:\Windows\System32\svchost.exe
1236 C:\Windows\System32\svchost.exe
1264 C:\Windows\System32\svchost.exe
1292 C:\Windows\System32\svchost.exe
1388 C:\Windows\System32\audiodg.exe
1428 C:\Windows\System32\SLsvc.exe
1472 C:\Windows\System32\svchost.exe
1568 C:\Program Files\Dell\DellDock\DockLogin.exe
1664 C:\Windows\System32\svchost.exe
1688 C:\Windows\System32\ngvpnmgr.exe
1832 C:\Windows\System32\WLTRYSVC.EXE
1840 C:\Windows\System32\wlanext.exe
1872 C:\Windows\System32\BCMWLTRY.EXE
1972 C:\Windows\System32\spoolsv.exe
1996 C:\Windows\System32\svchost.exe
660 C:\Windows\System32\AEstSrv.exe
676 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
716 C:\Program Files\AVG\AVG10\avgwdsvc.exe
952 C:\Program Files\Bonjour\mDNSResponder.exe
1800 C:\Windows\System32\svchost.exe
2036 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
1736 C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
2092 C:\Windows\System32\svchost.exe
2120 C:\Windows\System32\stacsv.exe
2256 C:\Windows\System32\svchost.exe
2288 C:\Windows\System32\svchost.exe
2336 C:\Windows\System32\SearchIndexer.exe
2516 C:\Windows\System32\drivers\XAudio.exe
2540 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
2724 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
2748 C:\Windows\System32\taskeng.exe
2912 C:\Program Files\AVG\AVG10\avgnsx.exe
2936 C:\Program Files\AVG\AVG10\avgemcx.exe
3716 C:\Windows\System32\dwm.exe
3772 C:\Windows\System32\taskeng.exe
1552 C:\Program Files\AVG\AVG10\avgtray.exe
3204 WmiPrvSE.exe
4048 C:\Windows\ehome\ehtray.exe
376 C:\Windows\ehome\ehmsas.exe
4352 C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
260 C:\Windows\System32\wuauclt.exe
2840 C:\PROGRA~1\AVG\AVG10\avgrsx.exe
4204 C:\Program Files\AVG\AVG10\avgcsrvx.exe
6120 C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
2156 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
3412 C:\Windows\System32\rundll32.exe
3892 C:\Windows\explorer.exe
2596 C:\Windows\System32\wbem\unsecapp.exe
5168 C:\Windows\System32\SearchProtocolHost.exe
4036 C:\Windows\System32\SearchFilterHost.exe
6092 C:\Users\Karen Vercellino\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`73800000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000000`02800000 (NTFS)

PhysicalDrive0 Model Number: WDCWD2500BEVS-75UST0, Rev: 01.01A01

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Dell Inspiron MBR code detected
SHA1: AE3E0A945D44C8EA304A19A8F50F69065C34344B

Done!

TonyV84 · 2010/12/30

DDS (Ver_10-12-12.02) - NTFSx86
Run by Karen Vercellino at 19:39:31.45 on Thu 12/30/2010
Internet Explorer: 7.0.6001.18000
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2037.892 [GMT -6:00]

AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\ngvpnmgr.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\aestsrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\STacSV.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Windows\system32\wuauclt.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\AVG\AVG10\avgchsvx.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Windows\System32\rundll32.exe
C:\Windows\explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Karen Vercellino\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.yahoo.com/
uWindow Title = Internet Explorer provided by Dell
uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=0080822
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.yahoo.com/
mDefault_Page_URL = hxxp://www.yahoo.com/
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyServer = http=127.0.0.1:5577
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Yahooo Search Protection: {25bc7718-0bfa-40ea-b381-4b2d9732d686} - c:\program files\yahoo!\search protection\ysp.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [ECenter] c:\dell\e-center\EULALauncher.exe
mRun: [Apoint] c:\program files\delltpad\Apoint.exe
mRun: [OEM02Mon.exe] c:\windows\OEM02Mon.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe "
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe "
mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe "
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\users\karenv~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\delldo~1.lnk - c:\program files\dell\delldock\DellDock.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
mPolicies-system: ConsentPromptBehaviorUser = 2 (0x2)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
IE: {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - c:\program files\yahoo!\search protection\ysp.dll
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll
Notify: igfxcui - igfxdev.dll
IFEO: image file execution options - svchost.exe
Hosts: 74.125.45.100 4-open-davinci.com
Hosts: 74.125.45.100 securitysoftwarepayments.com
Hosts: 74.125.45.100 privatesecuredpayments.com
Hosts: 74.125.45.100 secure.privatesecuredpayments.com
Hosts: 74.125.45.100 getantivirusplusnow.com

Note: multiple HOSTS entries found. Please refer to Attach.txt

================= FIREFOX ===================

FF - ProfilePath - c:\users\karenv~1\appdata\roaming\mozilla\firefox\profiles\piy9drwo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\program files\avg\avg10\firefox\components\avgssff.dll
FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\karen vercellino\appdata\roaming\move networks\plugins\npqmp071505000011.dll
FF - plugin: c:\users\karen vercellino\appdata\roaming\mozilla\plugins\np-mswmp.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg10\Firefox
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\users\karen vercellino\appdata\roaming\Move Networks

---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
============= SERVICES / DRIVERS ===============

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 26064]
R0 ntcdrdrv;ntcdrdrv;c:\windows\system32\drivers\ntcdrdrv.sys [2008-12-22 13440]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-12-8 251728]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34384]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-11-12 299984]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\AEstSrv.exe [2008-8-21 73728]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2010-11-23 6128208]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2010-10-22 265400]
R2 DockLoginService;Dock Login Service;c:\program files\dell\delldock\DockLogin.exe [2008-4-28 161048]
R2 NgVpnMgr;Aventail VPN Client;c:\windows\system32\ngvpnmgr.exe [2007-8-1 203843]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 123472]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 30288]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 27216]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2008-8-22 111616]
R3 NgLog;Aventail VPN Logging;c:\windows\system32\drivers\nglog.sys [2007-8-1 25240]
R3 NgVpn;Aventail VPN Adapter;c:\windows\system32\drivers\ngvpn.sys [2007-8-1 76440]
R3 NgWfp;Aventail VPN Callout;c:\windows\system32\drivers\ngwfp.sys [2007-8-1 21656]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 NgFilter;Aventail VPN Filter;c:\windows\system32\drivers\ngfilter.sys [2007-8-1 20632]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================

2010-12-30 22:27:41 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-12-30 22:27:41 -------- d-----w- c:\progra~2\Spybot - Search & Destroy
2010-12-27 22:04:54 -------- d-----w- c:\windows\pss
2010-12-27 19:58:37 -------- d-----w- c:\users\karenv~1\appdata\roaming\AVG10
2010-12-27 19:57:49 -------- d--h--w- c:\progra~2\Common Files
2010-12-27 19:55:02 -------- d-----w- c:\windows\system32\drivers\AVG
2010-12-27 19:55:01 -------- d-----w- c:\progra~2\AVG10
2010-12-27 19:36:34 -------- d-----w- c:\progra~2\MFAData
2010-12-16 09:01:04 -------- d-----w- C:\c7be0340d3f5faea959ac251e2c467e1
2010-12-15 18:33:40 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
2010-12-13 21:53:34 719832 ----a-w- c:\program files\mozilla firefox\mozcpp19.dll
2010-12-13 21:53:34 16856 ----a-w- c:\program files\mozilla firefox\plugin-container.exe
2010-12-10 23:21:51 749832 ----a-w- c:\progra~2\microsoft\ehome\packages\mcespotlight\mcespotlight\SpotlightResources.dll
2010-12-08 10:12:38 251728 ----a-w- c:\windows\system32\drivers\avgldx86.sys

==================== Find3M ====================

2010-11-29 23:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 23:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-06 11:10:29 345088 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-11-06 11:10:13 357376 ----a-w- c:\windows\system32\taskschd.dll
2010-11-06 11:10:13 270336 ----a-w- c:\windows\system32\taskcomp.dll
2010-11-06 11:09:57 603648 ----a-w- c:\windows\system32\schedsvc.dll
2010-11-05 00:53:47 171520 ----a-w- c:\windows\system32\taskeng.exe
2010-10-28 15:02:24 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-10-28 13:03:07 292352 ----a-w- c:\windows\system32\atmfd.dll
2010-10-28 12:56:58 2048 ----a-w- c:\windows\system32\tzres.dll
2010-10-20 17:45:29 833024 ----a-w- c:\windows\system32\wininet.dll
2010-10-20 17:41:28 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-10-20 16:16:50 389632 ----a-w- c:\windows\system32\html.iec
2010-10-20 15:51:56 1383424 ----a-w- c:\windows\system32\mshtml.tlb
2010-10-18 14:01:05 81920 ----a-w- c:\windows\system32\consent.exe
2010-10-18 13:56:44 2037248 ----a-w- c:\windows\system32\win32k.sys

============= FINISH: 19:40:15.16 ===============

broni · 2010/12/30

Welcome aboard

Attach.txt part of DDS is missing.

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running tools or applying updates other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

TonyV84 · 2010/12/31

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume3
Install Date: 8/22/2008 12:35:02 AM
System Uptime: 12/30/2010 5:56:17 PM (2 hours ago)

Motherboard: Dell Inc. | | 0U990C
Processor: Intel(R) Pentium(R) Dual CPU T2390 @ 1.86GHz | Microprocessor | 1867/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 221 GiB total, 155.054 GiB free.
D: is FIXED (NTFS) - 10 GiB total, 4.889 GiB free.
E: is CDROM ()
F: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP714: 12/12/2010 3:22:38 PM - Scheduled Checkpoint
RP715: 12/13/2010 7:00:55 AM - Restore Operation
RP716: 12/13/2010 6:48:00 PM - Removed Ask Toolbar.
RP717: 12/13/2010 6:50:24 PM - Removed Google Earth.
RP718: 12/14/2010 10:39:05 AM - Scheduled Checkpoint
RP719: 12/15/2010 7:16:19 AM - Scheduled Checkpoint
RP720: 12/15/2010 8:44:20 PM - Scheduled Checkpoint
RP721: 12/16/2010 3:00:41 AM - Windows Update
RP722: 12/16/2010 9:26:30 PM - Scheduled Checkpoint
RP723: 12/17/2010 1:10:27 PM - Scheduled Checkpoint
RP724: 12/18/2010 11:26:29 AM - Scheduled Checkpoint
RP725: 12/19/2010 5:21:43 PM - Scheduled Checkpoint
RP726: 12/21/2010 8:39:01 AM - Scheduled Checkpoint
RP727: 12/21/2010 9:47:54 PM - Scheduled Checkpoint
RP728: 12/26/2010 1:37:58 PM - Scheduled Checkpoint
RP729: 12/27/2010 1:43:14 PM - Installed
RP730: 12/27/2010 1:44:57 PM - Installed AVG 2011
RP731: 12/27/2010 1:46:21 PM - Removed AVG Free 9.0
RP732: 12/27/2010 1:52:53 PM - Installed AVG 2011
RP733: 12/27/2010 4:33:56 PM - Removed Ask Toolbar.
RP734: 12/30/2010 12:13:55 PM - Scheduled Checkpoint
RP735: 12/30/2010 4:04:34 PM - Installed QuickTime
RP736: 12/30/2010 4:17:36 PM - Installed Adobe Reader X.

==== Hosts File Hijack ======================

Hosts: 74.125.45.100 4-open-davinci.com
Hosts: 74.125.45.100 securitysoftwarepayments.com
Hosts: 74.125.45.100 privatesecuredpayments.com
Hosts: 74.125.45.100 secure.privatesecuredpayments.com
Hosts: 74.125.45.100 getantivirusplusnow.com
Hosts: 74.125.45.100 secure-plus-payments.com
Hosts: 74.125.45.100 www.getantivirusplusnow.com
Hosts: 74.125.45.100 www.secure-plus-payments.com
Hosts: 74.125.45.100 www.getavplusnow.com
Hosts: 74.125.45.100 safebrowsing-cache.google.com
Hosts: 74.125.45.100 urs.microsoft.com
Hosts: 74.125.45.100 www.securesoftwarebill.com
Hosts: 74.125.45.100 secure.paysecuresystem.com
Hosts: 74.125.45.100 paysoftbillsolution.com
Hosts: 74.125.45.100 protected.maxisoftwaremart.com
Hosts: 217.23.7.114 www.google.com
Hosts: 217.23.7.114 google.com
Hosts: 217.23.7.114 google.com.au
Hosts: 217.23.7.114 www.google.com.au
Hosts: 217.23.7.114 google.be
Hosts: 217.23.7.114 www.google.be
Hosts: 217.23.7.114 google.com.br
Hosts: 217.23.7.114 www.google.com.br
Hosts: 217.23.7.114 google.ca
Hosts: 217.23.7.114 www.google.ca
Hosts: 217.23.7.114 google.ch
Hosts: 217.23.7.114 www.google.ch
Hosts: 217.23.7.114 google.de
Hosts: 217.23.7.114 www.google.de
Hosts: 217.23.7.114 google.dk
Hosts: 217.23.7.114 www.google.dk
Hosts: 217.23.7.114 google.fr
Hosts: 217.23.7.114 www.google.fr
Hosts: 217.23.7.114 google.ie
Hosts: 217.23.7.114 www.google.ie
Hosts: 217.23.7.114 google.it
Hosts: 217.23.7.114 www.google.it
Hosts: 217.23.7.114 google.co.jp
Hosts: 217.23.7.114 www.google.co.jp
Hosts: 217.23.7.114 google.nl
Hosts: 217.23.7.114 www.google.nl
Hosts: 217.23.7.114 google.no
Hosts: 217.23.7.114 www.google.no
Hosts: 217.23.7.114 google.co.nz
Hosts: 217.23.7.114 www.google.co.nz
Hosts: 217.23.7.114 google.pl
Hosts: 217.23.7.114 www.google.pl
Hosts: 217.23.7.114 google.se
Hosts: 217.23.7.114 www.google.se
Hosts: 217.23.7.114 google.co.uk
Hosts: 217.23.7.114 www.google.co.uk
Hosts: 217.23.7.114 google.co.za
Hosts: 217.23.7.114 www.google.co.za
Hosts: 217.23.7.114 www.google-analytics.com
Hosts: 217.23.7.114 www.bing.com
Hosts: 217.23.7.114 search.yahoo.com
Hosts: 217.23.7.114 www.search.yahoo.com
Hosts: 217.23.7.114 uk.search.yahoo.com
Hosts: 217.23.7.114 ca.search.yahoo.com
Hosts: 217.23.7.114 de.search.yahoo.com
Hosts: 217.23.7.114 fr.search.yahoo.com
Hosts: 217.23.7.114 au.search.yahoo.com

==== Installed Programs ======================

1500
1500_Help
1500Trb
32 Bit HP CIO Components Installer
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X
Adobe Shockwave Player 11.5
Advanced Audio FX Engine
Advanced Video FX Engine
AIO_CDB_ProductContext
AIO_CDB_Software
AIO_Scan
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Aventail Access Manager
Aventail Connect
Aventail Webifiers
AVG 2011
Banctec Service Agreement
Bonjour
Browser Address Error Redirector
BufferChm
CCleaner
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Citrix Presentation Server Client
Compatibility Pack for the 2007 Office system
Conexant HDA D330 MDC V.92 Modem
CustomerResearchQFolder
Defraggler
Dell-eBay
Dell Best of Web
Dell DataSafe Online
Dell Dock
Dell Getting Started Guide
Dell Support Center
Dell Touchpad
Dell Webcam Center
Dell Webcam Manager
Dell Wireless WLAN Card
Digital Line Detect
DING!
DocProc
DocProcQFolder
EDocs
ExamView Assessment Suite
Fax
GearDrvs
GoToAssist 8.0.0.514
HASP4 Device Drivers
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Customer Participation Program 8.0
HP OCR Software 8.0
HP Photosmart Essential
HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
HP Update
HPSSupply
Intel(R) Matrix Storage Manager
iTunes
Java(TM) 6 Update 5
Junk Mail filter update
Laptop Integrated Webcam Driver (1.04.01.1011)
Live! Cam Avatar Creator
Live! Cam Avatar v1.0
LiveUpdate (Symantec Corporation)
Logitech Harmony Remote Software 7
Malwarebytes' Anti-Malware
MarketResearch
MediaDirect
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word 2003
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Modem Diagnostic Tool
Move Media Player
Mozilla Firefox (3.6.13)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NetWaiting
NoteBurner 2.25
OGA Notifier 2.0.0048.0
OutlookAddinSetup
QuickSet
QuickTime
RealPlayer
Remove Game Show Presenter PLUS
ResponseCard AnyWhere Desktop
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
Scan
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2289158)
Security Update for 2007 Microsoft Office System (KB2344875)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2345035)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
Security Update for Microsoft Office Publisher 2007 (KB2284697)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Skype Toolbars
Skype™ 4.2
Spybot - Search & Destroy
The Weather Channel Desktop 6
Toolbox
TurningPoint 2008
TurningPoint AnyWhere 2008
UnloadSupport
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2412171)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (KB2466076)
WebReg
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Media Player Firefox Plugin
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Search Protection
Yahoo! Software Update
Yahoo! Toolbar

==== End Of File ===========================

broni · 2010/12/31

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

[color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

[color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.pif
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

TonyV84 · 2010/12/31

ComboFix 10-12-31.01 - Karen Vercellino 12/31/2010 12:43:22.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2037.1174 [GMT -6:00]
Running from: c:\users\Karen Vercellino\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-11-28 to 2010-12-31 )))))))))))))))))))))))))))))))
.

2010-12-30 22:27 . 2010-12-30 23:09 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-12-30 22:27 . 2010-12-30 22:30 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-12-30 22:16 . 2010-12-30 22:16 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-12-27 19:57 . 2010-12-27 19:57 -------- d--h--w- c:\programdata\Common Files
2010-12-27 19:55 . 2010-12-31 18:25 -------- d-----w- c:\windows\system32\drivers\AVG
2010-12-26 22:47 . 2010-12-26 22:48 -------- d-----w- c:\programdata\Yahoo! Companion
2010-12-16 09:01 . 2010-12-16 09:03 -------- d-----w- C:\c7be0340d3f5faea959ac251e2c467e1
2010-12-15 18:33 . 2010-11-03 10:51 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2010-12-13 21:53 . 2010-12-15 17:32 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe
2010-12-13 21:53 . 2010-12-15 17:32 719832 ----a-w- c:\program files\Mozilla Firefox\mozcpp19.dll
2010-12-10 23:21 . 2010-12-10 23:21 749832 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-21 00:09 . 2010-06-13 02:33 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-21 00:08 . 2010-06-13 02:33 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-29 23:38 . 2010-11-29 23:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 23:38 . 2010-11-29 23:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2007-06-21 23:38 . 2007-06-21 23:38 30280 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2007-06-21 23:38 . 2007-06-21 23:38 79432 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2007-06-21 23:38 . 2007-06-21 23:38 71240 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2007-06-21 23:38 . 2007-06-21 23:38 140872 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2007-06-21 23:39 . 2007-06-21 23:39 38472 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2007-06-21 23:39 . 2007-06-21 23:39 46664 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2007-06-21 23:39 . 2007-06-21 23:39 34376 ----a-w- c:\program files\mozilla firefox\plugins\logging.dll
2007-06-21 23:39 . 2007-06-21 23:39 685640 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2007-06-21 23:40 . 2007-06-21 23:40 30280 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter "= "c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"Apoint "= "c:\program files\DellTPad\Apoint.exe" [2008-05-04 167936]
"OEM02Mon.exe "= "c:\windows\OEM02Mon.exe" [2008-03-04 36864]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2008-03-06 141848]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2008-03-06 166424]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2008-03-06 133656]
"IAAnotif "= "c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"Broadcom Wireless Manager UI "= "c:\windows\system32\WLTRAY.exe" [2008-05-19 3444736]
"dscactivate "= "c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PCMService "= "c:\program files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-28 198160]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"Malwarebytes' Anti-Malware (reboot) "= "c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-21 963976]

c:\users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]

c:\users\Karen Vercellino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-8-22 50688]

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser "= 2 (0x2)
"EnableUIADesktopToggle "= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-08-22 11:06 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux "=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "

[HKLM\~\startupfolder\C:^Users^Karen Vercellino^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^DING!.lnk]
path=c:\users\Karen Vercellino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DING!.lnk
backup=c:\windows\pss\DING!.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DW6]
2009-10-08 18:13 818288 ----a-w- c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-04-28 20:06 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-12-21 00:08 963976 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2010-12-21 00:08 963976 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-11-05 03:04 6174008 ----a-w- c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 22:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NoteBurner]
2008-12-02 18:02 5668864 ----a-w- c:\program files\NoteBurner\VTBurnerGUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 23:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shockwave Updater]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2008-01-21 02:23 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-05-13 21:12 26192168 ----a-r- c:\program files\Skype\Phone\Skype.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 NgFilter;Aventail VPN Filter;c:\windows\system32\DRIVERS\ngfilter.sys [2007-08-01 20632]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 ntcdrdrv;ntcdrdrv;c:\windows\system32\DRIVERS\ntcdrdrv.sys [2008-11-27 13440]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-11-12 73728]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]
S2 NgVpnMgr;Aventail VPN Client;c:\windows\system32\ngvpnmgr.exe [2007-08-01 203843]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2008-03-06 111616]
S3 NgLog;Aventail VPN Logging;c:\windows\system32\DRIVERS\nglog.sys [2007-08-01 25240]
S3 NgVpn;Aventail VPN Adapter;c:\windows\system32\DRIVERS\ngvpn.sys [2007-08-01 76440]
S3 NgWfp;Aventail VPN Callout;c:\windows\system32\DRIVERS\ngwfp.sys [2007-08-01 21656]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-12-31 c:\windows\Tasks\User_Feed_Synchronization-{751D9FE1-1690-43E1-A19C-7DA33A553AF7}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyServer = http=127.0.0.1:5577
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Karen Vercellino\AppData\Roaming\Mozilla\Firefox\Profiles\piy9drwo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\users\Karen Vercellino\AppData\Roaming\Move Networks
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
MSConfigStartUp-DRWAkcmd - c:\users\KARENV~1\AppData\Local\Temp\iexphone.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-31 12:50
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
Completion time: 2010-12-31 12:52:44
ComboFix-quarantined-files.txt 2010-12-31 18:52

Pre-Run: 166,623,330,304 bytes free
Post-Run: 166,591,631,360 bytes free

- - End Of File - - CFE3BBD07E3A0ED36A1D62B48FE4371B

broni · 2010/12/31

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:5577
uInternet Settings,ProxyOverride = <local>
3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

TonyV84 · 2010/12/31

ComboFix 10-12-31.01 - Karen Vercellino 12/31/2010 15:25:16.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2037.988 [GMT -6:00]
Running from: c:\users\Karen Vercellino\Desktop\ComboFix.exe
Command switches used :: c:\users\Karen Vercellino\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-11-28 to 2010-12-31 )))))))))))))))))))))))))))))))
.

2010-12-31 21:33 . 2010-12-31 21:33 -------- d-----w- c:\users\Karen Vercellino\AppData\Local\temp
2010-12-31 21:33 . 2010-12-31 21:33 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-12-31 21:33 . 2010-12-31 21:33 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-12-30 22:27 . 2010-12-30 23:09 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-12-30 22:27 . 2010-12-30 22:30 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-12-30 22:16 . 2010-12-30 22:16 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-12-27 19:57 . 2010-12-27 19:57 -------- d--h--w- c:\programdata\Common Files
2010-12-27 19:55 . 2010-12-31 18:25 -------- d-----w- c:\windows\system32\drivers\AVG
2010-12-26 22:47 . 2010-12-26 22:48 -------- d-----w- c:\programdata\Yahoo! Companion
2010-12-16 09:01 . 2010-12-16 09:03 -------- d-----w- C:\c7be0340d3f5faea959ac251e2c467e1
2010-12-15 18:33 . 2010-11-03 10:51 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2010-12-13 21:53 . 2010-12-15 17:32 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe
2010-12-13 21:53 . 2010-12-15 17:32 719832 ----a-w- c:\program files\Mozilla Firefox\mozcpp19.dll
2010-12-10 23:21 . 2010-12-10 23:21 749832 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-21 00:09 . 2010-06-13 02:33 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-21 00:08 . 2010-06-13 02:33 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-29 23:38 . 2010-11-29 23:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 23:38 . 2010-11-29 23:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2007-06-21 23:38 . 2007-06-21 23:38 30280 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2007-06-21 23:38 . 2007-06-21 23:38 79432 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2007-06-21 23:38 . 2007-06-21 23:38 71240 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2007-06-21 23:38 . 2007-06-21 23:38 140872 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2007-06-21 23:39 . 2007-06-21 23:39 38472 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2007-06-21 23:39 . 2007-06-21 23:39 46664 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2007-06-21 23:39 . 2007-06-21 23:39 34376 ----a-w- c:\program files\mozilla firefox\plugins\logging.dll
2007-06-21 23:39 . 2007-06-21 23:39 685640 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2007-06-21 23:40 . 2007-06-21 23:40 30280 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter "= "c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"Apoint "= "c:\program files\DellTPad\Apoint.exe" [2008-05-04 167936]
"OEM02Mon.exe "= "c:\windows\OEM02Mon.exe" [2008-03-04 36864]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2008-03-06 141848]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2008-03-06 166424]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2008-03-06 133656]
"IAAnotif "= "c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"Broadcom Wireless Manager UI "= "c:\windows\system32\WLTRAY.exe" [2008-05-19 3444736]
"dscactivate "= "c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PCMService "= "c:\program files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-28 198160]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"Malwarebytes' Anti-Malware (reboot) "= "c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-21 963976]

c:\users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]

c:\users\Karen Vercellino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-8-22 50688]

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser "= 2 (0x2)
"EnableUIADesktopToggle "= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-08-22 11:06 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux "=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "

[HKLM\~\startupfolder\C:^Users^Karen Vercellino^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^DING!.lnk]
path=c:\users\Karen Vercellino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DING!.lnk
backup=c:\windows\pss\DING!.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DW6]
2009-10-08 18:13 818288 ----a-w- c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-04-28 20:06 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-12-21 00:08 963976 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2010-12-21 00:08 963976 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-11-05 03:04 6174008 ----a-w- c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 22:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NoteBurner]
2008-12-02 18:02 5668864 ----a-w- c:\program files\NoteBurner\VTBurnerGUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 23:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shockwave Updater]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2008-01-21 02:23 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-05-13 21:12 26192168 ----a-r- c:\program files\Skype\Phone\Skype.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 NgFilter;Aventail VPN Filter;c:\windows\system32\DRIVERS\ngfilter.sys [2007-08-01 20632]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 ntcdrdrv;ntcdrdrv;c:\windows\system32\DRIVERS\ntcdrdrv.sys [2008-11-27 13440]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-11-12 73728]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]
S2 NgVpnMgr;Aventail VPN Client;c:\windows\system32\ngvpnmgr.exe [2007-08-01 203843]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2008-03-06 111616]
S3 NgLog;Aventail VPN Logging;c:\windows\system32\DRIVERS\nglog.sys [2007-08-01 25240]
S3 NgVpn;Aventail VPN Adapter;c:\windows\system32\DRIVERS\ngvpn.sys [2007-08-01 76440]
S3 NgWfp;Aventail VPN Callout;c:\windows\system32\DRIVERS\ngwfp.sys [2007-08-01 21656]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-12-31 c:\windows\Tasks\User_Feed_Synchronization-{751D9FE1-1690-43E1-A19C-7DA33A553AF7}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Karen Vercellino\AppData\Roaming\Mozilla\Firefox\Profiles\piy9drwo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\users\Karen Vercellino\AppData\Roaming\Move Networks
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-31 15:33
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
Completion time: 2010-12-31 15:34:59
ComboFix-quarantined-files.txt 2010-12-31 21:34
ComboFix2.txt 2010-12-31 18:52

Pre-Run: 166,634,000,384 bytes free
Post-Run: 166,585,675,776 bytes free

- - End Of File - - 79717D24F570DB35C51402B54680CA4F

broni · 2010/12/31

Looks good

How is redirection?

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

TonyV84 · 2010/12/31

OTL logfile created on: 12/31/2010 4:01:50 PM - Run 1
OTL by OldTimer - Version 3.2.18.2 Folder = C:\Users\Karen Vercellino\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 53.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 220.58 Gb Total Space | 155.21 Gb Free Space | 70.36% Space Free | Partition Type: NTFS
Drive D: | 9.77 Gb Total Space | 4.89 Gb Free Space | 50.06% Space Free | Partition Type: NTFS

Computer Name: KARENS_LAPTOP | User Name: Karen Vercellino | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/12/31 16:00:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Karen Vercellino\Desktop\OTL.exe
PRC - [2010/04/16 07:33:40 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2009/05/28 10:00:34 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/10/29 00:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/05/04 03:25:32 | 000,040,960 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\hidfind.exe
PRC - [2008/05/04 03:25:26 | 000,167,936 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\Apoint.exe
PRC - [2008/05/04 03:25:26 | 000,050,736 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\ApMsgFwd.exe
PRC - [2008/05/04 03:25:26 | 000,049,152 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\ApntEx.exe
PRC - [2008/04/28 15:56:28 | 000,161,048 | ---- | M] (Stardock Corporation) -- C:\Program Files\Dell\DellDock\DockLogin.exe
PRC - [2008/03/03 23:05:24 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM02Mon.exe
PRC - [2008/02/21 16:02:53 | 000,238,968 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2007/12/21 09:58:06 | 000,184,320 | ---- | M] (CyberLink Corp.) -- C:\Program Files\Dell\MediaDirect\PCMService.exe
PRC - [2007/11/12 05:07:20 | 000,102,400 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\stacsv.exe
PRC - [2007/11/12 05:07:16 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEstSrv.exe
PRC - [2007/08/01 17:04:34 | 000,203,843 | ---- | M] (Aventail Corporation) -- C:\Windows\System32\ngvpnmgr.exe
PRC - [2007/03/21 12:00:04 | 000,355,096 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007/03/21 12:00:00 | 000,174,872 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2006/11/03 17:02:14 | 000,050,688 | ---- | M] (Avanquest Software ) -- C:\Program Files\Digital Line Detect\DLG.exe

========== Modules (SafeList) ==========

MOD - [2010/12/31 16:00:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Karen Vercellino\Desktop\OTL.exe
MOD - [2010/08/31 09:39:57 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/04/16 07:33:40 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/03/18 12:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/09/05 11:52:32 | 003,220,856 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE -- (LiveUpdate)
SRV - [2008/08/22 05:06:59 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist)
SRV - [2008/04/28 15:56:28 | 000,161,048 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV - [2008/02/21 16:02:53 | 000,238,968 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2008/01/20 20:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/11/12 05:07:20 | 000,102,400 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\stacsv.exe -- (STacSV)
SRV - [2007/11/12 05:07:16 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEstSrv.exe -- (AESTFilters)
SRV - [2007/08/01 17:04:34 | 000,203,843 | ---- | M] (Aventail Corporation) [Auto | Running] -- C:\Windows\System32\ngvpnmgr.exe -- (NgVpnMgr)
SRV - [2007/03/21 12:00:04 | 000,355,096 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\KARENV~1\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BCM42RLY.sys -- (BCM42RLY)
DRV - [2008/11/27 15:10:24 | 000,013,440 | ---- | M] (NoteBurn Software) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\ntcdrdrv.sys -- (ntcdrdrv)
DRV - [2008/06/23 06:45:44 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2008/06/23 06:45:40 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DPV.sys -- (HSF_DPV)
DRV - [2008/06/23 06:45:40 | 000,661,504 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
DRV - [2008/06/23 06:45:38 | 000,208,384 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWAZL.sys -- (HSXHWAZL)
DRV - [2008/05/19 00:26:02 | 001,044,984 | ---- | M] (Broadcom Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XX)
DRV - [2008/05/04 03:25:24 | 000,164,400 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2008/03/06 01:58:44 | 000,111,616 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV - [2008/03/06 01:58:12 | 002,016,256 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2008/03/03 23:05:34 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM02Vfx.sys -- (OEM02Vfx)
DRV - [2008/03/03 23:05:18 | 000,235,648 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM02Dev.sys -- (OEM02Dev)
DRV - [2008/01/20 20:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)
DRV - [2008/01/20 20:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2008/01/20 20:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2008/01/20 20:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2008/01/20 20:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2008/01/20 20:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2008/01/20 20:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2008/01/20 20:23:25 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2008/01/20 20:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2008/01/20 20:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2008/01/20 20:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2008/01/20 20:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2008/01/20 20:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2008/01/20 20:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2008/01/20 20:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2008/01/20 20:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2008/01/20 20:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2008/01/20 20:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2008/01/20 20:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2008/01/20 20:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2008/01/20 20:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2008/01/20 20:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2008/01/20 20:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2008/01/20 20:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008/01/20 20:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2008/01/20 20:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2007/11/12 05:07:28 | 000,330,240 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2007/09/28 23:31:54 | 000,278,528 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk60x86.sys -- (yukonwlh)
DRV - [2007/09/06 10:43:26 | 000,304,920 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\iastor.sys -- (iaStor)
DRV - [2007/09/06 10:35:16 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007/09/06 10:35:14 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007/09/06 10:35:12 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2007/08/01 17:03:52 | 000,021,656 | ---- | M] (Aventail Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ngwfp.sys -- (NgWfp)
DRV - [2007/08/01 17:03:46 | 000,020,632 | ---- | M] (Aventail Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ngfilter.sys -- (NgFilter)
DRV - [2007/08/01 17:03:40 | 000,076,440 | ---- | M] (Aventail Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ngvpn.sys -- (NgVpn)
DRV - [2007/08/01 17:02:22 | 000,025,240 | ---- | M] (Aventail Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nglog.sys -- (NgLog)
DRV - [2006/11/02 03:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 03:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 03:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 03:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 03:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 03:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 03:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 03:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 03:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 03:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 03:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 02:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 02:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 02:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 02:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 02:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 02:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 01:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 01:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2005/07/28 07:18:40 | 000,685,056 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\hardlock.sys -- (Hardlock)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr9/*http://www.yahoo.com/ext/search/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com "
FF - prefs.js..browser.search.defaultenginename: "Ask.com "
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p= "
FF - prefs.js..browser.search.order.1: "Ask.com "
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff- "
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff- "
FF - prefs.js..browser.search.selectedEngine: "Yahoo "
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/ "
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.%(version)s
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..keyword.URL: "http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= "

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/05/28 10:00:47 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/30 16:07:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/30 16:19:52 | 000,000,000 | ---D | M]

[2008/12/22 11:01:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Karen Vercellino\AppData\Roaming\Mozilla\Extensions
[2010/12/31 07:16:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Karen Vercellino\AppData\Roaming\Mozilla\Firefox\Profiles\piy9drwo.default\extensions
[2010/04/27 05:40:58 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Karen Vercellino\AppData\Roaming\Mozilla\Firefox\Profiles\piy9drwo.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/12/26 16:48:04 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Karen Vercellino\AppData\Roaming\Mozilla\Firefox\Profiles\piy9drwo.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/12/26 19:45:01 | 000,002,557 | ---- | M] () -- C:\Users\Karen Vercellino\AppData\Roaming\Mozilla\Firefox\Profiles\piy9drwo.default\searchplugins\askcom.xml
[2010/03/28 10:04:34 | 000,002,476 | ---- | M] () -- C:\Users\Karen Vercellino\AppData\Roaming\Mozilla\Firefox\Profiles\piy9drwo.default\searchplugins\BearShareWebSearch.xml
[2010/12/27 16:02:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/06/24 14:09:59 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/01/30 16:30:16 | 000,000,000 | ---D | M] (Move Media Player) -- C:\USERS\KAREN VERCELLINO\APPDATA\ROAMING\MOVE NETWORKS
[2007/06/21 17:38:54 | 000,079,432 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\CgpCore.dll
[2007/06/21 17:38:56 | 000,071,240 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\confmgr.dll
[2007/06/21 17:39:18 | 000,034,376 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\logging.dll
[2007/06/21 17:39:34 | 000,325,200 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npicaN.dll
[2007/06/21 17:40:02 | 000,030,280 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\TcpPServ.dll
[2010/03/28 10:04:34 | 000,002,476 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\BearShareWebSearch.xml

O1 HOSTS File: ([2010/09/11 11:32:59 | 000,002,670 | RHS- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 urs.microsoft.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com
O1 - Hosts: 217.23.7.114 www.google.com
O1 - Hosts: 217.23.7.114 google.com
O1 - Hosts: 217.23.7.114 google.com.au
O1 - Hosts: 217.23.7.114 www.google.com.au
O1 - Hosts: 217.23.7.114 google.be
O1 - Hosts: 217.23.7.114 www.google.be
O1 - Hosts: 217.23.7.114 google.com.br
O1 - Hosts: 217.23.7.114 www.google.com.br
O1 - Hosts: 39 more lines...
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Yahooo Search Protection) - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - Startup: C:\Users\Karen Vercellino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 2
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img19.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img19.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 15:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\PROGRA~1\AVG\AVG10\avgchsvx.exe File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\PROGRA~1\AVG\AVG10\avgrsx.exe File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/12/31 16:00:39 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Karen Vercellino\Desktop\OTL.exe
[2010/12/31 15:35:01 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010/12/31 15:35:01 | 000,000,000 | ---D | C] -- C:\Users\Karen Vercellino\AppData\Local\temp
[2010/12/31 15:34:04 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010/12/31 15:22:43 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010/12/31 12:39:25 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010/12/31 12:39:25 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010/12/31 12:39:25 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010/12/31 12:37:57 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/12/31 12:33:34 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/12/31 12:18:33 | 005,473,272 | ---- | C] (OPSWAT, Inc.) -- C:\Users\Karen Vercellino\Desktop\AppRemover.exe
[2010/12/30 19:27:50 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Karen Vercellino\Desktop\TFC.exe
[2010/12/30 16:27:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2010/12/30 16:27:41 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2010/12/30 16:19:01 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2010/12/30 16:16:35 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
[2010/12/30 16:07:09 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010/12/27 16:12:21 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2010/12/27 16:04:54 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2010/12/27 13:57:49 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2010/12/27 13:55:02 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\AVG
[2010/12/26 16:47:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo! Companion
[2010/12/16 03:01:04 | 000,000,000 | ---D | C] -- C:\c7be0340d3f5faea959ac251e2c467e1
[1 C:\Users\Karen Vercellino\Documents\*.tmp files -> C:\Users\Karen Vercellino\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/12/31 16:00:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Karen Vercellino\Desktop\OTL.exe
[2010/12/31 16:00:36 | 000,604,502 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/12/31 16:00:36 | 000,108,772 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/12/31 15:58:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/12/31 15:36:53 | 008,405,015 | ---- | M] () -- C:\Windows\TempFile
[2010/12/31 15:36:52 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/12/31 15:36:52 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/12/31 15:36:43 | 2137,042,944 | -HS- | M] () -- C:\hiberfil.sys
[2010/12/31 12:38:14 | 004,012,194 | R--- | M] () -- C:\Users\Karen Vercellino\Desktop\ComboFix.exe
[2010/12/31 12:18:43 | 005,473,272 | ---- | M] (OPSWAT, Inc.) -- C:\Users\Karen Vercellino\Desktop\AppRemover.exe
[2010/12/31 10:04:06 | 000,000,440 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{751D9FE1-1690-43E1-A19C-7DA33A553AF7}.job
[2010/12/30 19:50:00 | 000,000,056 | -H-- | M] () -- C:\Windows\System32\ezsidmv.dat
[2010/12/30 19:32:02 | 000,624,128 | ---- | M] () -- C:\Users\Karen Vercellino\Desktop\dds.scr
[2010/12/30 19:31:50 | 000,080,384 | ---- | M] () -- C:\Users\Karen Vercellino\Desktop\MBRCheck.exe
[2010/12/30 19:29:43 | 000,296,448 | ---- | M] () -- C:\Users\Karen Vercellino\Desktop\0fsd1h59.exe
[2010/12/30 19:28:00 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Karen Vercellino\Desktop\TFC.exe
[2010/12/30 16:19:55 | 000,001,894 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2010/12/30 12:03:41 | 000,005,972 | ---- | M] () -- C:\Users\Karen Vercellino\AppData\Local\d3d9caps.dat
[2010/12/28 11:29:24 | 000,015,725 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\Clinical 155-03 Vercellino.docm
[2010/12/28 11:12:22 | 000,015,402 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\Clinical NURS 155 -02.docm
[2010/12/28 10:58:55 | 000,048,128 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\Clinical rotation 155 -01.doc
[2010/12/27 13:38:56 | 000,000,000 | ---- | M] () -- C:\Users\Karen Vercellino\AppData\Local\prvlcl.dat
[2010/12/26 16:47:19 | 000,000,966 | ---- | M] () -- C:\Users\Karen Vercellino\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2010/12/26 16:47:19 | 000,000,942 | ---- | M] () -- C:\Users\Public\Desktop\Yahoo! Messenger.lnk
[2010/12/23 17:11:43 | 000,012,353 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\Carol Wood - Professor emeritus nomination.docx
[2010/12/21 12:59:57 | 000,010,357 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\Math 1550.docx
[2010/12/21 12:59:29 | 000,002,627 | ---- | M] () -- C:\Users\Karen Vercellino\Desktop\Microsoft Office Word 2007.lnk
[2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/12/17 14:43:51 | 006,806,528 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\Getting to know Karen.ppt
[2010/12/16 19:04:08 | 000,026,624 | ---- | M] () -- C:\Users\Karen Vercellino\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/16 19:03:41 | 002,210,044 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\Hemorrhagic_stroke_ani.mpg
[2010/12/16 19:03:40 | 003,554,890 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\Ischemic_Stroke_ani.mpeg
[2010/12/16 05:41:09 | 000,380,344 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/12/13 18:32:13 | 000,003,902 | ---- | M] () -- C:\Users\Karen Vercellino\AppData\Roaming\evpro32.prf
[2010/12/13 15:57:35 | 000,001,750 | ---- | M] () -- C:\Users\Karen Vercellino\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/12/13 15:57:35 | 000,001,726 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/12/12 17:32:20 | 000,035,328 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\Calculation Final #2.doc
[2010/12/12 17:27:31 | 000,035,840 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\Nursing 154 Calculation Final #3.doc
[2010/12/10 08:04:58 | 000,012,920 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\Study Guide for Nursing 154.docx
[2010/12/07 16:32:18 | 000,059,306 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\MS EXAM FALL 2010.tst
[2010/12/06 15:40:37 | 000,013,164 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\Study Guide for Nursing 154 Final.docx
[2010/12/06 06:48:12 | 000,030,208 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\michael schedule.doc
[2010/12/05 16:21:05 | 000,065,536 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\154_Final[1].doc
[2010/12/04 12:26:18 | 000,023,925 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\Final Exam edit.docx
[2010/12/04 06:13:21 | 000,004,320 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\felix.jpg
[2010/12/03 12:32:43 | 000,019,432 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\Cha paper.docx
[2010/12/03 11:36:19 | 000,012,366 | ---- | M] () -- C:\Users\Karen Vercellino\Documents\December 3.docx
[1 C:\Users\Karen Vercellino\Documents\*.tmp files -> C:\Users\Karen Vercellino\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/31 12:39:25 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010/12/31 12:39:25 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010/12/31 12:39:25 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2010/12/31 12:39:25 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010/12/31 12:39:25 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010/12/31 12:16:53 | 004,012,194 | R--- | C] () -- C:\Users\Karen Vercellino\Desktop\ComboFix.exe
[2010/12/30 19:50:00 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010/12/30 19:31:57 | 000,624,128 | ---- | C] () -- C:\Users\Karen Vercellino\Desktop\dds.scr
[2010/12/30 19:31:44 | 000,080,384 | ---- | C] () -- C:\Users\Karen Vercellino\Desktop\MBRCheck.exe
[2010/12/30 19:29:35 | 000,296,448 | ---- | C] () -- C:\Users\Karen Vercellino\Desktop\0fsd1h59.exe
[2010/12/30 17:55:10 | 2137,042,944 | -HS- | C] () -- C:\hiberfil.sys
[2010/12/30 16:19:55 | 000,001,894 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2010/12/23 17:11:42 | 000,012,353 | ---- | C] () -- C:\Users\Karen Vercellino\Documents\Carol Wood - Professor emeritus nomination.docx
[2010/12/21 12:59:56 | 000,010,357 | ---- | C] () -- C:\Users\Karen Vercellino\Documents\Math 1550.docx
[2010/12/17 14:43:46 | 006,806,528 | ---- | C] () -- C:\Users\Karen Vercellino\Documents\Getting to know Karen.ppt
[2010/12/12 17:27:30 | 000,035,840 | ---- | C] () -- C:\Users\Karen Vercellino\Documents\Nursing 154 Calculation Final #3.doc
[2010/12/10 08:04:57 | 000,012,920 | ---- | C] () -- C:\Users\Karen Vercellino\Documents\Study Guide for Nursing 154.docx
[2010/12/07 16:32:17 | 000,059,306 | ---- | C] () -- C:\Users\Karen Vercellino\Documents\MS EXAM FALL 2010.tst
[2010/12/07 07:03:20 | 000,035,328 | ---- | C] () -- C:\Users\Karen Vercellino\Documents\Calculation Final #2.doc
[2010/12/06 15:40:36 | 000,013,164 | ---- | C] () -- C:\Users\Karen Vercellino\Documents\Study Guide for Nursing 154 Final.docx
[2010/12/06 06:48:11 | 000,030,208 | ---- | C] () -- C:\Users\Karen Vercellino\Documents\michael schedule.doc
[2010/12/04 12:26:18 | 000,023,925 | ---- | C] () -- C:\Users\Karen Vercellino\Documents\Final Exam edit.docx
[2010/12/04 06:13:20 | 000,004,320 | ---- | C] () -- C:\Users\Karen Vercellino\Documents\felix.jpg
[2010/12/03 12:08:35 | 000,019,432 | ---- | C] () -- C:\Users\Karen Vercellino\Documents\Cha paper.docx
[2010/12/03 11:25:20 | 000,012,366 | ---- | C] () -- C:\Users\Karen Vercellino\Documents\December 3.docx
[2010/06/18 06:33:18 | 000,000,000 | ---- | C] () -- C:\Users\Karen Vercellino\AppData\Local\prvlcl.dat
[2010/05/09 13:21:27 | 000,005,130 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2010/05/09 08:00:11 | 000,076,407 | ---- | C] () -- C:\Users\Karen Vercellino\AppData\Roaming\Smiley.ico
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/05/28 10:02:36 | 000,000,025 | ---- | C] () -- C:\Windows\cdplayer.ini
[2009/03/29 13:19:52 | 000,000,074 | ---- | C] () -- C:\Users\Karen Vercellino\AppData\Roaming\evplay.prf
[2009/03/29 13:19:26 | 000,001,176 | ---- | C] () -- C:\Users\Karen Vercellino\AppData\Roaming\evmanage.prf
[2009/03/25 16:24:23 | 000,004,096 | -H-- | C] () -- C:\Users\Karen Vercellino\AppData\Local\keyfile3.drm
[2009/02/24 09:39:22 | 000,003,902 | ---- | C] () -- C:\Users\Karen Vercellino\AppData\Roaming\evpro32.prf
[2008/12/18 10:21:25 | 000,005,972 | ---- | C] () -- C:\Users\Karen Vercellino\AppData\Local\d3d9caps.dat
[2008/09/01 02:02:11 | 000,026,624 | ---- | C] () -- C:\Users\Karen Vercellino\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/08/29 13:45:21 | 000,001,068 | ---- | C] () -- C:\Users\Karen Vercellino\AppData\Roaming\wklnhst.dat
[2008/08/22 07:28:33 | 001,953,696 | ---- | C] () -- C:\Windows\System32\igklg400.dll
[2008/08/22 07:28:33 | 001,533,360 | ---- | C] () -- C:\Windows\System32\igklg450.dll
[2008/08/22 07:28:33 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1409.dll
[2008/08/22 07:28:33 | 000,104,636 | ---- | C] () -- C:\Windows\System32\igmedcompkrn.dll
[2008/08/22 07:28:33 | 000,004,608 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll
[2008/08/22 07:28:29 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2008/08/22 05:00:47 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2008/08/22 04:53:49 | 000,054,784 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll
[2007/08/01 17:06:14 | 000,106,053 | ---- | C] () -- C:\Windows\ngmsi.dll
[2006/11/02 06:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 04:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006/11/02 01:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

========== LOP Check ==========

[2010/07/12 08:34:11 | 000,000,000 | ---D | M] -- C:\Users\Karen Vercellino\AppData\Roaming\Aventail
[2008/11/10 15:22:11 | 000,000,000 | ---D | M] -- C:\Users\Karen Vercellino\AppData\Roaming\EazyPlanet
[2009/04/08 13:08:31 | 000,000,000 | ---D | M] -- C:\Users\Karen Vercellino\AppData\Roaming\ICAClient
[2010/05/09 14:14:27 | 000,000,000 | ---D | M] -- C:\Users\Karen Vercellino\AppData\Roaming\Image Zone Express
[2010/05/09 08:00:36 | 000,000,000 | ---D | M] -- C:\Users\Karen Vercellino\AppData\Roaming\MusicNet
[2010/05/09 13:39:04 | 000,000,000 | ---D | M] -- C:\Users\Karen Vercellino\AppData\Roaming\Printer Info Cache
[2009/06/20 09:57:30 | 000,000,000 | ---D | M] -- C:\Users\Karen Vercellino\AppData\Roaming\Southwest Airlines
[2009/04/12 16:30:49 | 000,000,000 | ---D | M] -- C:\Users\Karen Vercellino\AppData\Roaming\Template
[2009/12/16 19:40:20 | 000,000,000 | ---D | M] -- C:\Users\Karen Vercellino\AppData\Roaming\Tific
[2009/11/11 10:33:05 | 000,000,000 | ---D | M] -- C:\Users\Karen Vercellino\AppData\Roaming\tmp
[2009/05/27 14:56:17 | 000,000,000 | ---D | M] -- C:\Users\Karen Vercellino\AppData\Roaming\Turning Technologies
[2010/12/31 15:35:57 | 000,032,654 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010/12/31 10:04:06 | 000,000,440 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{751D9FE1-1690-43E1-A19C-7DA33A553AF7}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 15:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2008/01/20 20:24:42 | 000,333,203 | RHS- | M] () -- C:\bootmgr
[2010/12/27 16:03:33 | 000,002,339 | ---- | M] () -- C:\CD3rdPartyWrapper.log
[2010/12/31 15:35:00 | 000,013,018 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 15:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2008/08/22 07:28:46 | 000,003,742 | RH-- | M] () -- C:\dell.sdr
[2010/12/31 15:36:43 | 2137,042,944 | -HS- | M] () -- C:\hiberfil.sys
[2008/12/18 11:22:06 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2008/12/18 11:22:06 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/08/22 04:53:46 | 000,026,927 | ---- | M] () -- C:\newfile.enc
[2008/08/22 04:53:46 | 000,026,927 | ---- | M] () -- C:\newkey
[2010/12/31 15:36:41 | 2450,845,696 | -HS- | M] () -- C:\pagefile.sys
[2008/08/31 12:51:05 | 000,000,158 | ---- | M] () -- C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/11/02 06:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 06:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 06:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 06:37:12 | 000,030,808 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 15:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/01/20 20:23:14 | 000,089,600 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 06:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/07/10 12:15:46 | 000,306,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 20:43:21 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/01/20 21:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 21:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 21:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 04:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 04:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/12/13 14:59:14 | 000,000,286 | -HS- | M] () -- C:\Users\Karen Vercellino\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/12/30 19:29:43 | 000,296,448 | ---- | M] () -- C:\Users\Karen Vercellino\Desktop\0fsd1h59.exe
[2010/12/31 12:18:43 | 005,473,272 | ---- | M] (OPSWAT, Inc.) -- C:\Users\Karen Vercellino\Desktop\AppRemover.exe
[2010/12/31 12:38:14 | 004,012,194 | R--- | M] () -- C:\Users\Karen Vercellino\Desktop\ComboFix.exe
[2010/12/30 19:31:50 | 000,080,384 | ---- | M] () -- C:\Users\Karen Vercellino\Desktop\MBRCheck.exe
[2010/12/31 16:00:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Karen Vercellino\Desktop\OTL.exe
[2010/12/30 19:28:00 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Karen Vercellino\Desktop\TFC.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >
[2007/10/23 08:27:20 | 000,110,592 | ---- | M] () -- C:\Users\Karen Vercellino\cleanup.exe
[2008/02/25 12:47:34 | 003,489,792 | ---- | M] (SanDisk Corporation) -- C:\Users\Karen Vercellino\Launchpad Removal.exe
[2007/10/23 09:17:36 | 004,628,480 | ---- | M] () -- C:\Users\Karen Vercellino\LaunchPad.exe
[2007/10/23 08:44:48 | 000,054,584 | ---- | M] () -- C:\Users\Karen Vercellino\U3AccessGrant.exe

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2008/08/29 12:51:11 | 000,000,402 | -HS- | M] () -- C:\Users\Karen Vercellino\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010/05/09 14:14:18 | 000,005,130 | ---- | M] () -- C:\ProgramData\hpzinstall.log

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Users\Karen Vercellino\Documents\Ischemic_Stroke_ani.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Karen Vercellino\Documents\Hemorrhagic_stroke_ani.mpg:TOC.WMV
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:0B4227B4

< End of report >

TonyV84 · 2010/12/31

OTL Extras logfile created on: 12/31/2010 4:01:50 PM - Run 1
OTL by OldTimer - Version 3.2.18.2 Folder = C:\Users\Karen Vercellino\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 53.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 220.58 Gb Total Space | 155.21 Gb Free Space | 70.36% Space Free | Partition Type: NTFS
Drive D: | 9.77 Gb Total Space | 4.89 Gb Free Space | 50.06% Space Free | Partition Type: NTFS

Computer Name: KARENS_LAPTOP | User Name: Karen Vercellino | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{11DF66FE-6CEE-4444-BC9C-2DD83352E6C0}" = rport=445 | protocol=6 | dir=out | app=system |
"{1E01E7B1-C888-4C35-A5D7-FCD07BAE6C66}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{2AD86CCF-0D01-4815-AD5C-B222D0F75261}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{4AD3F355-8FCC-4CA7-B936-6FCF467477E6}" = rport=139 | protocol=6 | dir=out | app=system |
"{4D09D433-D3D5-4B96-9871-E9AD50F5D82A}" = lport=137 | protocol=17 | dir=in | app=system |
"{53DC7DEA-42CD-40E5-BE25-5B786466CE9D}" = lport=138 | protocol=17 | dir=in | app=system |
"{72CEDA2C-2F41-4F1B-9552-9E34EBE2D1A9}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{73E0A01D-BB2B-4371-8221-0CA0CE85A346}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{89453844-21AD-4C31-8410-1128D7A26095}" = lport=2869 | protocol=6 | dir=in | app=system |
"{8A4D4877-3D12-4EBD-A555-8D880B0C70CF}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A2E0BC02-7E7D-4D5E-B322-0D2499D4B800}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B5D55A84-1F9E-4FED-978A-81D1B94AEA21}" = rport=138 | protocol=17 | dir=out | app=system |
"{C0C7410C-75E9-453B-9FC4-6737BF34041F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D196FF06-66E9-4911-AB80-EFB40F6FA35E}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{E0107C39-3F70-4DDC-9167-A11A93B21AD1}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{E2C5E12D-F30C-44AB-9905-B99FA4D41763}" = lport=139 | protocol=6 | dir=in | app=system |
"{E3DD4525-C5D5-4EBE-B9A0-A607C676C27A}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{E8D05965-B003-47E9-ADEB-D4A57336C610}" = lport=445 | protocol=6 | dir=in | app=system |
"{F854DCF8-C011-4E81-8B0D-FADDDBFC5693}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{F8DDF08D-22A3-4C35-AD1C-43D59C2ECD94}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{FE10B217-7EB9-4D2F-AFF9-37C04D73A7BC}" = rport=137 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0604CCBB-E21B-4AF4-88E5-F26523CE3660}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{1009D26E-BC25-4924-B736-7152E82861D5}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{17C6F6FD-DC0C-45EE-9FD6-18356203EC41}" = protocol=6 | dir=in | app=c:\program files\turning technologies\turningpoint anywhere 2008\turningpoint anywhere.exe |
"{1821F3C4-01ED-4C4F-8AA3-E814471B0E1D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1FDF9E17-5911-449B-97FC-28EB508D32B0}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
"{2733EC31-D148-41A1-A2B9-CE2F7E3E8699}" = dir=in | app=c:\program files\dell\mediadirect\pcmservice.exe |
"{28D25966-EB84-423E-BE3E-3AD3270FADC8}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{2C9D40D2-9263-4C4B-8FDE-AD485ED99F39}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2DE5C9D5-0072-4278-B161-F968AE03CC57}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{35D3B363-4303-4BEE-A0E6-9FE028542C54}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
"{382839F2-A767-4E27-9F1D-5EC825BD0DB7}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{41FD8051-E015-4CCA-8AFC-2656E8A71A48}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
"{44F48419-3F78-4362-A217-F0B624B200C6}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{5527C201-A9A5-490F-B34E-C0F8AFB354DE}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
"{5F13C2D7-E83B-44AD-84C8-FD64CE3FBF33}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{7408AFE1-F4E5-4771-AB37-D9FC886B9BF7}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7E539CD2-F1B3-4DC3-8125-F0A7CBCE00AA}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{8BE010B3-6AEA-4355-963D-1D91099352C5}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
"{A217EED3-3CE0-444F-8F4F-BB25EEB9D8AA}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{AD0DB5FE-2F26-41FB-BA2B-3864C02C91FB}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{B05E54D6-DD9D-4400-AA98-1DE8BA7B02EC}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{BA15493D-04BD-4269-8245-1D81A5CF1C05}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{CB482763-E9A7-41E5-891F-7CDD6B7C21ED}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{CC8A44FA-9740-4D34-8B4D-539411B55937}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{CD93D2A5-1B1B-4BC7-A6F7-F04E379CEAE2}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{CF3A9DB4-3350-4A6C-AFC0-42B61D793B29}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{D0622F73-02D8-468C-82F9-A223184E7D2D}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{DDA7194F-F8AD-427E-9A3C-CD10B4916A2A}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{F2D3432B-EB79-4101-8A80-FD086B783939}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
"{F89C0DE8-15C1-4ED8-AF4C-48FD7DE54171}" = protocol=17 | dir=in | app=c:\program files\turning technologies\turningpoint anywhere 2008\turningpoint anywhere.exe |
"TCP Query User{2F1BFE14-A79D-4D91-97D1-FB67ED0339CA}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"UDP Query User{6AA7D556-AC4F-442F-8F99-BB12AF3C2F86}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0586696B-65B7-4058-B0BC-5C89196704CE}" = TurningPoint AnyWhere 2008
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}" = Live! Cam Avatar v1.0
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23DD6DAA-DDEF-41F5-A527-CECF07FA2CAF}" = 1500
"{294EAADF-E50F-4DD8-AD8D-19587EA10512}" = Modem Diagnostic Tool
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{373C7B28-788D-4528-A4AD-86CB960AB615}" = TurningPoint 2008
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}" = Banctec Service Agreement
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4B6AD248-D3BF-426A-8D64-847288154F13}" = QuickSet
"{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED}" = Dell DataSafe Online
"{4E5386F5-C0F6-4532-A54A-374865AEAB71}" = Cisco PEAP Module
"{54D44AD1-A083-48B9-BD6F-AFD517B7C775}" = Aventail Webifiers
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5C6F884D-680C-448B-B4C9-22296EE1B206}" = Logitech Harmony Remote Software 7
"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
"{663902D0-4E52-4DBB-8D27-EE0889239403}" = ResponseCard AnyWhere Desktop
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}" = EDocs
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{72552C46-944B-4E16-BBC8-0D85F31C1800}" = Aventail Access Manager
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{76F9CF97-FC4B-4E20-B363-D127C888448F}" = Cisco LEAP Module
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update
"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84031A18-BA9A-4156-A74F-E05B52DDFCE2}" = DING!
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{901B0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word 2003
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup
"{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect
"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A2101ACC-DC36-42AA-A576-6FD6A8D466DA}" = 1500_Help
"{A2A78788-2792-49BF-AF22-5E9296E568F3}" = Aventail Connect
"{A4C6B32D-5088-40AF-B74D-CDABEF144F04}" = 1500Trb
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B935C985-A17F-484B-8470-09E4FC27DC26}" = Dell-eBay
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{BF53252E-4AB2-4C7F-A0FD-6100755745E3}" = Cisco EAP-FAST Module
"{C39A4E1F-9AF1-4FE1-A80E-A5B867FABB42}" = Dell Best of Web
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{CB84F0F2-927B-458D-9DC5-87832E3DC653}" = GearDrvs
"{CBD55377-3FEA-4A93-A877-DB87B6C6C990}" = Logitech Harmony Remote Software 7
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{E80F62FF-5D3C-4A19-8409-9721F2928206}" = LiveUpdate (Symantec Corporation)
"{E89956F9-5B89-470E-818D-BD46102D0A01}" = Citrix Presentation Server Client
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F6CB42B9-F033-4152-8813-FF11DA8E6A78}" = Dell Dock
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Advanced Video FX Engine" = Advanced Video FX Engine
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"CCleaner" = CCleaner
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F" = Conexant HDA D330 MDC V.92 Modem
"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)
"Defraggler" = Defraggler
"Dell Webcam Center" = Dell Webcam Center
"Dell Webcam Manager" = Dell Webcam Manager
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ExamView Pro" = ExamView Assessment Suite
"Game Show Presenter PLUS" = Remove Game Show Presenter PLUS
"GoToAssist" = GoToAssist 8.0.0.514
"HASP4 Device Drivers" = HASP4 Device Drivers
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"NoteBurner_is1" = NoteBurner 2.25
"PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation)
"RealPlayer 6.0" = RealPlayer
"The Weather Channel Desktop 6" = The Weather Channel Desktop 6
"WinLiveSuite_Wave3" = Windows Live Essentials
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Extras" = Yahoo! Browser Services
"Yahoo! Mail" = Yahoo! Internet Mail
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Search Defender" = Yahoo! Search Protection
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{72552C46-944B-4E16-BBC8-0D85F31C1800}" = Aventail Access Manager
"Move Media Player" = Move Media Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/31/2010 2:36:38 PM | Computer Name = Karens_Laptop | Source = WinMgmt | ID = 10
Description =

Error - 12/31/2010 2:53:54 PM | Computer Name = Karens_Laptop | Source = EventSystem | ID = 4621
Description =

Error - 12/31/2010 2:55:13 PM | Computer Name = Karens_Laptop | Source = WinMgmt | ID = 10
Description =

Error - 12/31/2010 5:18:50 PM | Computer Name = Karens_Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 12/31/2010 5:18:50 PM | Computer Name = Karens_Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8324697

Error - 12/31/2010 5:18:50 PM | Computer Name = Karens_Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8324697

Error - 12/31/2010 5:37:09 PM | Computer Name = Karens_Laptop | Source = WinMgmt | ID = 10
Description =

Error - 12/31/2010 5:58:31 PM | Computer Name = Karens_Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 12/31/2010 5:58:31 PM | Computer Name = Karens_Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1052008

Error - 12/31/2010 5:58:31 PM | Computer Name = Karens_Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1052008

[ Broadcom Wireless LAN Events ]
Error - 12/17/2010 1:06:02 AM | Computer Name = Karens_Laptop | Source = WLAN-Tray | ID = 0
Description = 23:06:01, Thu, Dec 16, 10 Error - Unable to gain access to user store

Error - 12/17/2010 3:47:49 PM | Computer Name = Karens_Laptop | Source = WLAN-Tray | ID = 0
Description = 13:47:48, Fri, Dec 17, 10 Error - Unable to gain access to user store

Error - 12/18/2010 2:04:40 PM | Computer Name = Karens_Laptop | Source = WLAN-Tray | ID = 0
Description = 12:04:40, Sat, Dec 18, 10 Error - Unable to gain access to user store

Error - 12/19/2010 8:51:21 PM | Computer Name = Karens_Laptop | Source = WLAN-Tray | ID = 0
Description = 18:51:20, Sun, Dec 19, 10 Error - Unable to gain access to user store

Error - 12/21/2010 11:12:06 PM | Computer Name = Karens_Laptop | Source = WLAN-Tray | ID = 0
Description = 21:12:06, Tue, Dec 21, 10 Error - Unable to gain access to user store

Error - 12/22/2010 12:13:33 AM | Computer Name = Karens_Laptop | Source = WLAN-Tray | ID = 0
Description = 22:13:33, Tue, Dec 21, 10 Error - Unable to gain access to user store

Error - 12/26/2010 9:33:43 PM | Computer Name = Karens_Laptop | Source = WLAN-Tray | ID = 0
Description = 19:33:42, Sun, Dec 26, 10 Error - Unable to gain access to user store

Error - 12/30/2010 11:17:04 PM | Computer Name = Karens_Laptop | Source = WLAN-Tray | ID = 0
Description = 21:17:04, Thu, Dec 30, 10 Error - Unable to gain access to user store

Error - 12/30/2010 11:20:59 PM | Computer Name = Karens_Laptop | Source = WLAN-Tray | ID = 0
Description = 21:20:59, Thu, Dec 30, 10 Error - Unable to gain access to user store

Error - 12/31/2010 1:41:05 AM | Computer Name = Karens_Laptop | Source = WLAN-Tray | ID = 0
Description = 23:41:05, Thu, Dec 30, 10 Error - Unable to gain access to user store

[ Media Center Events ]
Error - 6/9/2009 7:40:14 AM | Computer Name = Karens_Laptop | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 6/11/2009 7:46:31 PM | Computer Name = Karens_Laptop | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 10/7/2009 4:50:05 PM | Computer Name = Karens_Laptop | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 11/28/2009 1:48:34 PM | Computer Name = Karens_Laptop | Source = MCUpdate | ID = 0
Description = Failed to wait on MCUpdate mutex with exception: 'The wait completed
due to an abandoned mutex.'.

Error - 12/27/2009 2:36:46 PM | Computer Name = Karens_Laptop | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 11/1/2010 8:08:54 PM | Computer Name = Karens_Laptop | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ OSession Events ]
Error - 7/8/2009 11:01:16 PM | Computer Name = Karens_Laptop | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6215.1000. This session
lasted 3750 seconds with 960 seconds of active time. This session ended with a
crash.

[ System Events ]
Error - 10/4/2008 10:24:00 PM | Computer Name = Karens_Laptop | Source = Service Control Manager | ID = 7000
Description =

Error - 10/4/2008 10:24:00 PM | Computer Name = Karens_Laptop | Source = Service Control Manager | ID = 7000
Description =

Error - 10/5/2008 3:52:30 PM | Computer Name = Karens_Laptop | Source = HTTP | ID = 15016
Description =

Error - 10/5/2008 3:54:10 PM | Computer Name = Karens_Laptop | Source = Service Control Manager | ID = 7000
Description =

Error - 10/5/2008 3:54:10 PM | Computer Name = Karens_Laptop | Source = Service Control Manager | ID = 7000
Description =

Error - 10/5/2008 3:54:10 PM | Computer Name = Karens_Laptop | Source = Service Control Manager | ID = 7000
Description =

Error - 10/5/2008 3:54:10 PM | Computer Name = Karens_Laptop | Source = Service Control Manager | ID = 7000
Description =

Error - 10/5/2008 3:54:10 PM | Computer Name = Karens_Laptop | Source = Service Control Manager | ID = 7000
Description =

Error - 10/5/2008 3:54:10 PM | Computer Name = Karens_Laptop | Source = Service Control Manager | ID = 7000
Description =

Error - 10/5/2008 3:54:10 PM | Computer Name = Karens_Laptop | Source = Service Control Manager | ID = 7000
Description =

< End of report >

broni · 2010/12/31

It looks, like nobody pays any attention to my replies...
Must be New Year's Eve

How is redirection?

Click to expand...

TonyV84 · 2010/12/31

Still getting redirected.

broni · 2010/12/31

OK....hold on...

broni · 2010/12/31

You have some Norton's leftovers.
Please, run this tool to remove them: http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=20080710133834EN

Reinstall AVG.

Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.

Accept any prompts.

===============================================================

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
FF - prefs.js..browser.search.defaultengine:  "Ask.com "
FF - prefs.js..browser.search.defaultenginename:  "Ask.com "
FF - prefs.js..browser.search.order.1:  "Ask.com "
[2010/12/26 19:45:01 | 000,002,557 | ---- | M] () -- C:\Users\Karen Vercellino\AppData\Roaming\Mozilla\Firefox\Profiles\piy9drwo.default\search plugins\askcom.xml
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
[1 C:\Users\Karen Vercellino\Documents\*.tmp files -> C:\Users\Karen Vercellino\Documents\*.tmp -> ]
@Alternate Data Stream - 64 bytes -> C:\Users\Karen Vercellino\Documents\Ischemic_Stroke_ani.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Karen Vercellino\Documents\Hemorrhagic_stroke_ani.mpg:TOC.WMV
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:0B4227B4


:Services

:Reg

:Files

:Commands
[resethosts]
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.

Open OTL again and click the Quick Scan button. Post the log it produces in your next reply. Only one log will be created.

TonyV84 · 2010/12/31

All processes killed
========== OTL ==========
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
File C:\Users\Karen Vercellino\AppData\Roaming\Mozilla\Firefox\Profiles\piy9drwo.default\search plugins\askcom.xml not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
C:\Users\Karen Vercellino\Documents\~WRL1167.tmp deleted successfully.
ADS C:\Users\Karen Vercellino\Documents\Ischemic_Stroke_ani.mpeg:TOC.WMV deleted successfully.
ADS C:\Users\Karen Vercellino\Documents\Hemorrhagic_stroke_ani.mpg:TOC.WMV deleted successfully.
ADS C:\ProgramData\TEMP:0B4227B4 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Karen Vercellino
->Temp folder emptied: 21078562 bytes
->Temporary Internet Files folder emptied: 278883 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 30923842 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 3172 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16910 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 50.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Guest
->Flash cache emptied: 0 bytes

User: Karen Vercellino
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.18.2 log created on 12312010_165756

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Log in or Sign up

Solved Google Redirect (among other things)

TonyV84 Inactive Thread Starter

Admin. Administrator Administrator Staff

TonyV84 Inactive Thread Starter

TonyV84 Inactive Thread Starter

TonyV84 Inactive Thread Starter

TonyV84 Inactive Thread Starter

broni Moderator Malware Analyst

TonyV84 Inactive Thread Starter

broni Moderator Malware Analyst

TonyV84 Inactive Thread Starter

broni Moderator Malware Analyst

TonyV84 Inactive Thread Starter

broni Moderator Malware Analyst

TonyV84 Inactive Thread Starter

TonyV84 Inactive Thread Starter

broni Moderator Malware Analyst

TonyV84 Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

TonyV84 Inactive Thread Starter

Share This Page

Log in or Sign up

Solved Google Redirect (among other things)

TonyV84 Inactive Thread Starter

Admin. Administrator Administrator Staff

TonyV84 Inactive Thread Starter

TonyV84 Inactive Thread Starter

TonyV84 Inactive Thread Starter

TonyV84 Inactive Thread Starter

broni Moderator Malware Analyst

TonyV84 Inactive Thread Starter

broni Moderator Malware Analyst

TonyV84 Inactive Thread Starter

broni Moderator Malware Analyst

TonyV84 Inactive Thread Starter

broni Moderator Malware Analyst

TonyV84 Inactive Thread Starter

TonyV84 Inactive Thread Starter

broni Moderator Malware Analyst

TonyV84 Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

TonyV84 Inactive Thread Starter

Share This Page

Useful Searches