Solved Laptop connects wirelessly but can't browse the Web (moved)

Broni, only one file appeared at the end of the scan, the OTL.txt file. Here it is:

OTL logfile created on: 3/21/2010 7:38:26 PM - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\LeAnn Keller\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 62.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 143.11 Gb Total Space | 123.16 Gb Free Space | 86.06% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LEANN-LAPTOP
Current User Name: LeAnn Keller
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/03/21 18:35:44 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LeAnn Keller\Desktop\OTL.exe
PRC - [2010/03/13 23:23:28 | 002,059,544 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2010/03/13 23:23:26 | 000,617,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010/03/13 23:23:23 | 000,308,064 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010/02/03 13:30:41 | 000,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/11/27 11:48:14 | 004,975,400 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version5\TeamViewer.exe
PRC - [2009/05/21 10:55:32 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
PRC - [2009/04/13 13:32:24 | 000,766,976 | ---- | M] () -- C:\Program Files\CPU Thermometer\CPUThermometer.exe
PRC - [2009/02/16 01:10:22 | 002,402,184 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2009/02/16 01:10:22 | 000,981,384 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/05/23 03:43:54 | 000,090,112 | ---- | M] (FGAG) -- C:\Program Files\BERNINA\ART Design\BIN\UCS\UniversalCommunicationServer.exe
PRC - [2008/05/02 00:15:46 | 000,015,872 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerAssistant.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/10/08 15:27:02 | 000,794,624 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
PRC - [2007/10/08 15:18:04 | 000,995,328 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
PRC - [2007/10/08 15:15:50 | 000,356,352 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
PRC - [2007/10/08 15:13:36 | 001,101,824 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
PRC - [2007/10/08 15:09:26 | 000,659,456 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
PRC - [2007/10/08 15:06:44 | 001,183,744 | ---- | M] (Intel Corporation ) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
PRC - [2007/10/08 15:01:54 | 000,483,328 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
PRC - [2007/09/05 13:20:12 | 000,036,352 | ---- | M] (VisualTaskTips.com) -- C:\Program Files\VisualTaskTips\VisualTaskTips.exe
PRC - [2007/07/10 00:03:06 | 000,405,504 | ---- | M] (SigmaTel, Inc.) -- C:\WINDOWS\stsystra.exe
PRC - [2007/03/09 01:28:19 | 000,700,416 | ---- | M] (Zhorn Software) -- C:\Program Files\Stickies\stickies.exe
PRC - [2007/02/12 10:17:02 | 000,267,840 | ---- | M] (BillP Studios) -- C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
PRC - [2006/11/05 12:22:16 | 000,221,184 | ---- | M] (Sonic Solutions) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
PRC - [2006/11/05 11:55:48 | 000,010,752 | ---- | M] (Sonic Solutions) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
PRC - [2006/11/03 20:02:14 | 000,050,688 | ---- | M] (Avanquest Software ) -- C:\Program Files\Digital Line Detect\DLG.exe
PRC - [2006/11/02 16:05:50 | 000,282,624 | ---- | M] (Knowles Acoustics) -- C:\WINDOWS\system32\KADxMain.exe
PRC - [2006/09/16 09:01:16 | 001,666,048 | ---- | M] (Renier Crause) -- C:\Program Files\PopTray\PopTray.exe
PRC - [2006/03/25 00:23:22 | 000,098,304 | ---- | M] (Brio) -- C:\Program Files\FolderSize\FolderSizeSvc.exe


========== Modules (SafeList) ==========

MOD - [2010/03/21 18:35:44 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LeAnn Keller\Desktop\OTL.exe
MOD - [2009/11/27 12:06:56 | 000,103,720 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version5\TV.dll
MOD - [2008/05/02 00:15:35 | 000,004,608 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerHook.dll
MOD - [2007/09/05 13:20:04 | 000,007,680 | ---- | M] () -- C:\Program Files\VisualTaskTips\VttHooks.dll
MOD - [2007/02/12 10:17:10 | 000,063,032 | ---- | M] (BillP Studios) -- C:\Program Files\BillP Studios\WinPatrol\patrolpro.dll
MOD - [2003/04/08 23:57:09 | 000,032,768 | ---- | M] () -- C:\Program Files\Stickies\shook45.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/03/13 23:23:23 | 000,308,064 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2010/03/13 23:23:21 | 000,916,760 | ---- | M] (AVG Technologies CZ, s.r.o.) [Disabled | Stopped] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2009/02/16 01:10:22 | 002,402,184 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2008/05/23 03:43:54 | 000,090,112 | ---- | M] (FGAG) [Auto | Running] -- C:\Program Files\BERNINA\ART Design\BIN\UCS\UniversalCommunicationServer.exe -- (UniversalCommunicationServer)
SRV - [2007/12/16 21:34:54 | 000,016,936 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe -- (GoToAssist)
SRV - [2007/10/08 15:27:02 | 000,794,624 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe -- (EvtEng) Intel(R)
SRV - [2007/10/08 15:15:50 | 000,356,352 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER) Intel(R)
SRV - [2007/10/08 15:06:44 | 001,183,744 | ---- | M] (Intel Corporation ) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- (S24EventMonitor) Intel(R)
SRV - [2007/10/08 15:01:54 | 000,483,328 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe -- (RegSrvc) Intel(R)
SRV - [2007/08/09 03:27:52 | 000,073,728 | ---- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2006/03/25 00:23:22 | 000,098,304 | ---- | M] (Brio) [Auto | Running] -- C:\Program Files\FolderSize\FolderSizeSvc.exe -- (FolderSize)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6071203
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6071203

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.openintab: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/ "
FF - prefs.js..extensions.enabledItems: {C0D0F6D1-9FC9-4b0a-B485-D5E13AF40D51}:2.3.54
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.783
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.7
FF - prefs.js..extensions.enabledItems: chromeditplus@webdesigns.ms11.net:2.7.2
FF - prefs.js..extensions.enabledItems: {a0faa0a4-f1a7-4098-9a74-21efc3a92372}:3.6.1
FF - prefs.js..extensions.enabledItems: {36EC55C0-D27E-11d8-9418-444553540001}:0.5.8.05.1
FF - prefs.js..extensions.enabledItems: {c36177c0-224a-11da-8cd6-0800200c9a66}:2.0.0
FF - prefs.js..extensions.enabledItems: isadmin@vdtsoftware.ffext:2.2
FF - prefs.js..extensions.enabledItems: {8620c15f-30dc-4dba-a131-7c5d20cf4a29}:2.0.3
FF - prefs.js..extensions.enabledItems: {35106bca-6c78-48c7-ac28-56df30b51d2c}:0.6.4
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.3pre.100213
FF - prefs.js..extensions.enabledItems: {95f24680-9e31-11da-a746-0800200c9a66}:0.1.5.5


FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/03/16 08:25:12 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/19 17:40:54 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/03/19 17:06:42 | 000,000,000 | ---D | M]

[2008/06/21 15:54:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Extensions
[2010/03/21 18:01:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions
[2009/09/02 18:53:48 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/12/05 14:53:29 | 000,000,000 | ---D | M] (Organize Status Bar) -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2c}
[2007/12/09 16:14:44 | 000,000,000 | ---D | M] (Enhanced History Manager) -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{36EC55C0-D27E-11d8-9418-444553540001}
[2010/02/25 15:26:36 | 000,000,000 | ---D | M] (NoScript) -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2009/06/17 16:46:40 | 000,000,000 | ---D | M] (IE Tab) -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2009/12/05 14:53:30 | 000,000,000 | ---D | M] (Nightly Tester Tools) -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{8620c15f-30dc-4dba-a131-7c5d20cf4a29}
[2009/07/06 22:57:41 | 000,000,000 | ---D | M] (Update Notifier) -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{95f24680-9e31-11da-a746-0800200c9a66}
[2010/01/02 23:25:34 | 000,000,000 | ---D | M] (DictionarySearch) -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{a0faa0a4-f1a7-4098-9a74-21efc3a92372}
[2010/02/25 15:26:37 | 000,000,000 | ---D | M] (Answers) -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{C0D0F6D1-9FC9-4b0a-B485-D5E13AF40D51}
[2007/12/09 16:14:44 | 000,000,000 | ---D | M] (Fasterfox) -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{c36177c0-224a-11da-8cd6-0800200c9a66}
[2010/02/25 15:26:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2010/02/25 15:26:35 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2008/06/21 15:58:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\chromeditplus@webdesigns.ms11.net
[2010/01/02 23:25:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\isadmin@vdtsoftware.ffext
[2010/03/21 18:01:35 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/03/03 16:31:22 | 000,162,072 | ---- | M] (Tracker Software Products Ltd.) -- C:\Program Files\Mozilla Firefox\plugins\npPDFXCviewNPPlugin.dll
[2008/05/09 21:47:46 | 000,024,673 | ---- | M] (Check Point Software Technologies Ltd.) -- C:\Program Files\Mozilla Firefox\plugins\NPZoneSB.dll

O1 HOSTS File: ([2010/03/19 15:48:07 | 000,000,736 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (PDF-XChange Viewer IE-Plugin) - {C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F} - C:\Program Files\Tracker Software\PDF-XChange Viewer\pdf-viewer\PDFXCviewIEPlugin.dll (Tracker Software Products Ltd.)
O2 - BHO: (ZoneAlarm Spy Blocker BHO) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL (ZoneAlarm)
O3 - HKLM\..\Toolbar: (ZoneAlarm Spy Blocker) - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL (ZoneAlarm)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Spy Blocker) - {F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL (ZoneAlarm)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BuildBU] c:\dell\bldbubg.exe ()
O4 - HKLM..\Run: [CPU Thermometer] C:\Program Files\CPU Thermometer\CPUThermometer.exe ()
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKLM..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe (Knowles Acoustics)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\WINDOWS\System32\nvhotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe (BillP Studios)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKCU..\Run: [VisualTaskTips] C:\Program Files\VisualTaskTips\VisualTaskTips.exe (VisualTaskTips.com)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software )
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\LeAnn Keller\Start Menu\Programs\Startup\PopTray.lnk = C:\Program Files\PopTray\PopTray.exe (Renier Crause)
O4 - Startup: C:\Documents and Settings\LeAnn Keller\Start Menu\Programs\Startup\Stickies.lnk = C:\Program Files\Stickies\stickies.exe (Zhorn Software)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 01 00 00 00 [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.64.150 68.87.75.198
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\mctp {d7b95390-b1c5-11d0-b111-0080c712fe82} - C:\Program Files\Microsoft ActiveSync\aatp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\480\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop BackupWallPaper: C:\Documents and Settings\LeAnn Keller\Application Data\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/11 19:15:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2004/08/11 19:02:12 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16891835792228352)

========== Files/Folders - Created Within 14 Days ==========

[2010/03/21 19:36:55 | 000,555,520 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\LeAnn Keller\Desktop\OTL.exe
[2010/03/21 17:53:09 | 000,000,000 | ---D | C] -- C:\i386
[2010/03/21 17:33:29 | 000,000,000 | --SD | C] -- C:\broni
[2010/03/21 16:10:11 | 000,181,000 | ---- | C] (Kaspersky Lab) -- C:\Documents and Settings\LeAnn Keller\Desktop\TDSSKiller.exe
[2010/03/21 14:09:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LeAnn Keller\Application Data\YouSendIt
[2010/03/21 14:09:36 | 000,000,000 | ---D | C] -- C:\Program Files\YouSendIt
[2010/03/21 13:11:30 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/03/19 16:34:45 | 000,000,000 | -H-D | C] -- C:\WINDOWS\System32\GroupPolicy
[2010/03/16 10:11:10 | 000,000,000 | ---D | C] -- C:\CDX_DIR
[2010/03/16 10:10:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LeAnn Keller\Desktop\BERNINA_CutWork_SP1
[2010/03/13 23:23:26 | 000,012,464 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2010/03/13 14:20:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\Logs
[2010/03/13 14:19:53 | 000,376,832 | ---- | C] (MARX CryptoTech LP ) -- C:\WINDOWS\System32\MPIWIN32.DLL
[2010/03/13 14:19:51 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\MARX Shared
[2010/03/13 14:19:50 | 000,045,136 | ---- | C] (MARX CryptoTech LP) -- C:\WINDOWS\System32\drivers\CBUSB.sys
[2010/03/13 14:19:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Temp
[2010/03/13 14:19:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LeAnn Keller\Local Settings\Application Data\Bernina CutWork
[2010/03/13 14:18:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LeAnn Keller\My Documents\Embroidery Designs
[2010/03/13 14:18:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Bernina CutWork Samples
[2009/12/05 15:15:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/12/05 15:15:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/12/05 15:15:52 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/12/05 15:15:52 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2008/04/05 19:06:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Talkback
[2008/04/05 19:05:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Mozilla
[2008/04/05 19:05:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Mozilla
[2008/03/06 20:04:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2008/01/03 09:08:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
[2007/12/16 21:17:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Intel
[2007/12/16 21:17:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Intel
[2007/12/03 00:57:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Roxio
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\LeAnn Keller\My Documents\*.tmp files -> C:\Documents and Settings\LeAnn Keller\My Documents\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/03/21 19:34:19 | 000,028,095 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001
[2010/03/21 18:35:44 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LeAnn Keller\Desktop\OTL.exe
[2010/03/21 17:52:16 | 000,350,193 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2010/03/21 17:52:14 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/03/21 17:51:50 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/03/21 17:51:44 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/03/21 17:51:40 | 2145,427,456 | -HS- | M] () -- C:\hiberfil.sys
[2010/03/21 17:51:01 | 007,077,888 | ---- | M] () -- C:\Documents and Settings\LeAnn Keller\NTUSER.DAT
[2010/03/21 17:50:41 | 016,378,648 | -H-- | M] () -- C:\Documents and Settings\LeAnn Keller\Local Settings\Application Data\IconCache.db
[2010/03/21 17:32:57 | 003,896,557 | R--- | M] () -- C:\Documents and Settings\LeAnn Keller\Desktop\broni.exe
[2010/03/21 17:14:18 | 000,290,816 | ---- | M] () -- C:\Documents and Settings\LeAnn Keller\Desktop\exeHelper.com
[2010/03/21 16:32:52 | 000,363,008 | ---- | M] () -- C:\Documents and Settings\LeAnn Keller\Desktop\rkill.exe
[2010/03/21 16:32:36 | 000,363,008 | ---- | M] () -- C:\Documents and Settings\LeAnn Keller\Desktop\rkill.pif
[2010/03/21 16:32:10 | 000,363,008 | ---- | M] () -- C:\Documents and Settings\LeAnn Keller\Desktop\rkill.scr
[2010/03/21 16:31:50 | 000,363,008 | ---- | M] () -- C:\Documents and Settings\LeAnn Keller\Desktop\rkill.com
[2010/03/21 14:03:01 | 004,622,551 | ---- | M] () -- C:\Documents and Settings\LeAnn Keller\Desktop\broni.zip
[2010/03/20 13:27:06 | 000,002,385 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Bernina CutWork.lnk
[2010/03/19 16:38:23 | 000,000,008 | RHS- | M] () -- C:\Documents and Settings\All Users\ntuser.pol
[2010/03/17 21:02:40 | 000,464,078 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/03/17 21:02:39 | 000,079,188 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/03/16 20:58:51 | 000,553,066 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/15 22:50:13 | 000,002,473 | ---- | M] () -- C:\Documents and Settings\LeAnn Keller\Desktop\Excel 2007.lnk
[2010/03/15 22:49:50 | 057,108,066 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/03/13 23:23:27 | 000,242,696 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/03/13 23:23:26 | 000,029,512 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/03/13 23:23:26 | 000,012,464 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2010/03/13 23:23:20 | 000,216,200 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/03/13 14:53:44 | 000,028,095 | ---- | M] () -- C:\WINDOWS\System32\nvModes.dat
[2010/03/13 14:19:53 | 000,376,832 | ---- | M] (MARX CryptoTech LP ) -- C:\WINDOWS\System32\MPIWIN32.DLL
[2010/03/13 14:19:50 | 000,045,136 | ---- | M] (MARX CryptoTech LP) -- C:\WINDOWS\System32\drivers\CBUSB.sys
[2010/03/10 15:53:32 | 000,181,000 | ---- | M] (Kaspersky Lab) -- C:\Documents and Settings\LeAnn Keller\Desktop\TDSSKiller.exe
[2010/03/07 21:41:03 | 000,030,505 | ---- | M] () -- C:\Documents and Settings\LeAnn Keller\My Documents\Book List.xlsx
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\LeAnn Keller\My Documents\*.tmp files -> C:\Documents and Settings\LeAnn Keller\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/03/21 16:40:23 | 000,290,816 | ---- | C] () -- C:\Documents and Settings\LeAnn Keller\Desktop\exeHelper.com
[2010/03/21 16:35:23 | 000,363,008 | ---- | C] () -- C:\Documents and Settings\LeAnn Keller\Desktop\rkill.com
[2010/03/21 16:35:19 | 000,363,008 | ---- | C] () -- C:\Documents and Settings\LeAnn Keller\Desktop\rkill.scr
[2010/03/21 16:35:15 | 000,363,008 | ---- | C] () -- C:\Documents and Settings\LeAnn Keller\Desktop\rkill.pif
[2010/03/21 16:35:12 | 000,363,008 | ---- | C] () -- C:\Documents and Settings\LeAnn Keller\Desktop\rkill.exe
[2010/03/21 14:02:59 | 004,622,551 | ---- | C] () -- C:\Documents and Settings\LeAnn Keller\Desktop\broni.zip
[2010/03/21 12:58:32 | 003,896,557 | R--- | C] () -- C:\Documents and Settings\LeAnn Keller\Desktop\broni.exe
[2010/03/19 17:44:17 | 2145,427,456 | -HS- | C] () -- C:\hiberfil.sys
[2010/03/19 16:37:08 | 000,000,008 | RHS- | C] () -- C:\Documents and Settings\All Users\ntuser.pol
[2010/03/13 14:19:31 | 000,002,385 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Bernina CutWork.lnk
[2008/05/14 11:26:47 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI
[2008/03/19 10:29:12 | 000,000,081 | ---- | C] () -- C:\WINDOWS\PARSONS.INI
[2008/01/11 14:54:48 | 000,047,976 | -H-- | C] () -- C:\Program Files\Eq98.GID
[2008/01/05 11:57:03 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll
[2008/01/05 11:56:36 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll
[2008/01/05 11:54:29 | 000,000,191 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2008/01/04 18:59:35 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\LeAnn Keller\Local Settings\Application Data\fusioncache.dat
[2008/01/04 18:47:41 | 000,000,839 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2007/12/27 16:38:38 | 000,000,501 | ---- | C] () -- C:\Program Files\Tweak UI.lnk
[2007/12/11 16:14:46 | 000,056,056 | ---- | C] () -- C:\WINDOWS\System32\DLAAPI_W.DLL
[2007/12/10 20:12:14 | 000,187,392 | ---- | C] () -- C:\WINDOWS\System32\lpng.DLL
[2007/12/10 20:11:09 | 000,000,092 | ---- | C] () -- C:\WINDOWS\System32\FTDIUN2K.INI
[2007/12/09 20:25:56 | 000,003,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\BANTExt.sys
[2007/12/08 16:10:47 | 000,796,048 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2007/12/03 00:57:47 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2007/12/03 00:50:21 | 000,198,144 | ---- | C] () -- C:\WINDOWS\System32\_psisdecd.dll
[2007/12/03 00:46:53 | 000,000,277 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2007/12/03 00:17:22 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll
[2007/12/03 00:17:10 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2007/12/03 00:17:10 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2007/12/03 00:17:09 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2007/12/03 00:17:08 | 001,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2007/12/03 00:16:01 | 000,001,121 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2007/08/06 19:22:15 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2007/01/03 12:24:36 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/01/03 12:22:46 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/01/03 12:22:14 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2006/09/17 00:36:50 | 000,520,192 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Roxio.dll
[2006/09/17 00:36:50 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\CddbFileTaggerRoxio.dll
[2004/08/11 19:24:19 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini

========== LOP Check ==========

[2008/06/21 16:30:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\abelhadigital.com
[2009/12/05 15:18:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2008/02/22 13:45:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Broderbund Software
[2007/12/16 20:42:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Citrix
[2008/05/09 19:50:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft
[2007/12/08 16:11:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
[2008/02/22 13:52:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Riverdeep Interactive Learning Limited
[2007/12/03 00:53:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2010/03/19 22:44:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2008/06/21 16:30:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\abelhadigital.com
[2009/01/04 21:03:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\CallingID
[2007/12/17 21:11:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\Goodsol
[2007/12/08 15:54:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\Grisoft
[2009/06/17 20:28:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\IObit
[2009/01/04 21:48:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\KC Softwares
[2008/05/09 21:52:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\MailWasherPro
[2008/01/05 12:27:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\MSNInstaller
[2009/12/06 16:45:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\ProcessLasso
[2009/12/05 14:58:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\QuickScan
[2010/03/21 17:52:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\stickies
[2010/03/21 14:42:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\TeamViewer
[2008/01/25 17:24:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\Windows Desktop Search
[2007/12/08 16:08:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\WinPatrol
[2010/03/21 14:14:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LeAnn Keller\Application Data\YouSendIt
[2009/06/17 19:26:04 | 000,000,122 | ---- | M] () -- C:\WINDOWS\Tasks\Low Battery Alarm Program.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2004/08/04 07:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\Program Files\i386\sp2.cab:AGP440.sys
[2004/08/04 07:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/09/05 17:29:42 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/09/05 17:29:42 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 01:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\Program Files\i386\AGP440.SYS
[2004/08/04 01:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 07:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\Program Files\i386\sp2.cab:atapi.sys
[2004/08/04 07:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/09/05 17:29:42 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/09/05 17:29:42 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 00:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\Program Files\i386\atapi.sys
[2004/08/04 00:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 00:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys
[2004/08/04 00:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2004/08/04 07:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\Program Files\i386\eventlog.dll
[2004/08/04 07:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: IASTOR.SYS >
[2007/05/08 22:22:56 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\drivers\storage\R154200\iastor.sys
[2007/05/08 22:22:58 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\Program Files\i386\iastor.sys
[2007/05/08 22:22:58 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\WINDOWS\system32\drivers\iastor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/04 07:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\Program Files\i386\netlogon.dll
[2004/08/04 07:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 07:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\Program Files\i386\scecli.dll
[2004/08/04 07:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/04/13 20:11:53 | 000,380,445 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\expsrv.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2004/08/11 19:06:14 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004/08/11 19:06:14 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004/08/11 19:06:14 | 000,876,544 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\LeAnn Keller\My Documents\seniors_files:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\LeAnn Keller\My Documents\Minn Christmas tree II-09.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\LeAnn Keller\My Documents\Minn Christmas tree 09.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\LeAnn Keller\My Documents\Embroidery Designs:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\LeAnn Keller\My Documents\ATT2.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\LeAnn Keller\My Documents\a-squared Free:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\LeAnn Keller\My Documents\457690412_QiZEG-L.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\LeAnn Keller\Desktop\BERNINA_CutWork_SP1:Roxio EMC Stream
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
< End of report >

Frank

 

Sorry, the other file was hiding behind the first one. Here it is:

OTL Extras logfile created on: 3/21/2010 7:38:26 PM - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\LeAnn Keller\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 62.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 143.11 Gb Total Space | 123.16 Gb Free Space | 86.06% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LEANN-LAPTOP
Current User Name: LeAnn Keller
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)
"C:\Program Files\Grisoft\AVG7\avginet.exe" = C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe -- File not found
"C:\Program Files\Grisoft\AVG7\avgamsvr.exe" = C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe -- File not found
"C:\Program Files\Grisoft\AVG7\avgcc.exe" = C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe -- File not found
"C:\Program Files\Electric Quilt Company\EQ6\EQ6.exe" = C:\Program Files\Electric Quilt Company\EQ6\EQ6.exe:*:Enabled:EQ6 -- (The Electric Quilt Company)
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe -- File not found
"C:\Program Files\Dell\MediaDirect\PCMService.exe" = C:\Program Files\Dell\MediaDirect\PCMService.exe:*:Enabled:CyberLink PowerCinema Resident Program -- (CyberLink Corp.)
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:*:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:*:Enabled:ActiveSync Application -- (Microsoft Corporation)
"C:\Program Files\TeamViewer\Version5\TeamViewer.exe" = C:\Program Files\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Program Files\AVG\AVG9\avgemc.exe" = C:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{007C0BB9-C5E2-4C73-B96B-2BBD5CEA9BF9}" = 2350
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{0390854C-42B9-4BC2-B0CF-87DDA0F62EC8}" = 2350_Help
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{06BE8AFD-A8E2-4B63-BAE7-287016D16ACB}" = mSSO
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0DC86BEC-5CE3-413A-BB61-C40A3D186B24}" = Scan
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{0E4BC542-9CFD-4E97-B586-9F1E5516E7B9}" = Microsoft IntelliPoint 6.1
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = QualxServ Service Agreement
"{14BEB6DF-A499-4A38-8E06-E173BCD5C087}" = ScannerCopy
"{17293791-C82E-476C-9997-9A0FF234A19B}" = HP Product Assistant
"{181821B7-82AA-44DA-9DAF-EF254CCB670A}" = Fax
"{1AD5F465-8282-4DAD-B957-E09C0B783D18}" = InstantShare
"{1B680FBA-E317-4E93-AF43-3B59798A4BE0}" = Copy
"{1D2AB963-7FF4-4446-BF22-822101AA550F}" = The Print Shop 22
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{20FBC0A0-3160-4F14-83ED-3A74BB6B8C31}" = TrayApp
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 17
"{272EC8BA-5A08-4ea1-A189-684466A06B02}" = cp_dwShrek2Albums1
"{2C6C74C2-042F-4D36-B7B0-0C538FCF01AB}" = Dell DataSafe Online
"{2E8428AD-6CD2-4031-916A-3CF9BBF2DEC9}" = Unload
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{342C7C88-D335-4bc2-8CF1-281857629CE2}" = HP PSC & OfficeJet 4.7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{3762DB2D-71BD-421F-9E55-C74DA7DF4D07}" = CueTour
"{391E18CE-7D3B-45E9-A8F0-34E77F14F47A}" = ProductContext
"{3E252EDB-F90D-40D4-B701-19FF06D71018}" = Bernina CutWork
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{442BE28B-782B-4DC0-B490-E70A403B1C69}" = Readme
"{49D687E5-6784-431B-A0A2-2F23B8CC5A1B}" = mHlpDell
"{5E8D588F-307C-4250-B622-26969027319A}" = PanoStandAlone
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{629AC11F-077F-4F58-916C-5B21E68468A8}" = HostsMan 3.1.55
"{63DB9CCD-2B56-4217-9A3D-507AC78320CA}" = mWMI
"{644D04A2-C682-4FD5-977D-03B804C4B9C5}" = CreativeProjects
"{646A65DD-23FC-418E-B9F0-E0500FB42CB1}" = PhotoGallery
"{655CB07D-C944-40BE-B93F-55957CAC7625}" = AiO_Scan
"{656A8811-95E1-4BD2-B692-8202DDBA15D5}_is1" = CPU Thermometer 1.0
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{68963635-14A4-48D9-B431-DF3A74D1AAE1}" = Destinations
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{700A6597-3CE6-49C1-AA75-846B24CDA66D}" = BufferChm
"{724517BD-1DE1-4986-BFCA-C1DFD379E3BC}" = cp_dwShrek2Cards1
"{736CE9DD-F589-485B-ACFF-78C235A57066}" = WinPatrol 2007 Step 2
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{7AD25C9F-9957-4D1C-95EF-9BCD09F6D31B}" = HPSystemDiagnostics
"{818ABC3C-635C-4651-8183-D0E9640B7DD1}" = HP Update
"{829CD169-E692-48E8-9BDE-A3E8D8B65538}" = mSCfg
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{84CDF5A8-1D57-4B69-BAB6-1F11D8923375}" = SkinsHP1
"{85CFD253-38AE-4DB1-ACB7-F0F4C791990D}" = AiOSoftware
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8BC3B99B-A6BE-4A0B-8535-B1B94BA4B1B1}" = DocProc
"{8C8224B7-AA9B-4807-97CD-55899BAC83FE}" = YouSendIt Express
"{8D273DE5-ABFA-4BD0-A9D7-EE9C971438C4}_is1" = PDF-Viewer
"{8E0FF6D6-5DDA-4854-82DE-E2250C7F94CB}" = Ec On Pc V3.1
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup
"{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5B9D22C-755A-4AC6-9904-875E80838BB6}" = CP_AtenaShokunin1Config
"{A81C0B52-B829-4B77-91D6-947B32E72298}" = BERNINA ART Design
"{B0DF58A2-40DF-4465-AA56-38623EC9938C}" = Documentation & Support Launcher
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6884A07-0305-47AE-9969-8F26FADC17DE}" = Games, Music, & Photos Launcher
"{B8A7CBED-E991-4979-B2E4-885F05E36347}" = BERNINA ART Design 1.0D
"{B90BE7F5-5E53-4B03-BA8E-563DCEE45862}_is1" = Mz Cpu Accelerator v3.0
"{B911B811-BA3E-46D4-90F8-6F3338359651}" = Director
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C0E7118C-CF3D-46EC-B431-F744C035A571}" = 2350Trb
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{C7A5573D-693C-441C-8968-B372593748AC}" = Microsoft .NET Framework 1.1 -- Device Update 3.0
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{C99C0593-3B48-41D9-B42F-6E035B320449}" = Broadcom Management Programs
"{C99D083F-1F2F-4E3A-91EF-13F6268FB2D9}" = OESD Digital Catalog Volume 8
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDFC8F9A-79A7-4438-A090-B07C5A9739E9}" = EQ6
"{CDFCF124-115F-4976-8BF4-08C89187A146}" = WebReg
"{CE0C8CC5-E396-442B-A50E-D1D374A9E820}" = DocumentViewer
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1B5E9C8-4CCF-44E3-87D6-7C00D7DA5370}" = IntelliSonic Speech Enhancement
"{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E42BD75A-FC23-4E3F-9F91-2658334C644F}" = Internet Service Offers Launcher
"{E5B72007-07C9-4E67-B29E-696073F45704}" = DropMyRights
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{E93E5EF6-D361-481E-849D-F16EF5C78EBC}" = Musicmatch for Windows Media Player
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
"{FC22D020-3005-4715-8DF9-F3EDE81DEB3D}" = CreativeProjectsTemplates
"{FC8D21C8-7B29-4104-ADB0-FEE9CA1C7922}" = Folder Size for Windows
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced SystemCare 3_is1" = Advanced SystemCare 3
"Agent Ransack_is1" = Agent Ransack Version 1.7.3
"AnVir Task Manager Free" = AnVir Task Manager Free
"AVG9Uninstall" = AVG Free 9.0
"Belarc Advisor 2.0" = Belarc Advisor 7.2
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F" = Conexant HDA D330 MDC V.92 Modem
"ERUNT_is1" = ERUNT 1.1j
"Foundation Factory 2" = Foundation Factory 2
"Game Booster_is1" = Game Booster
"GoToAssist" = GoToAssist 8.0.0.480
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Photo & Imaging" = HP Image Zone 4.7
"ie8" = Windows Internet Explorer 8
"Indeo® software" = Indeo® software
"InstallShield_{8C8224B7-AA9B-4807-97CD-55899BAC83FE}" = YouSendIt Express
"InstallShield_{CDFC8F9A-79A7-4438-A090-B07C5A9739E9}" = EQ6
"ioIsland.com ClearTweak" = ioIsland.com ClearTweak
"lfl_SuperSafe" = lfl_SuperSafe
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.8)" = Mozilla Firefox (3.5.8)
"NTREGOPT_is1" = NTREGOPT 1.1j
"NVIDIA Drivers" = NVIDIA Drivers
"PopTray" = PopTray 3.20
"ProcessLasso" = Process Lasso
"ProInst" = Intel(R) PROSet/Wireless Software
"Revo Uninstaller" = Revo Uninstaller 1.83
"SearchAssist" = SearchAssist
"SendToX.PowerToy" = Send To Extensions PowerToy
"Shockwave" = Shockwave
"Solitaire Wizard_is1" = Solitaire Wizard version 2.0.0
"Spell Checker For OE 2.1" = Spell Checker For OE 2.1
"SpywareBlaster_is1" = SpywareBlaster 4.2
"Steve Murphy's Automatic Wallpaper Changer_is1" = AWC V3.0.7
"Stickies 6.0c" = Stickies 6.0c
"SynTPDeinstKey" = Dell Touchpad
"TeamViewer 5" = TeamViewer 5
"Tweak UI 2.10" = Tweak UI
"Unlocker" = Unlocker 1.8.7
"Visual Task Tips" = Visual Task Tips 2.3
"WebPost" = Microsoft Web Publishing Wizard 1.52
"WIC" = Windows Imaging Component
"Windows CE Services" = Microsoft ActiveSync 3.8
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinPatrol 2007" = WinPatrol 2007 Restore/Remove First
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"ZoneAlarm" = ZoneAlarm
"ZoneAlarmSB Uninstall" = ZoneAlarm Spy Blocker

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GoToMeeting" = GoToMeeting 4.0.0.320

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9/16/2009 8:10:00 PM | Computer Name = LEANN-LAPTOP | Source = Windows Search Service | ID = 3024
Description = The update cannot be started because the content sources cannot be
accessed. Fix the errors and try the update again. Context: Windows Application,
SystemIndex Catalog

Error - 9/16/2009 8:15:00 PM | Computer Name = LEANN-LAPTOP | Source = Windows Search Service | ID = 3029
Description = The plug-in in <Search.TripoliIndexer> cannot be initialized. Context:
Windows Application, SystemIndex Catalog Details: The content index cannot be read.
(0xc0041800)

Error - 9/16/2009 8:15:00 PM | Computer Name = LEANN-LAPTOP | Source = Windows Search Service | ID = 3028
Description = The gatherer object cannot be initialized. Context: Windows Application,
SystemIndex Catalog Details: The content index cannot be read. (0xc0041800)

Error - 9/16/2009 8:15:00 PM | Computer Name = LEANN-LAPTOP | Source = Windows Search Service | ID = 3058
Description = The application cannot be initialized. Context: Windows Application

Details:
The
content index cannot be read. (0xc0041800)

Error - 9/16/2009 8:17:12 PM | Computer Name = LEANN-LAPTOP | Source = Windows Search Service | ID = 3024
Description = The update cannot be started because the content sources cannot be
accessed. Fix the errors and try the update again. Context: Windows Application,
SystemIndex Catalog

Error - 12/5/2009 3:43:05 PM | Computer Name = LEANN-LAPTOP | Source = FolderSize | ID = 0
Description =

Error - 12/6/2009 3:42:29 PM | Computer Name = LEANN-LAPTOP | Source = Windows Search Service | ID = 3100
Description = Unable to initialize the filter host process. Terminating. Details:
A
system shutdown is in progress. (0x8007045b)

Error - 3/17/2010 8:47:56 PM | Computer Name = LEANN-LAPTOP | Source = JavaQuickStarterService | ID = 1
Description =

Error - 3/19/2010 5:17:13 PM | Computer Name = LEANN-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x6c331203.

Error - 3/21/2010 2:45:35 PM | Computer Name = LEANN-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application teamviewer.exe, version 5.0.7418.0, faulting
module teamviewer.exe, version 5.0.7418.0, fault address 0x0015f2e0.

[ BerninaCutWork Events ]
Error - 3/13/2010 2:21:46 PM | Computer Name = LEANN-LAPTOP | Source = BerninaCutWork | ID = 4001
Description = CBU key not attached

Error - 3/13/2010 2:22:26 PM | Computer Name = LEANN-LAPTOP | Source = BerninaCutWork | ID = 4001
Description = CBU key not attached

Error - 3/13/2010 2:22:38 PM | Computer Name = LEANN-LAPTOP | Source = BerninaCutWork | ID = 4001
Description = CBU key not attached

Error - 3/13/2010 2:24:15 PM | Computer Name = LEANN-LAPTOP | Source = BerninaCutWork | ID = 4001
Description = CBU key not attached

Error - 3/13/2010 2:25:05 PM | Computer Name = LEANN-LAPTOP | Source = BerninaCutWork | ID = 4001
Description = CBU key not attached

Error - 3/13/2010 2:29:23 PM | Computer Name = LEANN-LAPTOP | Source = BerninaCutWork | ID = 4001
Description = CBU key not attached

Error - 3/13/2010 11:17:57 PM | Computer Name = LEANN-LAPTOP | Source = BerninaCutWork | ID = 4001
Description = CBU key not attached

Error - 3/16/2010 1:43:50 PM | Computer Name = LEANN-LAPTOP | Source = BerninaCutWork | ID = 4001
Description = CBU key not attached

Error - 3/18/2010 10:31:55 AM | Computer Name = LEANN-LAPTOP | Source = BerninaCutWork | ID = 4001
Description = CBU key not attached

Error - 3/20/2010 1:27:08 PM | Computer Name = LEANN-LAPTOP | Source = BerninaCutWork | ID = 4001
Description = CBU key not attached

[ System Events ]
Error - 3/19/2010 5:39:48 PM | Computer Name = LEANN-LAPTOP | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 3/19/2010 5:43:22 PM | Computer Name = LEANN-LAPTOP | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 3/21/2010 1:03:48 PM | Computer Name = LEANN-LAPTOP | Source = Service Control Manager | ID = 7031
Description = The AVG Free WatchDog service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 3/21/2010 1:03:48 PM | Computer Name = LEANN-LAPTOP | Source = Service Control Manager | ID = 7000
Description = The AVG Free WatchDog service failed to start due to the following
error: %%3

Error - 3/21/2010 1:49:59 PM | Computer Name = LEANN-LAPTOP | Source = Service Control Manager | ID = 7000
Description = The AVG Free WatchDog service failed to start due to the following
error: %%3

Error - 3/21/2010 2:30:09 PM | Computer Name = LEANN-LAPTOP | Source = Service Control Manager | ID = 7000
Description = The AVG Free WatchDog service failed to start due to the following
error: %%3

Error - 3/21/2010 2:48:26 PM | Computer Name = LEANN-LAPTOP | Source = Service Control Manager | ID = 7000
Description = The AVG Free WatchDog service failed to start due to the following
error: %%3

Error - 3/21/2010 4:43:39 PM | Computer Name = LEANN-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The NVIDIA Display Driver Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 3/21/2010 4:43:39 PM | Computer Name = LEANN-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The RoxMediaDB9 service terminated unexpectedly. It has done this
1 time(s).

Error - 3/21/2010 4:43:39 PM | Computer Name = LEANN-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The Roxio Hard Drive Watcher 9 service terminated unexpectedly. It
has done this 1 time(s).


< End of report >

 

We were successful in running the new broni.exe program, and it generated the desired text file. Here it is:

ComboFix 10-03-21.01 - LeAnn Keller 03/21/2010 20:21:16.1.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1732 [GMT -4:00]
Running from: c:\documents and settings\LeAnn Keller\Desktop\Broni.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\AegisP.inf
c:\windows\system32\ccrpTmr6.dll
c:\windows\system32\F834AH3F.ocx
c:\windows\system32\regsvr32.dll
c:\windows\system32\Temp

.
((((((((((((((((((((((((( Files Created from 2010-02-22 to 2010-03-22 )))))))))))))))))))))))))))))))
.

2010-03-21 21:53 . 2010-03-21 21:53 -------- d-----w- C:\i386
2010-03-21 18:09 . 2010-03-21 18:14 -------- d-----w- c:\documents and settings\LeAnn Keller\Application Data\YouSendIt
2010-03-21 18:09 . 2010-03-21 18:09 -------- d-----w- c:\program files\YouSendIt
2010-03-19 21:40 . 2010-03-19 21:40 -------- d-----w- c:\documents and settings\Admin - Sterling\Local Settings\Application Data\Mozilla
2010-03-19 20:34 . 2010-03-19 20:35 -------- d--h--w- c:\windows\system32\GroupPolicy
2010-03-19 19:27 . 2010-03-19 19:27 -------- d-----w- c:\windows\system32\wbem\Repository
2010-03-16 14:11 . 2010-03-16 14:11 -------- d-----w- C:\CDX_DIR
2010-03-14 03:23 . 2010-03-14 03:23 360584 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2010-03-14 03:23 . 2010-03-14 03:23 333192 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgldx86.sys
2010-03-14 03:23 . 2010-03-14 03:23 28424 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgmfx86.sys
2010-03-14 03:23 . 2010-03-14 03:23 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-03-13 18:20 . 2008-07-12 13:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
2010-03-13 18:20 . 2008-07-12 13:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2010-03-13 18:20 . 2008-07-12 13:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2010-03-13 18:20 . 2010-03-13 18:20 -------- d-----w- c:\windows\Logs
2010-03-13 18:19 . 2010-03-13 18:19 376832 ----a-w- c:\windows\system32\MPIWIN32.DLL
2010-03-13 18:19 . 2010-03-13 18:19 -------- d-----w- c:\program files\Common Files\MARX Shared
2010-03-13 18:19 . 2010-03-13 18:19 45136 ----a-w- c:\windows\system32\drivers\CBUSB.sys
2010-03-13 18:19 . 2010-03-13 18:54 -------- d-----w- c:\documents and settings\LeAnn Keller\Local Settings\Application Data\Bernina CutWork
2010-03-11 03:00 . 2009-10-23 15:28 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe
2010-02-25 19:26 . 2010-02-25 03:06 632544 ----a-w- c:\documents and settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-02-25 19:26 . 2010-02-25 03:06 795320 ----a-w- c:\documents and settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-02-25 19:23 . 2010-02-25 19:23 -------- d-sh--w- c:\documents and settings\Admin - Sterling\PrivacIE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-22 00:16 . 2007-12-10 21:28 -------- d-----w- c:\documents and settings\LeAnn Keller\Application Data\stickies
2010-03-21 19:18 . 2008-05-09 23:50 -------- d-----w- c:\program files\AVG
2010-03-21 18:42 . 2009-06-17 20:38 -------- d-----w- c:\documents and settings\LeAnn Keller\Application Data\TeamViewer
2010-03-21 18:09 . 2007-12-03 04:38 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-20 02:59 . 2010-03-20 03:00 133632 ----a-w- c:\windows\Internet Logs\xDB15.tmp
2010-03-20 02:44 . 2008-06-21 20:25 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-19 19:25 . 2010-03-19 19:28 2327040 ----a-w- c:\windows\Internet Logs\xDB14.tmp
2010-03-18 02:49 . 2010-03-18 14:05 56832 ----a-w- c:\windows\Internet Logs\xDB13.tmp
2010-03-17 23:48 . 2010-03-17 23:53 50688 ----a-w- c:\windows\Internet Logs\xDB12.tmp
2010-03-17 20:39 . 2010-03-17 20:40 41984 ----a-w- c:\windows\Internet Logs\xDB11.tmp
2010-03-16 20:19 . 2010-03-17 00:54 352768 ----a-w- c:\windows\Internet Logs\xDB10.tmp
2010-03-16 14:11 . 2009-02-20 17:02 -------- d-----w- c:\program files\BERNINA
2010-03-14 03:23 . 2009-12-05 19:18 242696 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-03-14 03:23 . 2007-12-08 19:24 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-03-14 03:23 . 2008-05-09 23:50 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-03-13 18:53 . 2007-12-03 04:23 28095 ----a-w- c:\windows\system32\nvModes.dat
2010-03-03 22:02 . 2008-02-28 21:07 16200445 ----a-w- c:\windows\Internet Logs\tvDebug.zip
2010-03-03 17:45 . 2010-03-03 22:02 2282496 ----a-w- c:\windows\Internet Logs\xDBF.tmp
2010-01-30 22:28 . 2007-12-03 04:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-29 00:34 . 2010-01-29 01:45 400384 ----a-w- c:\windows\Internet Logs\xDBE.tmp
2010-01-19 00:35 . 2010-01-19 00:35 139 ----a-w- c:\documents and settings\Admin - Sterling\Local Settings\Application Data\fusioncache.dat
2009-12-31 16:50 . 2004-08-11 23:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2008-01-17 13:47 . 2008-01-11 18:54 47976 ---ha-w- c:\program files\Eq98.GID
2007-12-27 20:38 . 2007-12-27 20:38 501 ----a-w- c:\program files\Tweak UI.lnk
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VisualTaskTips "= "c:\program files\VisualTaskTips\VisualTaskTips.exe" [2007-09-05 36352]
"DellSupportCenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-07-10 851968]
"IntelZeroConfig "= "c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-10-08 995328]
"IntelWireless "= "c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-10-08 1101824]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2007-06-06 8429568]
"IntelliPoint "= "c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-11-22 842584]
"NvMediaCenter "= "NvMCTray.dll" [2007-06-06 81920]
"dscactivate "= "c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-10 16384]
"DellSupportCenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"WinPatrol "= "c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2007-02-12 267840]
"SigmatelSysTrayApp "= "stsystra.exe" [2007-07-10 405504]
"RoxWatchTray "= "c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"nwiz "= "nwiz.exe" [2007-06-06 1626112]
"NVHotkey "= "nvHotkey.dll" [2007-06-06 67584]
"KADxMain "= "c:\windows\system32\KADxMain.exe" [2006-11-02 282624]
"ISUSPM Startup "= "c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"BuildBU "= "c:\dell\bldbubg.exe" [2004-02-19 61440]
"UnlockerAssistant "= "c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"CPU Thermometer "= "c:\program files\CPU Thermometer\CPUThermometer.exe" [2009-04-13 766976]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"ZoneAlarm Client "= "c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting "= "c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2006-10-27 434528]

c:\documents and settings\LeAnn Keller\Start Menu\Programs\Startup\
PopTray.lnk - c:\program files\PopTray\PopTray.exe [2006-9-16 1666048]
Stickies.lnk - c:\program files\Stickies\stickies.exe [2007-3-9 700416]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-12-3 50688]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-03-14 03:23 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2007-12-17 00:41 10792 ----a-w- c:\program files\Citrix\GoToAssist\480\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
2007-09-21 05:07 184320 ------w- c:\program files\Dell\MediaDirect\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"c:\\Program Files\\Electric Quilt Company\\EQ6\\EQ6.exe "=
"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe "=
"c:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe "=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe "=

R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [12/5/2009 3:18 PM 242696]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/9/2008 7:50 PM 216200]
S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [3/13/2010 11:23 PM 308064]
S2 UniversalCommunicationServer;Universal Communication Server;c:\program files\BERNINA\ART Design\BIN\UCS\UniversalCommunicationServer.exe [2/20/2009 1:03 PM 90112]
S3 CBUSB;MARX CryptoTech LP;c:\windows\system32\drivers\CBUSB.sys [3/13/2010 2:19 PM 45136]
S4 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [3/13/2010 11:23 PM 916760]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MDMXSDK
*NewlyCreated* - PXHELP20
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
FF - ProfilePath - c:\documents and settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\documents and settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - component: c:\documents and settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\isadmin@vdtsoftware.ffext\components\isadmin.dll
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\LeAnn Keller\Application Data\Mozilla\Firefox\Profiles\rdj4w9se.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPDFXCviewNPPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPZoneSB.dll
FF - plugin: c:\program files\Tracker Software\PDF-XChange Viewer\pdf-viewer\npPDFXCviewNPPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
- - - - ORPHANS REMOVED - - - -

ActiveSetup-{3E252EDB-F90D-40D4-B701-19FF06D71018} - MSIEXEC
AddRemove-{B90BE7F5-5E53-4B03-BA8E-563DCEE45862}_is1 - c:\program files\Mz_CpuAcc\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-21 20:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(544)
c:\program files\Citrix\GoToAssist\480\G2AWinLogon.dll
c:\windows\system32\netprovcredman.dll
.
Completion time: 2010-03-21 20:26:48
ComboFix-quarantined-files.txt 2010-03-22 00:26

Pre-Run: 135,181,066,240 bytes free
Post-Run: 135,220,662,272 bytes free

- - End Of File - - 4B964F00AE2EABD7D8F609059FE45443


Frank

 

Broni,

Combofix was uninstalled successfully. The computer was restarted normally.

Both browsers are still unable to show any webpages. There's no change from the way they were at the start of the problem. I think I'll try installing a different browser, such as Opera, and see what happens.

We're going to sign off for the night and aim at being back online ~10 AM (Eastern) tomorrow. Thank you for all the attention you're giving to this.

Frank

 

Broni, before getting on to your new instructions I just want to let you know that we installed Opera and it has the same, exact problem that the other two browsers have. Needless to say, we uninstalled it immediately. We will get on to your latest instructions tomorrow.

Frank

 

Success!

Broni,

Good news! The laptop is back in operation!

We uninstalled AVG as you instructed and before uninstalling ZoneAlarm we rebooted and tried browsing in both FF and IE, and to our utter amazement, we were back on the Web!!! We were able to download Windows Updates and get e-mail too. Everything seems to be back to normal after 3 1/2 days.

As a final test, we reinstalled AVG 9 and rebooted. Surprise! Everything still works!

We don't know precisely what did the trick but we must assume that something you had us do had the desired effect -- for which we are extremely grateful!!! We certainly appreciate all the help you have given us.

Frank

 

Broni,

My friend says the following, "I'm of the 'if it ain't broke, don't try to fix it' school of thought. I really hate to hit a sleeping lion with a stick just to see what it might do. If AVG is starting to behave badly, then let's replace AVG. Right now my wife is happy (and VERY grateful), with the results and all she knows is that her computer is working, so I'm very reluctant to take it away from her again, at least this soon after restoring it for her, so that we can *do stuff* to it again. I fear she will react badly to that. "

I agree. Other than tidying up loose ends and maybe answering some lingering questions, is there anything material to be gained by running these further tests? I think the tests you already recommended have shown pretty conclusively that the problem was caused by something to do with the AVG program. My feeling is that all we need to do at this point is to permanently uninstall AVG and install (for example) Avast, which I have been using for some time on my own PC and really like. I felt AVG was getting too intrusive in setting itself up with no real means of turning some parts off (except by internal meddling with files and with difficulty), while Avast is generally regarded to be an excellent program and it lets you configure and turn it on or off as you like. I appreciate your concern but I would like to decline runnning these tests if at all possible.

Thank you,
Frank

 

Broni, we ran the TFC program, restarted the computer, went to the Kaspersky website and did the online antivirus scan as prescribed (after AVG had been uninstalled, because there's no way to turn it off) twice. Why twice? Because the first time there were no results shown in the report. The second time through, there were also no results, just a blank report window. Running these two tests, including downloading all the virus updates, took about four and a half hours.

I'm convinced that we're done. I'm going to oversee the installation of Avast on this machine and then turn it over to my friend. I appreciate all your help through this ordeal.

Frank

 

Broni, have done so. Also installed Avast, which is working nicely, and rebooted again. Turned ownership of laptop over to friend. All is functioning well now.

Many thanks to you and the experts on this BBS, which I think is the best on the Web (that's why I keep coming back).

Frank

 

One last question: does the publishing of the requested information in this thread put my friend at risk?