Antivirus Live comes back every 2 days....

supersonic · January 2, 2010

Hi - thanks in advance for your help. You guys are awesome and very much appreciated!

About a week ago my daughter clicked an infected video link on Facebook and Antivirus Live popped up and disabled everything. I did a system restore, re-downloaded and re-installed MBAM, ran a scan, cleaned whatever it found and we were fine.

2 days after that Antivirus Live just randomly popped up with no prompting. I dealt with it exactly the way I had last time.

2 days after that, last night, you guessed it...Antivirus Live! I did an immediate system restore, didn't need to redl or reinst MBAM so ran it and it didn't find anything but something must still be there for it to keep coming back.

Here are the MBAM and HJT logs:

Malwarebytes' Anti-Malware 1.43

Database version: 3475

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18865

1/2/2010 8:11:23 AM

mbam-log-2010-01-02 (08-11-23).txt

Scan type: Full Scan (C:\|)

Objects scanned: 353322

Time elapsed: 1 hour(s), 56 minute(s), 39 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:18:59 PM, on 1/2/2010

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18865)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HpqSRmon.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\RtHDVCpl.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe

C:\WINDOWS\System32\rundll32.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.charter.net/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)

O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: ooVoo Toolbar - {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Program Files\oovootb\oovoodx.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: ooVoo Toolbar - {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Program Files\oovootb\oovoodx.dll

O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [Conime] %windir%\system32\conime.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide

O4 - HKLM\..\Run: [LogitechSetup] F:\Setup\Setup.exe /restart /l:enu

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [Logitech Vid] "C:\Program Files\Logitech\Logitech Vid\vid.exe" -bootmode

O4 - HKCU\..\Run: [ooVoo.exe] C:\Program Files\ooVoo\oovoo.exe /minimized

O4 - HKCU\..\RunOnce: [shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) )" -"http://www.harcourtschool.com/activity/language_arts/goforgold/content_builder/dswmedia/g2c16/nadia.htm"

O4 - Global Startup: Event Reminder.lnk = ?

O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O13 - Gopher Prefix:

O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/...s/wlscctrl2.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1259121048575

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1259121084436

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0...oUploader55.cab

O16 - DPF: {A1662FB6-39BE-41BB-ACDC-0448FB1B5817} (Photo Upload Plugin Class) - http://images3.pnimedia.com/ProductAssets/...veX_Control.cab

O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab

O16 - DPF: {C75BE5CC-7F80-458C-8B66-FAB86E3B13C3} (FotkiUploader Control) - http://images.fotki.com/activex/FotkiUploader.cab

O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} (Photo Upload Plugin Class) - http://www.costcophotocenter.com/upload/ac...veX_Control.cab?

O20 - AppInit_DLLs: C:\ProgramData\gokovuli\gokovuli.dll c:\windows\system32\fegenope.dll,C:\ProgramData\jiwejela\jiwejela.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

O21 - SSODL: sovufodas - {ea958c90-d927-444d-98fc-cfe726621a27} - (no file)

O21 - SSODL: voyuwelen - {cebb99b6-7a1e-4ef6-8af6-8d093daaf64b} - c:\windows\system32\fegenope.dll (file missing)

O22 - SharedTaskScheduler: jugezatag - {ea958c90-d927-444d-98fc-cfe726621a27} - (no file)

O22 - SharedTaskScheduler: jugezatag - {cebb99b6-7a1e-4ef6-8af6-8d093daaf64b} - c:\windows\system32\fegenope.dll (file missing)

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe

O23 - Service: Google Update Service (gupdate1c9894f89bc6240) (gupdate1c9894f89bc6240) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: IJS - Unknown owner - C:\Users\HOMEPC~1\AppData\Local\Temp\IJS.exe (file missing)

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: J - Unknown owner - C:\Users\HOMEPC~1\AppData\Local\Temp\J.exe (file missing)

O23 - Service: JIT - Unknown owner - C:\Users\HOMEPC~1\AppData\Local\Temp\JIT.exe (file missing)

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

End of file - 10201 bytes

kahdah · January 2, 2010

Hello supersonic

Welcome to Malwarebytes.

=====================

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Under Custom scan's and fixes section paste in the below in bold

%SYSTEMDRIVE%\*.exe

/md5start

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

sceclt.dll

ntelogon.dll

logevent.dll

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

/md5stop

CREATERESTOREPOINT
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

====================

Download the following GMER Rootkit Scanner from Here

Download the randomly named EXE file to your Desktop. Remember what its name is since it is randomly named.
Double click on the new random named exe file you downloaded and run it. If prompted about the Security Warning and Unknown Publisher go ahead and click on Run
It may take a minute to load and become available.
If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..
In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED
Sections
IAT/EAT
Drives/Partition other than Systemdrive (typically only C:\ should be checked)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop
**Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
Click OK and quit the GMER program.
Note: On Firefox you need to go to Tools/Options/Main then under the Downloads section, click on Always ask me where to save files so that you can choose the name and where to save to, in this case your Desktop.
Post that log in your next reply.

supersonic · January 2, 2010

Ok - ran OTL successfully. GMER became unresponsive and froze up my puter so I pulled the plug. Should I try GMER again?

OTL.Txt

Extras.Txt

kahdah · January 3, 2010

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

supersonic · January 3, 2010

Ran CF, now my Internet Explorer icon only works if I left click and Run As Administrator, otherwise it does nothing.

Here is my CF log:

combolog.txt

supersonic · January 3, 2010

That log looks weird, here's a c&p:

ComboFix 10-01-02.01 - HOME PC 01/02/2010 23:12:46.6.2 - x86

Microsoft

kahdah · January 3, 2010

now my Internet Explorer icon only works if I left click and Run As Administrator, otherwise it does nothing.

Ok it may revert back before we are finish let's remove the malware so we can get the system back to normal then we can address the other issue's after that.

=================================

1. Please open Notepad

Click Start , then Run
type in notepad in the Run Box then hit ok.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
c:\users\HOME PC\AppData\Local\Hhocalegacude.dat
c:\users\HOME PC\AppData\Local\Qqahadutodi.bin

Folder::
c:\users\HOME PC\AppData\Roaming\lowsec
c:\programdata\jiwejela
c:\programdata\bugubado
c:\programdata\disawemo

Reglock::
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following report/log into your next reply:

Combofix.txt

=============

supersonic · January 3, 2010

I woke up today to find that my husband did yet another system restore this morning. Does this change our avenue of attack?

supersonic · January 3, 2010

I woke up today to find that my husband did yet another system restore this morning. Does this change our avenue of attack?

All the programs you had me dl are gone. I'm really sorry, he didn't know I was working with you to fix it.

kahdah · January 3, 2010

Well we have to start from the beginning again then.

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Under Custom scan's and fixes section paste in the below in bold

%SYSTEMDRIVE%\*.exe

/md5start

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

sceclt.dll

ntelogon.dll

logevent.dll

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

/md5stop

CREATERESTOREPOINT
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

====================

Download the following GMER Rootkit Scanner from Here

Download the randomly named EXE file to your Desktop. Remember what its name is since it is randomly named.
Double click on the new random named exe file you downloaded and run it. If prompted about the Security Warning and Unknown Publisher go ahead and click on Run
It may take a minute to load and become available.
If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..
In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED
Sections
IAT/EAT
Drives/Partition other than Systemdrive (typically only C:\ should be checked)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop
**Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
Click OK and quit the GMER program.
Note: On Firefox you need to go to Tools/Options/Main then under the Downloads section, click on Always ask me where to save files so that you can choose the name and where to save to, in this case your Desktop.
Post that log in your next reply.

supersonic · January 3, 2010

OK - I'll do it right now.

supersonic · January 3, 2010

Quick question, I am hesitant to run GMER again because of how it jammed up my computer last time. It ran, but froze up at the end and had my CPU usage pinned at 100% for about a half hour before I cut the power. What do you think?

supersonic · January 3, 2010

OTL logfile created on: 1/3/2010 11:56:22 AM - Run 1

OTL by OldTimer - Version 3.1.20.2 Folder = C:\Users\HOME PC\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18865)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

894.00 Mb Total Physical Memory | 220.00 Mb Available Physical Memory | 25.00% Memory free

2.00 Gb Paging File | 1.00 Gb Available in Paging File | 56.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 225.21 Gb Total Space | 110.80 Gb Free Space | 49.20% Space Free | Partition Type: NTFS

Drive D: | 7.67 Gb Total Space | 0.87 Gb Free Space | 11.40% Space Free | Partition Type: NTFS

Drive E: | 114.48 Gb Total Space | 88.39 Gb Free Space | 77.21% Space Free | Partition Type: NTFS

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

Drive I: | 3.68 Gb Total Space | 2.02 Gb Free Space | 54.97% Space Free | Partition Type: FAT32

Computer Name: HENRIQUES

Current User Name: HOME PC

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\HOME PC\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)

PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)

PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)

PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)

PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)

PRC - C:\WINDOWS\System32\nvvsvc.exe (NVIDIA Corporation)

PRC - C:\WINDOWS\System32\WUDFHost.exe (Microsoft Corporation)

PRC - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

PRC - C:\WINDOWS\System32\mobsync.exe (Microsoft Corporation)

PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HpqSRmon.exe (Hewlett-Packard)

PRC - C:\WINDOWS\RtHDVCpl.exe (Realtek Semiconductor)

PRC - c:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)

PRC - C:\WINDOWS\System32\drivers\XAudio.exe (Conexant Systems, Inc.)

PRC - C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe (Logitech Inc.)

========== Modules (SafeList) ==========

MOD - C:\Users\HOME PC\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\ProgramData\jiwejela\jiwejela.dll ()

MOD - C:\WINDOWS\System32\msi.dll (Microsoft Corporation)

MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)

MOD - C:\WINDOWS\System32\sfc_os.dll (Microsoft Corporation)

MOD - C:\WINDOWS\System32\sfc.dll (Microsoft Corporation)

MOD - C:\WINDOWS\System32\msiltcfg.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (CLTNetCnService) -- File not found

SRV - (iPod Service) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)

SRV - (FontCache) -- C:\WINDOWS\System32\FntCache.dll (Microsoft Corporation)

SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)

SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (IJS) -- C:\Users\HOME PC\AppData\Local\Temp\IJS.exe (Sysinternals - www.sysinternals.com)

SRV - (JIT) -- C:\Users\HOME PC\AppData\Local\Temp\JIT.exe (Sysinternals - www.sysinternals.com)

SRV - (J) -- C:\Users\HOME PC\AppData\Local\Temp\J.exe (Sysinternals - www.sysinternals.com)

SRV - (LVPrcSrv) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

SRV - (gupdate1c9894f89bc6240) Google Update Service (gupdate1c9894f89bc6240) -- C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)

SRV - (Bonjour Service) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)

SRV - (nvsvc) -- C:\WINDOWS\System32\nvvsvc.exe (NVIDIA Corporation)

SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (WLSetupSvc) -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation)

SRV - (usnjsvc) -- C:\Program Files\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation)

SRV - (GameConsoleService) -- C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe (WildTangent, Inc.)

SRV - (LightScribeService) -- c:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)

SRV - (XAudioService) -- C:\WINDOWS\System32\drivers\XAudio.exe (Conexant Systems, Inc.)

SRV - (ehstart) -- C:\WINDOWS\ehome\ehstart.dll (Microsoft Corporation)

SRV - (RoxMediaDB9) -- c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (Sonic Solutions)

SRV - (stllssvr) -- c:\Program Files\Common Files\SureThing Shared\stllssvr.exe (MicroVision Development, Inc.)

SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)

========== Driver Services (SafeList) ==========

DRV - (avgntflt) -- C:\WINDOWS\System32\drivers\avgntflt.sys (Avira GmbH)

DRV - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)

DRV - (USBAAPL) -- C:\WINDOWS\System32\drivers\usbaapl.sys (Apple, Inc.)

DRV - (ssmdrv) -- C:\WINDOWS\System32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (GEARAspiWDM) -- C:\WINDOWS\System32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

DRV - (avipbb) -- C:\WINDOWS\System32\drivers\avipbb.sys (Avira GmbH)

DRV - (LVPr2Mon) -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys ()

DRV - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)

DRV - (usbaudio) USB Audio Driver (WDM) -- C:\WINDOWS\System32\drivers\USBAUDIO.sys (Microsoft Corporation)

DRV - (RTSTOR) -- C:\WINDOWS\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.)

DRV - (SASENUM) -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)

DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)

DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)

DRV - (MusCDriverV32) -- C:\WINDOWS\System32\drivers\MusCDriverV32.sys (Windows ® Codename Longhorn DDK provider)

DRV - (MusCVideo32) -- C:\WINDOWS\System32\drivers\MusCVideo32.sys (Windows ® 2000 DDK provider)

DRV - (NVENETFD) -- C:\WINDOWS\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)

DRV - (nvlddmkm) -- C:\WINDOWS\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)

DRV - (RimUsb) -- C:\WINDOWS\System32\drivers\RimUsb.sys (Research In Motion Limited)

DRV - (UMPass) -- C:\WINDOWS\System32\drivers\umpass.sys (Microsoft Corporation)

DRV - (nvstor32) -- C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation)

DRV - (LVcKap) -- C:\WINDOWS\System32\drivers\Lvckap.sys (Logitech Inc.)

DRV - (LVUSBSta) -- C:\WINDOWS\System32\drivers\LVUSBSta.sys (Logitech Inc.)

DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) -- C:\WINDOWS\System32\drivers\LV302V32.SYS (Logitech Inc.)

DRV - (pepifilter) -- C:\WINDOWS\System32\drivers\lv302af.sys (Logitech Inc.)

DRV - (LVMVDrv) -- C:\WINDOWS\System32\drivers\LVMVdrv.sys (Logitech Inc.)

DRV - (MCSTRM) -- C:\WINDOWS\System32\drivers\mcstrm.sys (RealNetworks, Inc.)

DRV - (motmodem) -- C:\WINDOWS\System32\drivers\motmodem.sys (Motorola)

DRV - (HSXHWBS2) -- C:\WINDOWS\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)

DRV - (winachsf) -- C:\WINDOWS\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)

DRV - (HSF_DP) -- C:\WINDOWS\System32\drivers\HSX_DP.sys (Conexant Systems, Inc.)

DRV - (XAudio) -- C:\WINDOWS\System32\drivers\XAudio.sys (Conexant Systems, Inc.)

DRV - (PxHelp20) -- C:\Windows\System32\Drivers\PxHelp20.sys (Sonic Solutions)

DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)

DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)

DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)

DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)

DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)

DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)

DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)

DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)

DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)

DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)

DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)

DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)

DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)

DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)

DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)

DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)

DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)

DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)

DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)

DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)

DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)

DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)

DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)

DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)

DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)

DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)

DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)

DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)

DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)

DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)

DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)

DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)

DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)

DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)

DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)

DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)

DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)

DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)

DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)

DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)

DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)

DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)

DRV - (E1G60) Intel® -- C:\WINDOWS\System32\drivers\E1G60I32.sys (Intel Corporation)

DRV - (secdrv) -- C:\WINDOWS\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)

DRV - (mdmxsdk) -- C:\WINDOWS\System32\drivers\mdmxsdk.sys (Conexant)

DRV - (Ps2) -- C:\WINDOWS\System32\drivers\PS2.sys (Hewlett-Packard Company)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.charter.net/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2

IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\System32\ieframe.dll (Microsoft Corporation)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/02 02:01:03 | 00,000,000 | ---D | M]

[2008/09/17 13:45:10 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\Mozilla\Extensions

[2008/09/17 13:45:10 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com

O1 HOSTS File: (734 bytes) - C:\WINDOWS\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll File not found

O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)

O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\System32\ieframe.dll (Microsoft Corporation)

O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [Conime] C:\WINDOWS\System32\conime.exe (Microsoft Corporation)

O4 - HKLM..\Run: [hpqSRMon] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HpqSRmon.exe (Hewlett-Packard)

O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)

O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe (Logitech Inc.)

O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()

O4 - HKLM..\Run: [LogitechSetup] F:\Setup\Setup.exe File not found

O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe File not found

O4 - HKLM..\Run: [nuhisuhugo] C:\ProgramData\disawemo\disawemo.DLL ()

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)

O4 - HKCU..\Run: [ehTray.exe] C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation)

O4 - HKCU..\Run: [iSUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)

O4 - HKCU..\Run: [Logitech Vid] C:\Program Files\Logitech\Logitech Vid\vid.exe (Logitech Inc.)

O4 - HKCU..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)

O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

O4 - HKCU..\RunOnce: [shockwave Updater] C:\Windows\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -Mozilla\4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident\4.0; Mozilla\4.0 ( File not found

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0

O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)

O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe ()

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\System32\nlaapi.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\System32\NapiNSP.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\System32\pnrpnsp.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\System32\pnrpnsp.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\WINDOWS\System32\winrnr.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)

O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll File not found

O13 - gopher Prefix: missing

O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)

O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://support.microsoft.com/OAS/ActiveX/MSDcode.cab (Microsoft Data Collection Control)

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1...toUploader5.cab (Facebook Photo Uploader 5 Control)

O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} http://cdn.scan.onecare.live.com/resource/...s/wlscctrl2.cab (Windows Live OneCare safety scanner control)

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scan8/oscan8.cab (BDSCANONLINE Control)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1259121048575 (WUWebControl Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu...b?1259121084436 (MUWebControl Class)

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0...oUploader55.cab (Facebook Photo Uploader 5 Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)

O16 - DPF: {A1662FB6-39BE-41BB-ACDC-0448FB1B5817} http://images3.pnimedia.com/ProductAssets/...veX_Control.cab (Photo Upload Plugin Class)

O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} http://support.f-secure.com/ols/fscax.cab (F-Secure Online Scanner 3.3)

O16 - DPF: {C75BE5CC-7F80-458C-8B66-FAB86E3B13C3} http://images.fotki.com/activex/FotkiUploader.cab (FotkiUploader Control)

O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_05)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)

O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} http://www.costcophotocenter.com/upload/ac...veX_Control.cab? (Photo Upload Plugin Class)

O16 - DPF: Microsoft XML Parser for Java file:///C:/Windows/Java/classes/xmldso.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.151.8.211 24.151.8.210 66.189.130.5

O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp - No CLSID value found

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)

O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\ProgramData\gokovuli\gokovuli.dll c:\windows\system32\fegenope.dll) - C:\ProgramData\gokovuli\gokovuli.dll File not found

O20 - AppInit_DLLs: (C:\ProgramData\jiwejela\jiwejela.dll) - C:\ProgramData\jiwejela\jiwejela.dll ()

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)

O21 - SSODL: sovufodas - {ea958c90-d927-444d-98fc-cfe726621a27} - CLSID or File not found.

O21 - SSODL: voyuwelen - {cebb99b6-7a1e-4ef6-8af6-8d093daaf64b} - C:\Windows\System32\fegenope.dll File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\System32\webcheck.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {cebb99b6-7a1e-4ef6-8af6-8d093daaf64b} - jugezatag - C:\Windows\System32\fegenope.dll File not found

O22 - SharedTaskScheduler: {ea958c90-d927-444d-98fc-cfe726621a27} - jugezatag - Reg Error: Key error. File not found

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)

O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2007/02/06 11:25:36 | 00,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{1e80769a-6805-11dc-b54f-001a92c4074a}\Shell - "" = AutoRun

O33 - MountPoints2\{1e80769a-6805-11dc-b54f-001a92c4074a}\Shell\AutoRun\command - "" = L:\LaunchU3.exe -- File not found

O33 - MountPoints2\{a302a2ed-33bb-11dc-99a1-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{a302a2ed-33bb-11dc-99a1-806e6f6e6963}\Shell\applet\command - "" = F:\Setup\autorun\autorun.exe -- File not found

O33 - MountPoints2\{a302a2ed-33bb-11dc-99a1-806e6f6e6963}\Shell\AutoRun\command - "" = F:\setup\autorun\autorun.exe -- File not found

O33 - MountPoints2\{a302a2ed-33bb-11dc-99a1-806e6f6e6963}\Shell\install\command - "" = F:\setup.exe -- File not found

O33 - MountPoints2\L\Shell - "" = AutoRun

O33 - MountPoints2\L\Shell\AutoRun\command - "" = L:\LaunchU3.exe -- File not found

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - comfile [open] -- "%1" %*

O35 - exefile [open] -- "%1" %*

OTL cannot create restorepoints on Vista OSs!

========== Files/Folders - Created Within 30 Days ==========

[2010/01/03 11:53:10 | 00,513,536 | ---- | C] (OldTimer Tools) -- C:\Users\HOME PC\Desktop\OTL.exe

[2010/01/03 10:01:25 | 00,000,000 | ---D | C] -- C:\Windows\LastGood

[2010/01/02 23:42:56 | 00,000,000 | ---D | C] -- C:\Users\HOME PC\AppData\Local\Temp(44)

[2010/01/02 23:27:24 | 00,000,000 | ---D | C] -- C:\Windows\temp

[2010/01/02 19:58:53 | 00,000,000 | ---D | C] -- C:\Users\HOME PC\Documents\SightSpeed Recordings

[2010/01/02 12:18:49 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro

[2010/01/01 12:48:46 | 00,000,000 | ---D | C] -- C:\Users\HOME PC\Desktop\New Folder (2)

[2010/01/01 11:31:02 | 00,000,000 | ---D | C] -- C:\Users\HOME PC\AppData\Local\Apple

[2009/12/31 12:36:51 | 00,000,000 | ---D | C] -- C:\Users\HOME PC\AppData\Local\Adobe

[2009/12/31 02:38:40 | 00,000,000 | ---D | C] -- C:\Users\HOME PC\AppData\Local\Apple Computer

[2009/12/29 17:21:59 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware(15)

[2009/12/29 16:01:16 | 00,000,000 | ---D | C] -- C:\Program Files\MBAM

[2009/12/28 15:31:32 | 00,000,000 | ---D | C] -- C:\Users\HOME PC\Documents\My ooVoo

[2009/12/26 18:41:53 | 00,000,000 | ---D | C] -- C:\ProgramData\EmailNotifier

[2009/12/26 18:41:35 | 00,000,000 | ---D | C] -- C:\Program Files\oovootb

[2009/12/26 18:32:17 | 00,000,000 | ---D | C] -- C:\Users\HOME PC\AppData\Roaming\ooVoo Details

[2009/12/26 18:31:53 | 00,000,000 | ---D | C] -- C:\Program Files\ooVoo

[2009/12/25 13:16:12 | 00,000,000 | ---D | C] -- C:\ProgramData\jiwejela

[2009/12/25 13:16:12 | 00,000,000 | ---D | C] -- C:\ProgramData\disawemo

[2009/12/25 13:16:12 | 00,000,000 | ---D | C] -- C:\ProgramData\bugubado

[2009/12/23 19:54:41 | 00,000,000 | ---D | C] -- C:\Users\HOME PC\{d4adbe9f-c841-41d9-bd90-36ff1e831b60}

[2009/12/14 16:52:57 | 00,000,000 | ---D | C] -- C:\Users\HOME PC\AppData\Local\PhotoChannel

[2009/12/09 20:07:46 | 00,000,000 | ---D | C] -- C:\Users\HOME PC\Desktop\renees pics

[2009/12/09 03:07:53 | 00,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nshhttp.dll

[2009/12/09 03:07:49 | 00,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\httpapi.dll

[2009/12/08 16:58:58 | 00,594,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll

[2009/12/08 16:58:58 | 00,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll

[2009/12/08 16:58:57 | 01,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2009/12/08 16:58:57 | 01,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl

[2009/12/08 16:58:57 | 00,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll

[2009/12/08 16:58:57 | 00,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe

[2009/12/08 16:58:57 | 00,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2009/12/08 16:58:57 | 00,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe

[2009/12/08 16:58:57 | 00,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll

[2009/12/08 16:58:57 | 00,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll

[2009/12/08 16:58:57 | 00,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll

[2009/12/08 16:58:57 | 00,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll

[2009/12/08 16:58:57 | 00,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2009/12/08 16:58:57 | 00,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe

[2009/12/08 16:58:13 | 00,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rastls.dll

[3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/01/03 11:57:50 | 00,011,168 | -H-- | M] () -- C:\ProgramData\ruvokula

[2010/01/03 11:55:52 | 04,456,448 | ---- | M] () -- C:\Users\HOME PC\ntuser.dat

[2010/01/03 11:53:36 | 00,293,376 | ---- | M] () -- C:\Users\HOME PC\Desktop\imfneq8x.exe

[2010/01/03 11:53:12 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Users\HOME PC\Desktop\OTL.exe

[2010/01/03 11:09:01 | 00,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2010/01/03 09:58:37 | 00,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2010/01/03 09:58:20 | 00,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2010/01/03 09:58:20 | 00,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2010/01/03 09:58:17 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT

[2010/01/03 09:58:14 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2010/01/03 09:58:09 | 93,800,8576 | -HS- | M] () -- C:\hiberfil.sys

[2010/01/03 09:40:53 | 00,524,288 | -HS- | M] () -- C:\Users\HOME PC\ntuser.dat{658fa8b7-f90c-11dd-abf0-001a92c4074a}.TMContainer00000000000000000001.regtrans-ms

[2010/01/03 09:40:53 | 00,065,536 | -HS- | M] () -- C:\Users\HOME PC\ntuser.dat{658fa8b7-f90c-11dd-abf0-001a92c4074a}.TM.blf

[2010/01/03 09:40:26 | 02,468,194 | -H-- | M] () -- C:\Users\HOME PC\AppData\Local\IconCache.db

[2010/01/03 00:12:47 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm

[2010/01/03 00:12:47 | 00,000,232 | -H-- | M] () -- C:\sqmdata02.sqm

[2010/01/03 00:12:31 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm

[2010/01/03 00:12:31 | 00,000,232 | -H-- | M] () -- C:\sqmdata01.sqm

[2010/01/03 00:12:13 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm

[2010/01/03 00:12:13 | 00,000,232 | -H-- | M] () -- C:\sqmdata00.sqm

[2009/12/26 23:27:30 | 00,232,532 | ---- | M] () -- C:\Users\HOME PC\Desktop\cousins xmas 2009.jpg

[2009/12/25 12:49:38 | 00,002,413 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk

[2009/12/24 12:29:05 | 00,690,960 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI

[2009/12/24 12:29:05 | 00,595,446 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2009/12/24 12:29:05 | 00,101,144 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2009/12/23 03:20:37 | 70,680,9409 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2009/12/22 23:06:42 | 00,002,595 | ---- | M] () -- C:\Users\HOME PC\Desktop\Microsoft Word.lnk

[2009/12/22 17:26:03 | 00,027,136 | ---- | M] () -- C:\Users\HOME PC\Documents\shabanu written piece.doc

[2009/12/22 09:11:46 | 00,002,075 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk

[2009/12/14 16:32:30 | 00,060,928 | ---- | M] () -- C:\Users\HOME PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009/12/10 09:04:28 | 00,029,231 | ---- | M] () -- C:\Users\HOME PC\Documents\Internet-TV-Viewing[1][1].pdf

[2009/12/09 21:50:03 | 00,043,520 | ---- | M] () -- C:\Users\HOME PC\Documents\orbital period lab.doc

[2009/12/09 12:38:12 | 00,025,088 | ---- | M] () -- C:\Users\HOME PC\Documents\graph paper light.doc

[2009/12/09 12:37:21 | 00,024,064 | ---- | M] () -- C:\Users\HOME PC\Documents\graph paper.doc

[2009/12/09 12:25:50 | 00,002,593 | ---- | M] () -- C:\Users\HOME PC\Desktop\Microsoft Excel.lnk

[2009/12/07 22:40:06 | 00,056,816 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2009/12/07 20:53:09 | 00,064,512 | ---- | M] () -- C:\Users\HOME PC\Documents\moon project.doc

[3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2099/01/01 12:00:00 | 00,011,168 | -H-- | C] () -- C:\ProgramData\ruvokula

[2010/01/03 11:53:31 | 00,293,376 | ---- | C] () -- C:\Users\HOME PC\Desktop\imfneq8x.exe

[2010/01/03 00:12:47 | 00,000,244 | -H-- | C] () -- C:\sqmnoopt02.sqm

[2010/01/03 00:12:47 | 00,000,232 | -H-- | C] () -- C:\sqmdata02.sqm

[2010/01/03 00:12:31 | 00,000,244 | -H-- | C] () -- C:\sqmnoopt01.sqm

[2010/01/03 00:12:31 | 00,000,232 | -H-- | C] () -- C:\sqmdata01.sqm

[2010/01/03 00:12:13 | 00,000,244 | -H-- | C] () -- C:\sqmnoopt00.sqm

[2010/01/03 00:12:13 | 00,000,232 | -H-- | C] () -- C:\sqmdata00.sqm

[2010/01/02 19:50:10 | 93,800,8576 | -HS- | C] () -- C:\hiberfil.sys

[2009/12/26 23:25:35 | 00,232,532 | ---- | C] () -- C:\Users\HOME PC\Desktop\cousins xmas 2009.jpg

[2009/12/22 17:24:37 | 00,027,136 | ---- | C] () -- C:\Users\HOME PC\Documents\shabanu written piece.doc

[2009/12/22 09:11:46 | 00,002,075 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk

[2009/12/10 09:04:28 | 00,029,231 | ---- | C] () -- C:\Users\HOME PC\Documents\Internet-TV-Viewing[1][1].pdf

[2009/12/09 12:52:14 | 00,043,520 | ---- | C] () -- C:\Users\HOME PC\Documents\orbital period lab.doc

[2009/12/09 12:38:12 | 00,025,088 | ---- | C] () -- C:\Users\HOME PC\Documents\graph paper light.doc

[2009/12/09 12:37:19 | 00,024,064 | ---- | C] () -- C:\Users\HOME PC\Documents\graph paper.doc

[2009/12/07 20:25:58 | 00,064,512 | ---- | C] () -- C:\Users\HOME PC\Documents\moon project.doc

[2009/09/19 06:54:13 | 00,000,120 | ---- | C] () -- C:\Users\HOME PC\AppData\Local\Hhocalegacude.dat

[2009/09/19 06:54:13 | 00,000,000 | ---- | C] () -- C:\Users\HOME PC\AppData\Local\Qqahadutodi.bin

[2009/09/17 22:47:51 | 00,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009/05/08 09:13:04 | 00,013,584 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll

[2009/04/30 15:00:12 | 00,025,624 | ---- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys

[2009/04/21 08:00:45 | 00,000,600 | ---- | C] () -- C:\Users\HOME PC\AppData\Local\PUTTY.RND

[2009/03/23 20:51:44 | 00,016,948 | ---- | C] () -- C:\Users\HOME PC\AppData\Local\installer.log

[2009/02/16 12:32:59 | 00,000,000 | ---- | C] () -- C:\Windows\setup32.INI

[2008/01/09 14:01:48 | 00,000,453 | ---- | C] () -- C:\Windows\bdoscandellang.ini

[2007/11/12 23:09:15 | 00,000,235 | ---- | C] () -- C:\Users\HOME PC\AppData\Roaming\devices.xml

[2007/11/12 23:09:15 | 00,000,012 | ---- | C] () -- C:\Users\HOME PC\AppData\Roaming\settings.xml

[2007/11/12 22:45:43 | 00,000,762 | ---- | C] () -- C:\ProgramData\hpzinstall.log

[2007/10/31 09:39:39 | 00,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[2007/10/12 01:11:58 | 00,059,500 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini

[2007/09/09 09:41:53 | 00,000,039 | ---- | C] () -- C:\Windows\WININIT.INI

[2007/09/08 13:50:59 | 01,265,664 | ---- | C] () -- C:\Windows\System32\MGIIpl2A6.dll

[2007/09/08 13:50:59 | 01,228,800 | ---- | C] () -- C:\Windows\System32\MGIIpl2M6.dll

[2007/09/08 13:50:58 | 01,200,128 | ---- | C] () -- C:\Windows\System32\MGIIpl2M5.dll

[2007/09/08 13:50:58 | 01,073,152 | ---- | C] () -- C:\Windows\System32\MGIIpl2P6.dll

[2007/09/08 13:50:58 | 01,028,096 | ---- | C] () -- C:\Windows\System32\MGIIpl2P5.dll

[2007/09/08 13:50:58 | 00,000,002 | ---- | C] () -- C:\Windows\PhotoSuite.ini

[2007/09/08 13:50:49 | 01,064,960 | ---- | C] () -- C:\Windows\System32\MGIIpl2PX.dll

[2007/09/08 13:50:49 | 00,332,800 | ---- | C] () -- C:\Windows\System32\FPXLIB.DLL

[2007/09/08 13:50:49 | 00,122,880 | ---- | C] () -- C:\Windows\System32\JPEGLIB.DLL

[2007/09/08 13:50:49 | 00,020,480 | ---- | C] () -- C:\Windows\System32\MGIIpl2.dll

[2007/09/08 13:50:49 | 00,019,968 | ---- | C] () -- C:\Windows\System32\CPUINF32.DLL

[2007/08/31 11:59:20 | 00,060,928 | ---- | C] () -- C:\Users\HOME PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2007/08/13 13:54:36 | 00,000,376 | ---- | C] () -- C:\Windows\ODBC.INI

[2007/08/12 01:14:40 | 00,000,000 | ---- | C] () -- C:\Users\HOME PC\AppData\Roaming\wklnhst.dat

[2007/02/06 11:03:04 | 00,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom24.dll

[2007/02/06 11:03:04 | 00,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes24.dll

[2007/01/10 06:56:34 | 00,000,000 | ---- | C] () -- C:\Windows\System32\px.ini

[2006/11/02 07:35:32 | 00,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006/11/02 02:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006/08/11 02:00:40 | 00,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll

[2006/08/11 02:00:40 | 00,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll

[2004/09/16 15:24:26 | 03,375,104 | ---- | C] () -- C:\Windows\System32\qt-mt331.dll

[1999/01/22 13:46:58 | 00,065,536 | ---- | C] () -- C:\Windows\System32\MSRTEDIT.DLL

========== LOP Check ==========

[2007/09/08 13:16:46 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\acccore

[2008/02/19 22:57:31 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\Babylon

[2008/05/22 20:14:19 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\CopyTransDoctor

[2007/10/08 17:59:37 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\funkitron

[2007/08/28 07:03:21 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\InterTrust

[2007/10/08 16:22:18 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\iWin

[2009/11/25 20:51:50 | 00,000,000 | -HSD | M] -- C:\Users\HOME PC\AppData\Roaming\lowsec

[2007/12/09 12:35:03 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\Morpheus Software

[2008/09/24 10:23:08 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\muvee Technologies

[2009/12/26 18:36:17 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\ooVoo Details

[2009/03/23 20:52:06 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\Temp

[2007/08/12 13:12:23 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\Template

[2008/09/17 13:45:02 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\TomTom

[2009/04/19 00:12:12 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\uTorrent

[2007/08/11 21:27:58 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\WildTangent

[2007/09/09 21:17:13 | 00,000,000 | ---D | M] -- C:\Users\HOME PC\AppData\Roaming\WinBatch

[2009/12/23 02:17:40 | 00,032,618 | ---- | M] () -- C:\WINDOWS\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >

[2008/01/19 02:42:25 | 00,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\WINDOWS\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008/01/19 02:42:25 | 00,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\WINDOWS\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008/01/19 02:42:25 | 00,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\WINDOWS\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008/01/19 02:42:25 | 00,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\WINDOWS\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2006/11/02 04:49:52 | 00,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\WINDOWS\System32\drivers\AGP440.sys

[2006/11/02 04:49:52 | 00,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\WINDOWS\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >

[2009/04/11 01:32:26 | 00,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\WINDOWS\System32\drivers\atapi.sys

[2009/04/11 01:32:26 | 00,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\WINDOWS\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009/04/11 01:32:26 | 00,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\WINDOWS\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008/01/19 02:41:30 | 00,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\WINDOWS\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008/01/19 02:41:30 | 00,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\WINDOWS\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006/11/02 04:49:36 | 00,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\WINDOWS\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2008/02/14 03:04:29 | 00,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\WINDOWS\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys

[2008/02/14 03:04:29 | 00,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\WINDOWS\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys

[2008/02/14 03:04:28 | 00,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\WINDOWS\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >

[2006/11/02 04:46:03 | 00,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\WINDOWS\System32\cngaudit.dll

[2006/11/02 04:46:03 | 00,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\WINDOWS\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTORV.SYS >

[2008/01/19 02:42:51 | 00,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\WINDOWS\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008/01/19 02:42:51 | 00,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\WINDOWS\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006/11/02 04:51:25 | 00,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\WINDOWS\System32\drivers\iaStorV.sys

[2006/11/02 04:51:25 | 00,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\WINDOWS\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: NETLOGON.DLL >

[2006/11/02 04:46:11 | 00,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\WINDOWS\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

[2009/04/11 01:28:23 | 00,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\WINDOWS\System32\netlogon.dll

[2009/04/11 01:28:23 | 00,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\WINDOWS\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008/01/19 02:35:36 | 00,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\WINDOWS\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVSTOR.SYS >

[2006/11/02 04:50:13 | 00,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\WINDOWS\System32\drivers\nvstor.sys

[2006/11/02 04:50:13 | 00,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\WINDOWS\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008/01/19 02:42:09 | 00,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\WINDOWS\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008/01/19 02:42:09 | 00,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\WINDOWS\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: NVSTOR32.SYS >

[2007/10/26 18:51:24 | 00,110,624 | ---- | M] (NVIDIA Corporation) MD5=7EBA6C9A0A295B1559EFB9062E701218 -- C:\WINDOWS\System32\drivers\nvstor32.sys

[2007/10/26 18:51:24 | 00,110,624 | ---- | M] (NVIDIA Corporation) MD5=7EBA6C9A0A295B1559EFB9062E701218 -- C:\WINDOWS\System32\DriverStore\FileRepository\nvrd32.inf_0f6358b4\nvstor32.sys

[2007/07/02 16:37:08 | 00,110,112 | ---- | M] (NVIDIA Corporation) MD5=A1CE1A6FD74C046F029448FCFA5E386D -- C:\hp\DRIVERS\NVIDIA_SATA_Controller\nvstor32.sys

[2007/07/02 16:37:08 | 00,110,112 | ---- | M] (NVIDIA Corporation) MD5=A1CE1A6FD74C046F029448FCFA5E386D -- C:\WINDOWS\System32\DriverStore\FileRepository\nvstor32.inf_6b03e392\nvstor32.sys

< MD5 for: SCECLI.DLL >

[2008/01/19 02:36:19 | 00,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\WINDOWS\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2006/11/02 04:46:12 | 00,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\WINDOWS\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

[2009/04/11 01:28:24 | 00,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\WINDOWS\System32\scecli.dll

[2009/04/11 01:28:24 | 00,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\WINDOWS\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:D1B5B4F1

@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DFC5A2B2

@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:7E95B6FD

< End of report >

OTL Extras logfile created on: 1/3/2010 11:56:22 AM - Run 1

OTL by OldTimer - Version 3.1.20.2 Folder = C:\Users\HOME PC\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18865)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

894.00 Mb Total Physical Memory | 220.00 Mb Available Physical Memory | 25.00% Memory free

2.00 Gb Paging File | 1.00 Gb Available in Paging File | 56.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 225.21 Gb Total Space | 110.80 Gb Free Space | 49.20% Space Free | Partition Type: NTFS

Drive D: | 7.67 Gb Total Space | 0.87 Gb Free Space | 11.40% Space Free | Partition Type: NTFS

Drive E: | 114.48 Gb Total Space | 88.39 Gb Free Space | 77.21% Space Free | Partition Type: NTFS

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

Drive I: | 3.68 Gb Total Space | 2.02 Gb Free Space | 54.97% Space Free | Partition Type: FAT32

Computer Name: HENRIQUES

Current User Name: HOME PC

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)

https [open] -- Reg Error: Value error.

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"UacDisableNotify" = 0

"InternetSettingsDisableNotify" = 0

"AutoUpdateDisableNotify" = 1

"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{2E39E902-0D49-41E7-94DE-8E5C3CEEF403}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{54129F77-2393-426C-90A4-26C0F32AAABE}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{64DA4D44-3B5D-4ED6-9D57-13E2E0CB1CF8}" = lport=2869 | protocol=6 | dir=in | app=system |

"{6766C414-FF12-4533-9A90-81D75CD127EC}" = rport=10244 | protocol=6 | dir=out | app=system |

"{79A1A056-AC51-4400-85C7-5567E32108BC}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{81152BCF-D688-49B6-B47B-9573865A9B14}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |

"{8FD5ED97-2614-4B16-B9F7-54DE3CF7D9AA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{904D1729-0CCA-462A-88A3-74A5CFD04B5A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{914E17CD-7724-42CE-A78A-2EAC1978B3F4}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{96A87EF1-F562-45C2-8940-B7104E82198F}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{9C51D349-A109-4E78-B40C-4C1B69E32234}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |

"{9CF322CD-B974-4CCF-9375-391C89247E0B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

"{9E422476-73E5-497C-9291-A782044157B9}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |

"{A2DC02D6-6DDC-4E3C-85E5-64A09C6D6675}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{A82ED81C-2099-43E3-8553-840E2F7FB996}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{A994F744-B71E-44B6-A890-D580C55420EF}" = lport=3390 | protocol=6 | dir=in | app=system |

"{B0DC5F90-9268-422F-A6D2-CB82B0E1D361}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{B2FA7EC3-6F9E-4A38-9FEF-7462BF4409AE}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{B4EC058B-6BB6-4EDC-B971-A89BCE78D5A3}" = rport=10244 | protocol=6 | dir=out | app=system |

"{BE2ABE80-E8BC-4DCF-9826-05887E780573}" = lport=3390 | protocol=6 | dir=in | app=system |

"{CFA7FE72-5F6D-40A2-A4C3-35F50D42BE94}" = lport=10244 | protocol=6 | dir=in | app=system |

"{D9C77BA7-3A55-4BFB-8706-D054E78434FF}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |

"{E2114A87-8155-4BD5-8B67-879B73A604D5}" = lport=10244 | protocol=6 | dir=in | app=system |

"{F6EDB334-71E0-4C04-9A76-CD7A27C3C23D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{04369BFD-6EB2-43BA-A026-56E70BD0ED88}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |

"{05FCDE0F-E3F8-4BB9-AF0B-60B938176411}" = protocol=17 | dir=in | app=c:\windows\system32\lsass.exe |

"{15FA68EF-3BFD-4DD9-84C6-FA0844929409}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

"{18279238-F706-4CF0-BCE8-5112AFE4FC50}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |

"{1D035E2E-297E-46E9-BCA1-8200F8F5457E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |

"{1D670789-4F7C-46FB-942B-3840C90C1EC9}" = protocol=17 | dir=in | app=c:\windows\system32\logonui.exe |

"{2320BE99-B421-49CB-98E4-7B34AF9EE546}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |

"{2E2FA4A1-BD71-4E48-BE4E-9BB125CBE39B}" = protocol=6 | dir=in | app=c:\windows\system32\logonui.exe |

"{2FE24E2F-8B17-429E-8311-8485132E3AEC}" = protocol=6 | dir=in | app=c:\windows\system32\spoolsv.exe |

"{34FEB1D3-C762-4FAF-A7FE-A907EA9E2DC0}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |

"{36946570-5F96-412E-9AE1-D2FCE2F00435}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |

"{3C7D1D4C-1746-4E24-8CA5-4403B53F9F1C}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

"{3ECD7DED-F10D-4398-98D9-DF5E91F0B26A}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |

"{4698CA29-91A0-4CBB-B3B2-7AF30B4E1952}" = protocol=6 | dir=in | app=c:\program files\logitech\logitech vid\vid.exe |

"{4B2E45F8-EF93-4D63-B9AC-078F9FA4B677}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe |

"{50D86DE3-C0CA-4BCC-B0A5-3148887DA67B}" = protocol=17 | dir=in | app=c:\program files\logitech\logitech vid\vid.exe |

"{51174F16-C14C-42B7-B379-E221795CA117}" = protocol=17 | dir=in | app=c:\windows\system32\spoolsv.exe |

"{5F0CE812-8DEE-45B8-A1CE-6AB52920B76D}" = protocol=17 | dir=in | app=c:\program files\avira\antivir desktop\avguard.exe |

"{6A0F50C6-6BBB-49D5-AF0F-25F05558914E}" = protocol=6 | dir=in | app=c:\windows\system32\logonui.exe |

"{6D678CE0-8460-4261-BD37-D357CEB7591A}" = protocol=17 | dir=in | app=c:\windows\system32\spoolsv.exe |

"{733370BD-71DA-45DA-B935-0A3C14B8FD07}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |

"{738005AA-1115-4008-A0C5-E485CF2B849A}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |

"{764A5135-CFCD-4782-8393-3B77768C6E2C}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |

"{769FF02E-C24E-4E76-8012-A9C673DE9AC0}" = protocol=6 | dir=in | app=c:\windows\system32\wininit.exe |

"{7A86607A-056C-4CED-A519-7055C79FA52F}" = protocol=17 | dir=in | app=c:\program files\hp connections\6811507\program\hp connections.exe |

"{7F480067-8181-4984-AF12-69316EA6F94E}" = protocol=6 | dir=in | app=c:\program files\rhapsody\rhapsody.exe |

"{82700D9D-1A4E-4C6F-9703-4FE8F8F34575}" = protocol=17 | dir=in | app=c:\program files\hp connections\6811507\program\hp connections.exe |

"{84A262D3-97C7-45DD-AFA6-D737FF3E0FE0}" = protocol=6 | dir=in | app=c:\program files\hp connections\6811507\program\hp connections.exe |

"{8D15269B-ABDC-4F28-BC4F-F6855010388D}" = protocol=17 | dir=in | app=c:\windows\system32\logonui.exe |

"{925668F1-8257-4618-8263-DBC5F334D3B8}" = protocol=6 | dir=in | app=c:\windows\system32\lsass.exe |

"{94C3D72B-B977-4AC4-BF2B-FB30ABD91D14}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |

"{9F22FA8C-8E75-426B-8846-B9AEF031CB69}" = protocol=6 | dir=in | app=c:\program files\avira\antivir desktop\avguard.exe |

"{9F4C0058-8F75-49BF-8985-2A3332DB3045}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

"{A72F14A6-B6C9-49B8-AE15-18342844488C}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |

"{ABEB5F31-242F-46B1-860C-9490D30A301B}" = protocol=6 | dir=in | app=c:\program files\hp connections\6811507\program\hp connections.exe |

"{AC610A90-7C78-434A-BAEA-362018718B93}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |

"{B6995D39-5568-4400-90AC-AB39A4DD7CC2}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

"{BC82CACC-DCD3-4E29-8252-20028220B2FC}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |

"{C2A21A3D-3F8F-4720-A0DE-61C3E258FF2B}" = protocol=17 | dir=in | app=c:\program files\hp connections\6811507\program\hp connections.exe |

"{C3DA90FC-B768-4D4C-8458-8211DEF5C233}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |

"{C47A4D53-EB6A-46A9-8756-72937B6E7FB6}" = protocol=6 | dir=in | app=c:\windows\system32\lsass.exe |

"{C67FEDD9-D404-4EE4-8FA3-269F69C9A1D1}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |

"{C781E305-1157-4F28-9826-24FBE3E050D6}" = protocol=17 | dir=in | app=c:\windows\system32\lsass.exe |

"{CC35A2A0-9DFD-458F-A4A6-89EC3062FF3D}" = protocol=17 | dir=in | app=c:\windows\system32\wininit.exe |

"{CC58D6F6-361A-4809-984E-71F90F4CF9F6}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |

"{CF117AC8-AF38-4D61-8514-2376527780C1}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |

"{D333D24E-ED8C-4AC4-B849-CC428969AA75}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |

"{D6282A72-BBB3-4E56-8744-417277102AF6}" = protocol=6 | dir=in | app=c:\windows\system32\spoolsv.exe |

"{D7311A9F-7EB1-4ED9-8EAC-57701E3EDB76}" = protocol=6 | dir=in | app=c:\program files\hp connections\6811507\program\hp connections.exe |

"{DC8814A9-0D7C-49A5-812D-10868653DE5A}" = protocol=17 | dir=in | app=c:\windows\system32\wininit.exe |

"{DCC5ECAC-D250-4541-97A1-DA1DEADA6201}" = protocol=17 | dir=in | app=c:\program files\rhapsody\rhapsody.exe |

"{DE0EA372-68E1-48C7-BFBB-8B746A425002}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |

"{E427A89D-EB3D-4DB1-9622-0C365B12090D}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |

"{E9DFB893-D16F-491E-8299-DF82E5639064}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |

"{EB879A75-D9ED-4C60-AE7D-D39EDAAC538B}" = dir=in | app=c:\program files\hp connections\6811507\program\hp connections |

"{F33BF12B-072B-43C2-BBBF-F62C7D89D8FE}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |

"{FF5721D5-2448-410B-A623-1BACFB459EC4}" = protocol=6 | dir=in | app=c:\windows\system32\wininit.exe |

"TCP Query User{1B3EC465-C27C-4A93-8797-03E68BFF5F98}C:\users\home pc\appdata\local\temp\ixp000.tmp\smwinvnc.exe" = protocol=6 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp000.tmp\smwinvnc.exe |

"TCP Query User{39E07035-A051-42B7-B9A4-9DB20CD60A6C}C:\users\home pc\appdata\local\temp\ixp000.tmp\smpcsetup.exe" = protocol=6 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp000.tmp\smpcsetup.exe |

"TCP Query User{455579E9-3BC9-4A01-9182-A5D932046DBE}C:\users\home pc\appdata\local\temp\ixp003.tmp\smwinvnc.exe" = protocol=6 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp003.tmp\smwinvnc.exe |

"TCP Query User{8F38C0A9-1DFA-4839-BC6F-5556570F4B97}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |

"TCP Query User{8F5C70A9-5AE2-40B7-8812-A96118AEA562}C:\users\home pc\appdata\local\temp\ixp003.tmp\smpcsetup.exe" = protocol=6 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp003.tmp\smpcsetup.exe |

"TCP Query User{B65DDDAF-5857-4AA9-8CA1-F4EEFAF431CB}C:\users\home pc\appdata\local\temp\ixp001.tmp\smwinvnc.exe" = protocol=6 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp001.tmp\smwinvnc.exe |

"TCP Query User{B7B5B82A-9003-42A9-AE5E-013206FAF484}C:\users\home pc\appdata\local\temp\ixp002.tmp\smwinvnc.exe" = protocol=6 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp002.tmp\smwinvnc.exe |

"TCP Query User{E3FE1288-E0F4-450A-BF9F-7D2973618AFD}C:\users\home pc\appdata\local\temp\ixp001.tmp\smpcsetup.exe" = protocol=6 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp001.tmp\smpcsetup.exe |

"TCP Query User{ECE94D45-1D9F-4829-971B-B449CEC5D92C}C:\users\home pc\appdata\local\temp\ixp002.tmp\smpcsetup.exe" = protocol=6 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp002.tmp\smpcsetup.exe |

"TCP Query User{F9A82E13-2421-40BD-8CAD-4D5E46D42B95}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

"UDP Query User{25B086F1-84E5-4A8F-BF53-91EB53EABA08}C:\users\home pc\appdata\local\temp\ixp000.tmp\smwinvnc.exe" = protocol=17 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp000.tmp\smwinvnc.exe |

"UDP Query User{338EED7D-AFF5-4E8D-98BC-A9B2E30867EE}C:\users\home pc\appdata\local\temp\ixp000.tmp\smpcsetup.exe" = protocol=17 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp000.tmp\smpcsetup.exe |

"UDP Query User{8A3AA525-F310-4A9A-8CAC-ED7CDAA7C445}C:\users\home pc\appdata\local\temp\ixp001.tmp\smpcsetup.exe" = protocol=17 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp001.tmp\smpcsetup.exe |

"UDP Query User{9641C5CE-444F-43B5-AC61-7630455BF3AE}C:\users\home pc\appdata\local\temp\ixp003.tmp\smwinvnc.exe" = protocol=17 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp003.tmp\smwinvnc.exe |

"UDP Query User{A0F28425-E0CF-438E-AAB2-6B7C5469C31A}C:\users\home pc\appdata\local\temp\ixp002.tmp\smpcsetup.exe" = protocol=17 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp002.tmp\smpcsetup.exe |

"UDP Query User{A27A4004-1F35-4F83-80D4-59A8B32A1758}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

"UDP Query User{B509FD5D-1021-4930-88F4-E7D2FB5DD4F3}C:\users\home pc\appdata\local\temp\ixp001.tmp\smwinvnc.exe" = protocol=17 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp001.tmp\smwinvnc.exe |

"UDP Query User{C1612A58-E2EC-4C6B-9668-6B2CFE0E41BD}C:\users\home pc\appdata\local\temp\ixp003.tmp\smpcsetup.exe" = protocol=17 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp003.tmp\smpcsetup.exe |

"UDP Query User{D4A1982F-4313-4553-8711-D82D01DD9AAC}C:\users\home pc\appdata\local\temp\ixp002.tmp\smwinvnc.exe" = protocol=17 | dir=in | app=c:\users\home pc\appdata\local\temp\ixp002.tmp\smwinvnc.exe |

"UDP Query User{FADA9F00-DE25-409B-B540-1FA30FC26F08}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools

"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour

"{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}" = WD Diagnostics

"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data

"{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0

"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive

"{12A76360-388E-4B27-ABEB-D5FC5378DD2A}" = HPPhotoSmartPhotobookWebPack1

"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime

"{184E7118-0295-43C4-B72C-1D54AA75AAF7}" = Windows Live Mail

"{1D643CD7-4DD6-11D7-A4E0-000874180BB3}" = Microsoft Money 2004

"{1FD25FCD-6F39-4686-AFBB-7056EBAE5E68}" = Avira RootKit Detection

"{25F6C900-C138-4888-A56C-91D3D063023A}" = HP Update

"{2632D76E-7B2F-4717-A5B3-A381AF3EDCC9}" = TrendMicro_UserControls30

"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java 6 Update 15

"{2CC982C0-7EAE-11D4-ACC3-0050568AD318}" = Avery DesignPro

"{2D4F6BE3-6FEF-4FE9-9D01-1406B220D08C}" = Windows Live Photo Gallery

"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java 6 Update 5

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java 6 Update 7

"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE

"{3AC54383-31D1-4907-961B-B12CBB1D0AE8}" = MobileMe Control Panel

"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support

"{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend

"{4CACFCD9-F71B-413A-8DF5-1A6419D5CDC6}" = Cards_Calendar_OrderGift_DoMorePlugout

"{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}" = Logitech Vid

"{508CE775-4BA4-4748-82DF-FE28DA9F03B0}" = Windows Live Messenger

"{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In

"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy

"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites

"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works

"{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}" = HP Photo and Imaging 2.0 - All-in-One Drivers

"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{75A0EB9D-2D1E-4FB7-BF61-498E33C73EB4}" = Motorola Driver Installation

"{75E71ADD-042C-4F30-BFAC-A9EC42351313}" = Python 2.4.3

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{77CA976C-403C-47E2-940B-733ECAB6F62B}" = muvee autoProducer 5.0

"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8C64E145-54BA-11D6-91B1-00500462BE80}" = Microsoft Money 2004 System Pack

"{900A92BA-19EF-4A34-86CF-7B6C85BDD971}" = VC_MergeModuleToMSI

"{91130409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Small Business

"{9176251A-4CC1-4DDB-B343-B487195EB397}" = Windows Live Writer

"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant

"{9867A917-5D17-40DE-83BA-BEA5293194B1}" = HP Photo and Imaging 2.0 - All-in-One

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback

"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes

"{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}" = Windows Live installer

"{A87B11AC-4344-4E5D-8B12-8F471A87DAD9}" = LightScribe 1.4.136.1

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support

"{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements

"{AC76BA86-7AD7-1033-7B44-A70900000002}" = Adobe Reader 7.0.9

"{AC96671C-2001-432C-9826-5266D84EF1DC}" = Logitech Webcam Software

"{AD8780DE-96F5-454B-B551-E063B94AAD4F}" = Homework Helpers

"{B139DD51-C3F1-4583-98B4-D35F64EA847F}" = Windows Easy Transfer Companion (Beta)

"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5

"{C084BC61-E537-11DE-8616-005056806466}" = Google Earth

"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9

"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection

"{CBFEEA43-2B94-44AF-8325-B413E62D2A5D}" = HP Total Care Advisor

"{CD6DED2F-F3ED-4A7B-B84A-322E23FC668B}" = Mz Registry Optimizer

"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition

"{CE2121C6-C94D-4A73-8EA4-6943F33EE335}" = Picture Package Music Transfer

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CF6AE90D-05E8-4D0B-AF79-94F9E1CA5601}" = Microsoft Flight Simulator X Demo

"{D5068583-D569-468B-9755-5FBF5848F46F}" = Sony Picture Utility

"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01

"{E4A02A3F-4F8A-4D94-BB99-68BC1D1CF6DB}" = Roxio MyDVD Basic v9

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)

"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01

"{F94234DB-FD06-42C3-B88D-6FC4DC9F988C}" = HP Easy Setup - Core

"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner

"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites

"Adobe Acrobat 5.0" = Adobe Acrobat 5.0

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Photoshop 6.0" = Adobe Photoshop 6.0

"Adobe Shockwave Player" = Adobe Shockwave Player

"AIM_6" = AIM 6

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Soft Data Fax Modem with SmartCP

"dBpowerAMP Music Converter" = dBpowerAMP Music Converter

"dBpowerAMP WMA V9 Codec" = dBpowerAMP WMA V9 Codec

"Free Window Registry Repair" = Free Window Registry Repair

"HijackThis" = HijackThis 2.0.2

"Homestead SiteBuilder" = Homestead SiteBuilder

"hp instant support" = hp instant support

"HP Photosmart Essential" = HP Photosmart Essential 2.5

"HPOOVClient-6811507 Uninstaller" = HP Connections (remove only)

"InstallShield_{CF6AE90D-05E8-4D0B-AF79-94F9E1CA5601}" = Microsoft Flight Simulator X Demo

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Morpheus Photo Morpher_is1" = Morpheus Photo Morpher v3.01

"Navilog1_is1" = Navilog1 3.7.6

"NVIDIA Drivers" = NVIDIA Drivers

"OsdMaestro" = HP On-Screen Caps/Num/Scroll Lock Indicator

"PC-Doctor 5 for Windows" = Hardware Diagnostic Tools

"QcDrv" = Logitech

kahdah · January 3, 2010

ok just do OTL please.

supersonic · January 3, 2010

ok just do OTL please.

Thanks, done :welcome:

kahdah · January 3, 2010

Please do not start topic's at another forums to try and get help while you are already getting help.

Why ?

Since you have done a system restore now the fixes we have applied have been undone and the malware is still on the machine.

So that means any changes Combofix made were undone.

=======================================

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O4 - HKLM..\Run: [nuhisuhugo] C:\ProgramData\disawemo\disawemo.DLL ()
O20 - AppInit_DLLs: (C:\ProgramData\gokovuli\gokovuli.dll c:\windows\system32\fegenope.dll) - C:\ProgramData\gokovuli\gokovuli.dll File not found
O20 - AppInit_DLLs: (C:\ProgramData\jiwejela\jiwejela.dll) - C:\ProgramData\jiwejela\jiwejela.dll ()
O21 - SSODL: sovufodas - {ea958c90-d927-444d-98fc-cfe726621a27} - CLSID or File not found.
O21 - SSODL: voyuwelen - {cebb99b6-7a1e-4ef6-8af6-8d093daaf64b} - C:\Windows\System32\fegenope.dll File not found
O22 - SharedTaskScheduler: {cebb99b6-7a1e-4ef6-8af6-8d093daaf64b} - jugezatag - C:\Windows\System32\fegenope.dll File not found
O22 - SharedTaskScheduler: {ea958c90-d927-444d-98fc-cfe726621a27} - jugezatag - Reg Error: Key error. File not found
[2009/12/25 13:16:12 | 00,000,000 | ---D | C] -- C:\ProgramData\jiwejela
[2009/12/25 13:16:12 | 00,000,000 | ---D | C] -- C:\ProgramData\disawemo
[2009/12/25 13:16:12 | 00,000,000 | ---D | C] -- C:\ProgramData\bugubado
[2010/01/03 11:57:50 | 00,011,168 | -H-- | M] () -- C:\ProgramData\ruvokula.
[2009/11/25 20:51:50 | 00,000,000 | -HSD | M] -- C:\Users\HOME PC\AppData\Roaming\lowsec


:Commands
[emptytemp]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply.

================================Malwarebytes' Anti-Malware=================================

Please update\run Malwarebytes' Anti-Malware.

Double Click the Malwarebytes Anti-Malware icon to run the application.

Click on the update tab then click on Check for updates.
If an update is found, it will download and install the latest version.
Once the update has loaded, go to the Scanner tab and select "Perform Full Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.

================================Online scan=================================

* Go here to run an online scannner from ESET.

Note: You will need to use Internet explorer for this scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Check next options: Remove found threats and Scan unwanted applications.
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\ESET\ESET Online Scanner\log.txt
Copy and paste that log as a reply to this topic

supersonic · January 3, 2010

I didn't try to get help there, I only asked if they knew how to fix the IE run as admin problem because it had a link at the bottom of the combofix page you linked. I have only worked on this problem with you. My husband did the system restore when he woke up and found that IE wouldn't work for him, he didn't know that I was working with you.

I just wanted you to know that and now I'll go read the rest of your post.

kahdah · January 3, 2010

Ok.

Please post those logs when completed.

supersonic · January 3, 2010

Ran everything you told me to. OTL and MBAM logs below. ESET completed and found one threat but when I clicked FINISH, it propmpted me to buy ESET or try the 30 day free trial and the ESET log is blank. I'll try to run it again.

All processes killed

========== OTL ==========

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\nuhisuhugo deleted successfully.

C:\ProgramData\disawemo\disawemo.dll moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\ProgramData\gokovuli\gokovuli.dll c:\windows\system32\fegenope.dll deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\ProgramData\jiwejela\jiwejela.dll deleted successfully.

C:\ProgramData\jiwejela\jiwejela.dll moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\sovufodas deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ea958c90-d927-444d-98fc-cfe726621a27}\ not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\voyuwelen deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cebb99b6-7a1e-4ef6-8af6-8d093daaf64b}\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{cebb99b6-7a1e-4ef6-8af6-8d093daaf64b} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cebb99b6-7a1e-4ef6-8af6-8d093daaf64b}\ not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{ea958c90-d927-444d-98fc-cfe726621a27} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ea958c90-d927-444d-98fc-cfe726621a27}\ not found.

C:\ProgramData\jiwejela folder moved successfully.

C:\ProgramData\disawemo folder moved successfully.

C:\ProgramData\bugubado folder moved successfully.

C:\ProgramData\ruvokula moved successfully.

C:\Users\HOME PC\AppData\Roaming\lowsec folder moved successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 402 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: HOME PC

->Temp folder emptied: 59612109 bytes

->Temporary Internet Files folder emptied: 103375045 bytes

->Java cache emptied: 59479308 bytes

->Google Chrome cache emptied: 22339982 bytes

User: Mcx1

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 402 bytes

User: Public

->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 3425552 bytes

Windows Temp folder emptied: 222652 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes

RecycleBin emptied: 42030249 bytes

Total Files Cleaned = 277.00 mb

OTL by OldTimer - Version 3.1.20.2 log created on 01032010_142126

Files\Folders moved on Reboot...

File\Folder C:\Windows\temp\logishrd\LVPrcInj02.dll not found!

Registry entries deleted on Reboot...

Malwarebytes' Anti-Malware 1.43

Database version: 3488

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18865

1/3/2010 4:12:51 PM

mbam-log-2010-01-03 (16-12-51).txt

Scan type: Full Scan (C:\|)

Objects scanned: 351434

Time elapsed: 1 hour(s), 42 minute(s), 7 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\_OTL\MovedFiles\01032010_142126\C_ProgramData\bugubado\bugubado.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\_OTL\MovedFiles\01032010_142126\C_ProgramData\disawemo\disawemo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\_OTL\MovedFiles\01032010_142126\C_ProgramData\jiwejela\jiwejela.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

kahdah · January 4, 2010

Ok let me know what it finds.

supersonic · January 4, 2010

C:\Users\HOME PC\Documents\oemail\Deleted Items.dbx multiple threats unable to clean

E:\Documents and Settings\new\Local Settings\Application Data\Identities\{51B09F1E-6792-4431-98D3-7777CEC1498C}\Microsoft\Outlook Express\Deleted Items.dbx multiple threats unable to clean

E:\Documents and Settings\new\My Documents\Setup-Install Programs\Install_AIM.exe Win32/Adware.WBug.A application deleted - quarantined

E:\Program Files\AIM\Sysfiles\WxBug.EXE Win32/Adware.WBug.A application deleted - quarantined

kahdah · January 4, 2010

OK all you have left are some bad emails in your deleted items folder,

Empty that and it will be gone.

How are things running?

Double click on OTL to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open one notepad window. OTL.Txt a This is saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.

supersonic · January 4, 2010

How are things running?

Nothing has popped up in the last 2 days, that has to be a good sign, no? :welcome:

OTL logfile created on: 1/4/2010 7:59:00 AM - Run 2

OTL by OldTimer - Version 3.1.20.2 Folder = C:\Users\HOME PC\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18865)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

894.00 Mb Total Physical Memory | 316.00 Mb Available Physical Memory | 35.00% Memory free

2.00 Gb Paging File | 1.00 Gb Available in Paging File | 49.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 225.21 Gb Total Space | 111.69 Gb Free Space | 49.59% Space Free | Partition Type: NTFS

Drive D: | 7.67 Gb Total Space | 0.87 Gb Free Space | 11.40% Space Free | Partition Type: NTFS

Drive E: | 114.48 Gb Total Space | 88.39 Gb Free Space | 77.21% Space Free | Partition Type: NTFS

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

Drive I: | 3.68 Gb Total Space | 2.02 Gb Free Space | 54.97% Space Free | Partition Type: FAT32

Computer Name: HENRIQUES

Current User Name: HOME PC

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\HOME PC\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)

PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)

PRC - C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe ()

PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)

PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)

PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()

PRC - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()

PRC - C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)

PRC - C:\WINDOWS\System32\nvvsvc.exe (NVIDIA Corporation)

PRC - C:\WINDOWS\System32\WUDFHost.exe (Microsoft Corporation)

PRC - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HpqSRmon.exe (Hewlett-Packard)

PRC - C:\WINDOWS\RtHDVCpl.exe (Realtek Semiconductor)

PRC - c:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)

PRC - C:\WINDOWS\System32\drivers\XAudio.exe (Conexant Systems, Inc.)

PRC - C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe (Logitech Inc.)

========== Modules (SafeList) ==========

MOD - C:\Users\HOME PC\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\WINDOWS\System32\msi.dll (Microsoft Corporation)

MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)

MOD - C:\WINDOWS\System32\sfc_os.dll (Microsoft Corporation)

MOD - C:\WINDOWS\System32\sfc.dll (Microsoft Corporation)

MOD - C:\WINDOWS\System32\msiltcfg.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (J) -- File not found

SRV - (IJS) -- File not found