gpascoe Posted July 14, 2010 ID:284420 Share Posted July 14, 2010 Hi - Malware Anti-Malware frequently throughout the day notifies me that it blocked a potentially maliciuos IP address. How do I stop whatever it is that keeps trying to access these sites? Link to post Share on other sites More sharing options...
Elise Posted July 15, 2010 ID:284570 Share Posted July 15, 2010 Hello , And My name is Elise and I'll be glad to help you with your computer problems.I will be working on your malware issues, this may or may not solve other issues you may have with your machine.Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen. Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications. -----------------------------------------------------------If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.If you have already posted a log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.We need to see some information about what is happening in your machine. Please perform the following scan:Please download OTL from one of the following mirrors:This is THE Mirror[*]Save it to your desktop.[*]Double click on the icon on your desktop.[*]Click the "Scan All Users" checkbox.[*]Push the button.[*]Two reports will open, copy and paste them in a reply here:OTListIt.txt <-- Will be openedExtra.txt <-- Will be minimizedPlease download GMER from one of the following locations and save it to your desktop:Main MirrorThis version will download a randomly named file (Recommended)Zipped MirrorThis version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.Disconnect from the Internet and close all running programs.Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.Now click the Scan button. If you see a rootkit warning window, click OK.When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.Click the Copy button and paste the results into your next reply.Exit GMER and re-enable all active protection when done.-- If you encounter any problems, try running GMER in Safe Mode.-------------------------------------------------------------In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problemIf you still need help, please include the following in your next replyA detailed description of your problemsA new OTL log (don't forget extra.txt)GMER log Link to post Share on other sites More sharing options...
gpascoe Posted July 17, 2010 Author ID:285538 Share Posted July 17, 2010 Hello , And My name is Elise and I'll be glad to help you with your computer problems.I will be working on your malware issues, this may or may not solve other issues you may have with your machine.Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen. Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications. -----------------------------------------------------------If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.If you have already posted a log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.We need to see some information about what is happening in your machine. Please perform the following scan:Please download OTL from one of the following mirrors:This is THE Mirror[*]Save it to your desktop.[*]Double click on the icon on your desktop.[*]Click the "Scan All Users" checkbox.[*]Push the button.[*]Two reports will open, copy and paste them in a reply here:OTListIt.txt <-- Will be openedExtra.txt <-- Will be minimizedPlease download GMER from one of the following locations and save it to your desktop:Main MirrorThis version will download a randomly named file (Recommended)Zipped MirrorThis version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.Disconnect from the Internet and close all running programs.Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.Now click the Scan button. If you see a rootkit warning window, click OK.When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.Click the Copy button and paste the results into your next reply.Exit GMER and re-enable all active protection when done.-- If you encounter any problems, try running GMER in Safe Mode.-------------------------------------------------------------In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problemIf you still need help, please include the following in your next replyA detailed description of your problemsA new OTL log (don't forget extra.txt)GMER logThanks Elise. I get multiple messages throughout the day that Malware Bytes has blocked access to a potentially malicous site. The following is the latest log from Malware-Bytes Anti Malware: protection-log-2010-07-16.txt. I'll send the OTL logs next.09:40:04 Gary1 MESSAGE Protection started successfully09:40:11 Gary1 MESSAGE IP Protection started successfully09:46:00 Gary1 MESSAGE Scheduled scan executed successfully09:46:56 Gary1 IP-BLOCK 94.228.209.20009:46:59 Gary1 IP-BLOCK 94.228.209.20009:47:05 Gary1 IP-BLOCK 94.228.209.20009:47:55 Gary1 IP-BLOCK 94.228.209.20009:47:58 Gary1 IP-BLOCK 94.228.209.20009:48:04 Gary1 IP-BLOCK 94.228.209.20009:50:00 Gary1 IP-BLOCK 91.212.226.5909:50:03 Gary1 IP-BLOCK 91.212.226.5909:50:09 Gary1 IP-BLOCK 91.212.226.5910:00:21 Gary1 IP-BLOCK 195.170.178.5510:00:24 Gary1 IP-BLOCK 195.170.178.5510:00:30 Gary1 IP-BLOCK 195.170.178.5510:04:16 Gary1 IP-BLOCK 94.228.209.20010:04:19 Gary1 IP-BLOCK 94.228.209.20010:04:25 Gary1 IP-BLOCK 94.228.209.20010:10:42 Gary1 IP-BLOCK 91.212.226.5910:10:45 Gary1 IP-BLOCK 91.212.226.5910:10:51 Gary1 IP-BLOCK 91.212.226.5910:37:37 Gary1 IP-BLOCK 94.228.209.20010:37:40 Gary1 IP-BLOCK 94.228.209.20010:37:46 Gary1 IP-BLOCK 94.228.209.20010:43:58 Gary1 IP-BLOCK 94.228.209.20010:44:01 Gary1 IP-BLOCK 94.228.209.20010:44:07 Gary1 IP-BLOCK 94.228.209.20011:03:19 Gary1 IP-BLOCK 94.228.209.20011:03:22 Gary1 IP-BLOCK 94.228.209.20011:03:28 Gary1 IP-BLOCK 94.228.209.20011:16:40 Gary1 IP-BLOCK 94.228.209.20011:16:43 Gary1 IP-BLOCK 94.228.209.20011:16:49 Gary1 IP-BLOCK 94.228.209.20011:50:02 Gary1 IP-BLOCK 94.228.209.20011:50:04 Gary1 IP-BLOCK 94.228.209.20011:50:10 Gary1 IP-BLOCK 94.228.209.20011:50:56 Gary1 IP-BLOCK 91.212.226.5911:50:59 Gary1 IP-BLOCK 91.212.226.5911:51:05 Gary1 IP-BLOCK 91.212.226.5912:01:18 Gary1 IP-BLOCK 195.170.178.5512:01:21 Gary1 IP-BLOCK 195.170.178.5512:01:27 Gary1 IP-BLOCK 195.170.178.5512:11:39 Gary1 IP-BLOCK 91.212.226.5912:11:42 Gary1 IP-BLOCK 91.212.226.5912:11:48 Gary1 IP-BLOCK 91.212.226.5912:23:23 Gary1 IP-BLOCK 94.228.209.20012:23:26 Gary1 IP-BLOCK 94.228.209.20012:23:32 Gary1 IP-BLOCK 94.228.209.20012:45:44 Gary1 IP-BLOCK 94.228.209.20012:45:47 Gary1 IP-BLOCK 94.228.209.20012:45:53 Gary1 IP-BLOCK 94.228.209.20013:04:05 Gary1 IP-BLOCK 94.228.209.20013:04:08 Gary1 IP-BLOCK 94.228.209.20013:04:14 Gary1 IP-BLOCK 94.228.209.20013:30:26 Gary1 IP-BLOCK 94.228.209.20013:30:29 Gary1 IP-BLOCK 94.228.209.20013:30:35 Gary1 IP-BLOCK 94.228.209.20013:51:51 Gary1 IP-BLOCK 91.212.226.5913:51:54 Gary1 IP-BLOCK 91.212.226.5913:52:00 Gary1 IP-BLOCK 91.212.226.5913:56:47 Gary1 IP-BLOCK 94.228.209.20013:56:50 Gary1 IP-BLOCK 94.228.209.20013:56:56 Gary1 IP-BLOCK 94.228.209.20014:02:12 Gary1 IP-BLOCK 195.170.178.5514:02:15 Gary1 IP-BLOCK 195.170.178.5514:02:21 Gary1 IP-BLOCK 195.170.178.5514:12:34 Gary1 IP-BLOCK 91.212.226.5914:12:37 Gary1 IP-BLOCK 91.212.226.5914:12:43 Gary1 IP-BLOCK 91.212.226.5914:19:08 Gary1 IP-BLOCK 94.228.209.20014:19:11 Gary1 IP-BLOCK 94.228.209.20014:19:17 Gary1 IP-BLOCK 94.228.209.20014:20:56 Gary1 IP-BLOCK 91.212.226.17914:20:59 Gary1 IP-BLOCK 91.212.226.17914:21:05 Gary1 IP-BLOCK 91.212.226.17914:21:17 Gary1 IP-BLOCK 91.212.226.17914:21:20 Gary1 IP-BLOCK 91.212.226.17914:21:26 Gary1 IP-BLOCK 91.212.226.17914:21:38 Gary1 IP-BLOCK 85.12.46.15614:21:41 Gary1 IP-BLOCK 85.12.46.15614:21:47 Gary1 IP-BLOCK 85.12.46.15614:21:59 Gary1 IP-BLOCK 85.12.46.15614:22:02 Gary1 IP-BLOCK 85.12.46.15614:22:08 Gary1 IP-BLOCK 85.12.46.15614:22:20 Gary1 IP-BLOCK 85.12.46.15714:22:23 Gary1 IP-BLOCK 85.12.46.15714:22:29 Gary1 IP-BLOCK 85.12.46.15714:22:41 Gary1 IP-BLOCK 85.12.46.15714:22:44 Gary1 IP-BLOCK 85.12.46.15714:22:50 Gary1 IP-BLOCK 85.12.46.15714:23:03 Gary1 IP-BLOCK 91.212.226.18214:23:05 Gary1 IP-BLOCK 91.212.226.18214:23:11 Gary1 IP-BLOCK 91.212.226.18214:23:23 Gary1 IP-BLOCK 91.212.226.18214:23:26 Gary1 IP-BLOCK 91.212.226.18214:23:32 Gary1 IP-BLOCK 91.212.226.18214:23:45 Gary1 IP-BLOCK 85.12.46.15814:23:48 Gary1 IP-BLOCK 85.12.46.15814:23:54 Gary1 IP-BLOCK 85.12.46.15814:24:06 Gary1 IP-BLOCK 85.12.46.15814:24:09 Gary1 IP-BLOCK 85.12.46.15814:24:15 Gary1 IP-BLOCK 85.12.46.15814:24:27 Gary1 IP-BLOCK 85.12.46.15714:24:30 Gary1 IP-BLOCK 85.12.46.15714:24:36 Gary1 IP-BLOCK 85.12.46.15714:24:48 Gary1 IP-BLOCK 85.12.46.15714:24:51 Gary1 IP-BLOCK 85.12.46.15714:24:57 Gary1 IP-BLOCK 85.12.46.15714:25:09 Gary1 IP-BLOCK 85.12.46.15514:25:12 Gary1 IP-BLOCK 85.12.46.15514:25:18 Gary1 IP-BLOCK 85.12.46.15514:25:30 Gary1 IP-BLOCK 85.12.46.15514:25:33 Gary1 IP-BLOCK 85.12.46.15514:25:39 Gary1 IP-BLOCK 85.12.46.15514:25:51 Gary1 IP-BLOCK 85.12.46.15514:25:54 Gary1 IP-BLOCK 85.12.46.15514:26:00 Gary1 IP-BLOCK 85.12.46.15514:26:12 Gary1 IP-BLOCK 85.12.46.15514:26:15 Gary1 IP-BLOCK 85.12.46.15514:26:21 Gary1 IP-BLOCK 85.12.46.15514:26:33 Gary1 IP-BLOCK 85.12.46.15814:26:36 Gary1 IP-BLOCK 85.12.46.15814:26:42 Gary1 IP-BLOCK 85.12.46.15814:26:54 Gary1 IP-BLOCK 85.12.46.15814:26:57 Gary1 IP-BLOCK 85.12.46.15814:27:03 Gary1 IP-BLOCK 85.12.46.15814:29:04 Gary1 IP-BLOCK 91.212.226.17914:29:07 Gary1 IP-BLOCK 91.212.226.17914:29:13 Gary1 IP-BLOCK 91.212.226.17914:29:25 Gary1 IP-BLOCK 85.12.46.15614:29:28 Gary1 IP-BLOCK 85.12.46.15614:29:34 Gary1 IP-BLOCK 85.12.46.15614:29:46 Gary1 IP-BLOCK 85.12.46.15714:29:49 Gary1 IP-BLOCK 85.12.46.15714:29:55 Gary1 IP-BLOCK 85.12.46.15714:30:07 Gary1 IP-BLOCK 91.212.226.17914:30:10 Gary1 IP-BLOCK 91.212.226.17914:30:16 Gary1 IP-BLOCK 91.212.226.17914:30:28 Gary1 IP-BLOCK 91.212.226.18214:30:31 Gary1 IP-BLOCK 91.212.226.18214:30:37 Gary1 IP-BLOCK 91.212.226.18214:30:49 Gary1 IP-BLOCK 85.12.46.15614:30:52 Gary1 IP-BLOCK 85.12.46.15614:30:58 Gary1 IP-BLOCK 85.12.46.15614:31:10 Gary1 IP-BLOCK 85.12.46.15814:31:13 Gary1 IP-BLOCK 85.12.46.15814:31:19 Gary1 IP-BLOCK 85.12.46.15814:31:31 Gary1 IP-BLOCK 85.12.46.15714:31:34 Gary1 IP-BLOCK 85.12.46.15714:31:40 Gary1 IP-BLOCK 85.12.46.15714:31:52 Gary1 IP-BLOCK 85.12.46.15714:31:55 Gary1 IP-BLOCK 85.12.46.15714:32:01 Gary1 IP-BLOCK 85.12.46.15714:32:13 Gary1 IP-BLOCK 91.212.226.18214:32:16 Gary1 IP-BLOCK 91.212.226.18214:32:22 Gary1 IP-BLOCK 91.212.226.18214:32:34 Gary1 IP-BLOCK 85.12.46.15514:32:37 Gary1 IP-BLOCK 85.12.46.15514:32:43 Gary1 IP-BLOCK 85.12.46.15514:32:55 Gary1 IP-BLOCK 91.212.226.17914:32:58 Gary1 IP-BLOCK 91.212.226.17914:33:04 Gary1 IP-BLOCK 91.212.226.17914:33:16 Gary1 IP-BLOCK 85.12.46.15814:33:19 Gary1 IP-BLOCK 85.12.46.15814:33:25 Gary1 IP-BLOCK 85.12.46.15814:33:37 Gary1 IP-BLOCK 85.12.46.15514:33:40 Gary1 IP-BLOCK 85.12.46.15514:33:46 Gary1 IP-BLOCK 85.12.46.15514:33:59 Gary1 IP-BLOCK 91.212.226.17914:34:02 Gary1 IP-BLOCK 91.212.226.17914:34:08 Gary1 IP-BLOCK 91.212.226.17914:34:20 Gary1 IP-BLOCK 85.12.46.15614:34:23 Gary1 IP-BLOCK 85.12.46.15614:34:29 Gary1 IP-BLOCK 85.12.46.15614:34:41 Gary1 IP-BLOCK 85.12.46.15714:34:44 Gary1 IP-BLOCK 85.12.46.15714:34:50 Gary1 IP-BLOCK 85.12.46.15714:35:02 Gary1 IP-BLOCK 85.12.46.15814:35:05 Gary1 IP-BLOCK 85.12.46.15814:35:11 Gary1 IP-BLOCK 85.12.46.15814:35:23 Gary1 IP-BLOCK 85.12.46.15614:35:26 Gary1 IP-BLOCK 85.12.46.15614:35:32 Gary1 IP-BLOCK 85.12.46.15614:35:44 Gary1 IP-BLOCK 85.12.46.15714:35:47 Gary1 IP-BLOCK 85.12.46.15714:35:53 Gary1 IP-BLOCK 85.12.46.15714:36:05 Gary1 IP-BLOCK 85.12.46.15514:36:08 Gary1 IP-BLOCK 85.12.46.15514:36:14 Gary1 IP-BLOCK 85.12.46.15514:36:26 Gary1 IP-BLOCK 85.12.46.15714:36:29 Gary1 IP-BLOCK 85.12.46.15714:36:35 Gary1 IP-BLOCK 85.12.46.15714:36:47 Gary1 IP-BLOCK 91.212.226.18214:36:50 Gary1 IP-BLOCK 91.212.226.18214:36:56 Gary1 IP-BLOCK 91.212.226.18214:37:09 Gary1 IP-BLOCK 85.12.46.15514:37:12 Gary1 IP-BLOCK 85.12.46.15514:37:18 Gary1 IP-BLOCK 85.12.46.15514:37:30 Gary1 IP-BLOCK 91.212.226.18214:37:33 Gary1 IP-BLOCK 91.212.226.18214:37:39 Gary1 IP-BLOCK 91.212.226.18214:37:51 Gary1 IP-BLOCK 85.12.46.15814:37:54 Gary1 IP-BLOCK 85.12.46.15814:38:00 Gary1 IP-BLOCK 85.12.46.15814:38:12 Gary1 IP-BLOCK 85.12.46.15814:38:15 Gary1 IP-BLOCK 85.12.46.15814:38:21 Gary1 IP-BLOCK 85.12.46.15814:38:33 Gary1 IP-BLOCK 85.12.46.15814:38:36 Gary1 IP-BLOCK 85.12.46.15814:38:42 Gary1 IP-BLOCK 85.12.46.15814:38:54 Gary1 IP-BLOCK 85.12.46.15714:38:57 Gary1 IP-BLOCK 85.12.46.15714:39:03 Gary1 IP-BLOCK 85.12.46.15714:39:15 Gary1 IP-BLOCK 85.12.46.15714:39:18 Gary1 IP-BLOCK 85.12.46.15714:39:24 Gary1 IP-BLOCK 85.12.46.15714:39:36 Gary1 IP-BLOCK 85.12.46.15514:39:39 Gary1 IP-BLOCK 85.12.46.15514:39:45 Gary1 IP-BLOCK 85.12.46.15514:39:57 Gary1 IP-BLOCK 85.12.46.15514:40:00 Gary1 IP-BLOCK 85.12.46.15514:40:06 Gary1 IP-BLOCK 85.12.46.15514:40:18 Gary1 IP-BLOCK 85.12.46.15514:40:21 Gary1 IP-BLOCK 85.12.46.15514:40:27 Gary1 IP-BLOCK 85.12.46.15514:40:39 Gary1 IP-BLOCK 85.12.46.15514:40:42 Gary1 IP-BLOCK 85.12.46.15514:40:48 Gary1 IP-BLOCK 85.12.46.15514:41:00 Gary1 IP-BLOCK 85.12.46.15814:41:03 Gary1 IP-BLOCK 85.12.46.15814:41:09 Gary1 IP-BLOCK 85.12.46.15814:41:21 Gary1 IP-BLOCK 85.12.46.15814:41:24 Gary1 IP-BLOCK 85.12.46.15814:41:30 Gary1 IP-BLOCK 85.12.46.15814:46:00 Gary1 MESSAGE Scheduled scan executed successfully14:46:29 Gary1 IP-BLOCK 94.228.209.20014:46:32 Gary1 IP-BLOCK 94.228.209.20014:46:38 Gary1 IP-BLOCK 94.228.209.20015:19:51 Gary1 IP-BLOCK 94.228.209.20015:19:54 Gary1 IP-BLOCK 94.228.209.20015:20:00 Gary1 IP-BLOCK 94.228.209.20015:37:12 Gary1 IP-BLOCK 94.228.209.20015:37:15 Gary1 IP-BLOCK 94.228.209.20015:37:21 Gary1 IP-BLOCK 94.228.209.20015:52:51 Gary1 IP-BLOCK 91.212.226.5915:52:54 Gary1 IP-BLOCK 91.212.226.5915:53:00 Gary1 IP-BLOCK 91.212.226.5916:03:12 Gary1 IP-BLOCK 195.170.178.5516:03:15 Gary1 IP-BLOCK 195.170.178.5516:03:22 Gary1 IP-BLOCK 195.170.178.5516:04:33 Gary1 IP-BLOCK 94.228.209.20016:04:36 Gary1 IP-BLOCK 94.228.209.20016:04:42 Gary1 IP-BLOCK 94.228.209.20016:13:34 Gary1 IP-BLOCK 91.212.226.5916:13:37 Gary1 IP-BLOCK 91.212.226.5916:13:43 Gary1 IP-BLOCK 91.212.226.5916:13:55 Gary1 IP-BLOCK 94.228.209.20016:13:58 Gary1 IP-BLOCK 94.228.209.20016:14:04 Gary1 IP-BLOCK 94.228.209.20016:24:17 Gary1 IP-BLOCK 94.228.209.20016:24:20 Gary1 IP-BLOCK 94.228.209.20016:24:26 Gary1 IP-BLOCK 94.228.209.20016:58:38 Gary1 IP-BLOCK 94.228.209.20016:58:41 Gary1 IP-BLOCK 94.228.209.20016:58:47 Gary1 IP-BLOCK 94.228.209.20017:12:59 Gary1 IP-BLOCK 94.228.209.20017:13:02 Gary1 IP-BLOCK 94.228.209.20017:13:08 Gary1 IP-BLOCK 94.228.209.20017:30:20 Gary1 IP-BLOCK 94.228.209.20017:30:23 Gary1 IP-BLOCK 94.228.209.20017:30:29 Gary1 IP-BLOCK 94.228.209.20017:44:41 Gary1 IP-BLOCK 94.228.209.20017:44:44 Gary1 IP-BLOCK 94.228.209.20017:44:50 Gary1 IP-BLOCK 94.228.209.20017:55:20 Gary1 MESSAGE Protection started successfully17:55:26 Gary1 MESSAGE IP Protection started successfully18:01:40 Gary1 IP-BLOCK 94.228.209.20018:01:43 Gary1 IP-BLOCK 94.228.209.20018:01:49 Gary1 IP-BLOCK 94.228.209.20018:02:40 Gary1 IP-BLOCK 94.228.209.20018:02:43 Gary1 IP-BLOCK 94.228.209.20018:02:49 Gary1 IP-BLOCK 94.228.209.20018:04:56 Gary1 IP-BLOCK 91.212.226.5918:04:58 Gary1 IP-BLOCK 91.212.226.5918:05:04 Gary1 IP-BLOCK 91.212.226.5918:10:01 Gary1 IP-BLOCK 94.228.209.20018:10:04 Gary1 IP-BLOCK 94.228.209.20018:10:10 Gary1 IP-BLOCK 94.228.209.20018:15:17 Gary1 IP-BLOCK 195.170.178.5518:15:20 Gary1 IP-BLOCK 195.170.178.5518:15:26 Gary1 IP-BLOCK 195.170.178.5518:25:38 Gary1 IP-BLOCK 91.212.226.5918:25:41 Gary1 IP-BLOCK 91.212.226.5918:25:47 Gary1 IP-BLOCK 91.212.226.5918:29:22 Gary1 IP-BLOCK 94.228.209.20018:29:25 Gary1 IP-BLOCK 94.228.209.20018:29:31 Gary1 IP-BLOCK 94.228.209.20019:03:43 Gary1 IP-BLOCK 94.228.209.20019:03:45 Gary1 IP-BLOCK 94.228.209.20019:03:52 Gary1 IP-BLOCK 94.228.209.20019:33:04 Gary1 IP-BLOCK 94.228.209.20019:33:07 Gary1 IP-BLOCK 94.228.209.20019:33:13 Gary1 IP-BLOCK 94.228.209.20019:47:25 Gary1 IP-BLOCK 94.228.209.20019:47:28 Gary1 IP-BLOCK 94.228.209.20019:47:34 Gary1 IP-BLOCK 94.228.209.20020:05:49 Gary1 IP-BLOCK 91.212.226.5920:05:52 Gary1 IP-BLOCK 91.212.226.5920:05:58 Gary1 IP-BLOCK 91.212.226.5920:10:33 Gary1 MESSAGE Scheduled update executed successfully20:10:33 Gary1 MESSAGE IP Protection stopped20:10:36 Gary1 MESSAGE Scheduled scan executed successfully20:10:46 Gary1 MESSAGE Database updated successfully20:10:49 Gary1 MESSAGE IP Protection started successfully20:12:46 Gary1 IP-BLOCK 94.228.209.20020:12:49 Gary1 IP-BLOCK 94.228.209.20020:12:55 Gary1 IP-BLOCK 94.228.209.20020:16:10 Gary1 IP-BLOCK 195.170.178.5520:16:13 Gary1 IP-BLOCK 195.170.178.5520:16:19 Gary1 IP-BLOCK 195.170.178.5520:26:31 Gary1 IP-BLOCK 91.212.226.5920:26:34 Gary1 IP-BLOCK 91.212.226.5920:26:40 Gary1 IP-BLOCK 91.212.226.5920:44:07 Gary1 IP-BLOCK 94.228.209.20020:44:10 Gary1 IP-BLOCK 94.228.209.20020:44:16 Gary1 IP-BLOCK 94.228.209.20020:59:28 Gary1 IP-BLOCK 94.228.209.200 Link to post Share on other sites More sharing options...
gpascoe Posted July 17, 2010 Author ID:285539 Share Posted July 17, 2010 This is the OTL.txtOTL logfile created on: 7/16/2010 5:55:28 PM - Run 1OTL by OldTimer - Version 3.2.9.0 Folder = C:\Documents and Settings\Gary1\DesktopWindows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 7.0.5730.11)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 73.00% Memory free5.00 Gb Paging File | 4.00 Gb Available in Paging File | 84.00% Paging File freePaging file location(s): C:\pagefile.sys 2046 4092 [binary data]%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 143.69 Gb Total Space | 54.38 Gb Free Space | 37.84% Space Free | Partition Type: NTFSDrive D: | 232.88 Gb Total Space | 47.83 Gb Free Space | 20.54% Space Free | Partition Type: NTFSE: Drive not present or media not loadedF: Drive not present or media not loadedG: Drive not present or media not loadedH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: GARYCurrent User Name: Gary1Logged in as Administrator.Current Boot Mode: NormalScan Mode: All usersCompany Name Whitelist: OffSkip Microsoft Files: OffFile Age = 30 DaysOutput = Standard========== Processes (SafeList) ==========PRC - [2010/07/16 14:43:42 | 002,065,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exePRC - [2010/07/16 14:43:39 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exePRC - [2010/07/16 14:43:38 | 000,620,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exePRC - [2010/07/16 14:43:36 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exePRC - [2010/07/16 14:43:30 | 000,723,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exePRC - [2010/07/16 14:43:29 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exePRC - [2010/07/16 10:35:43 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Gary1\Desktop\OTL.exePRC - [2010/07/07 10:24:33 | 002,403,568 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXEPRC - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exePRC - [2010/04/29 15:39:32 | 000,437,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exePRC - [2010/04/16 08:33:40 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exePRC - [2010/03/21 14:41:35 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exePRC - [2009/09/29 10:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exePRC - [2009/09/25 23:32:18 | 000,189,736 | ---- | M] (Seagate Technology LLC) -- C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exePRC - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exePRC - [2008/10/20 11:36:40 | 000,028,672 | ---- | M] (Lenovo Group Limited) -- c:\Program Files\Lenovo\System Update\SUService.exePRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exePRC - [2008/03/04 11:34:20 | 000,487,424 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exePRC - [2008/03/04 11:34:12 | 001,122,304 | ---- | M] (Lenovo Group Limited) -- c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exePRC - [2008/02/15 11:40:50 | 000,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exePRC - [2008/01/18 18:02:08 | 000,069,632 | ---- | M] (Nikon Corporation) -- C:\Program Files\Nikon\WT-4 Setup Utility\NkPtpEnum.exePRC - [2007/09/26 18:34:46 | 000,644,408 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exePRC - [2007/06/28 21:17:30 | 000,065,536 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exePRC - [2007/06/28 21:16:20 | 000,114,688 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exePRC - [2007/06/28 21:14:52 | 000,184,320 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exePRC - [2007/06/11 07:14:51 | 000,517,040 | ---- | M] ( ) -- C:\WINDOWS\system32\lxdicoms.exePRC - [2007/05/31 03:02:06 | 000,036,400 | ---- | M] (Lenovo) -- C:\WINDOWS\system32\ibmpmsvc.exePRC - [2007/04/16 11:33:18 | 000,647,168 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exePRC - [2007/04/16 11:21:20 | 000,983,040 | ---- | M] (Intel Corporation ) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exePRC - [2007/04/16 11:14:24 | 000,327,680 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exePRC - [2007/04/09 11:03:00 | 000,058,416 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exePRC - [2007/03/29 18:40:48 | 000,181,808 | ---- | M] (Lenovo.) -- C:\WINDOWS\system32\TpShocks.exePRC - [2007/03/28 10:32:00 | 000,243,248 | ---- | M] (Lenovo Group Ltd.) -- C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXEPRC - [2007/03/22 10:02:00 | 000,120,368 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXEPRC - [2007/03/02 17:49:00 | 000,037,680 | ---- | M] (Lenovo.) -- C:\WINDOWS\system32\TPHDEXLG.exePRC - [2007/02/27 17:43:30 | 000,561,213 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exePRC - [2007/02/27 17:35:04 | 000,266,295 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exePRC - [2007/02/08 13:11:32 | 000,569,344 | ---- | M] () -- C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exePRC - [2007/02/08 13:09:58 | 000,950,272 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exePRC - [2007/02/08 13:00:06 | 000,022,016 | ---- | M] () -- C:\Program Files\Common Files\Lenovo\Logger\logmon.exePRC - [2007/02/08 11:40:16 | 000,045,056 | ---- | M] () -- C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exePRC - [2007/02/05 16:40:46 | 000,118,784 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Desktop Search\WindowsSearch.exePRC - [2007/02/01 11:00:01 | 000,419,376 | ---- | M] (LENOVO) -- C:\Program Files\ThinkVantage\AMSG\Amsg.exePRC - [2007/01/31 15:55:42 | 000,096,370 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exePRC - [2007/01/30 19:01:36 | 002,618,944 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Client Security Solution\cssauth.exePRC - [2007/01/30 18:45:42 | 000,722,496 | ---- | M] (IBM) -- C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exePRC - [2007/01/29 20:05:02 | 000,108,080 | ---- | M] (Lenovo Group Limited) -- C:\WINDOWS\system32\IPSSVC.EXEPRC - [2007/01/28 16:38:00 | 000,925,696 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exePRC - [2006/11/21 19:16:02 | 000,724,992 | ---- | M] (Intuit, Inc.) -- C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exePRC - [2006/11/03 18:02:14 | 000,050,688 | ---- | M] (Avanquest Software ) -- C:\Program Files\Digital Line Detect\DLG.exePRC - [2006/07/07 16:14:38 | 000,576,320 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft IntelliType Pro\itype.exePRC - [2006/05/23 21:08:06 | 000,622,700 | ---- | M] (Diskeeper Corporation) -- C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exePRC - [2006/05/18 16:24:06 | 000,196,696 | ---- | M] (Diskeeper Corporation) -- C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exePRC - [2006/02/02 05:20:00 | 000,122,940 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\DLA\DLACTRLW.EXEPRC - [2002/09/24 17:39:48 | 000,151,552 | ---- | M] (Iomega Corporation) -- C:\Program Files\Iomega\AutoDisk\ADService.exePRC - [2002/09/24 17:39:24 | 000,147,456 | ---- | M] (Iomega Corporation) -- C:\Program Files\Iomega\AutoDisk\ADUserMon.exePRC - [2002/09/04 15:11:04 | 000,073,728 | ---- | M] (Iomega Corporation) -- C:\Program Files\Iomega\System32\AppServices.exePRC - [2002/08/13 14:30:57 | 000,086,016 | ---- | M] (Iomega) -- C:\Program Files\Iomega\DriveIcons\Imgicon.exePRC - [2001/09/05 14:50:42 | 001,732,608 | ---- | M] () -- C:\Program Files\ePlus48U\ScanPanel\ScnPanel.exePRC - [2000/04/06 14:26:34 | 000,037,888 | ---- | M] () -- C:\Program Files\TextBridge Pro 8.0\Bin\InstantAccess.exePRC - [1998/04/07 01:00:00 | 000,111,376 | ---- | M] () -- C:\Program Files\Microsoft Office\Office\FINDFAST.EXE========== Modules (SafeList) ==========MOD - [2010/07/16 10:35:43 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Gary1\Desktop\OTL.exeMOD - [2008/04/13 17:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocxMOD - [2007/02/27 17:48:08 | 000,077,824 | ---- | M] (Broadcom Corporation.) -- C:\WINDOWS\system32\BtMmHook.dllMOD - [2002/08/06 13:01:54 | 000,286,720 | ---- | M] (Iomega Corporation) -- C:\Program Files\Iomega\DriveIcons\Imghook.dllMOD - [2000/10/26 00:17:54 | 000,110,592 | ---- | M] () -- C:\Program Files\TextBridge Pro 8.0\Bin\Tbmhook.dll========== Win32 Services (SafeList) ==========SRV - File not found [Disabled | Stopped] -- -- (Iomega Activity Disk2)SRV - [2010/07/16 14:43:36 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)SRV - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)SRV - [2010/04/16 08:33:40 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)SRV - [2009/10/23 13:31:44 | 000,401,920 | ---- | M] (Amazon.com) [On_Demand | Stopped] -- C:\Program Files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe -- (Amazon Download Agent)SRV - [2009/09/29 10:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)SRV - [2009/09/25 23:32:18 | 000,189,736 | ---- | M] (Seagate Technology LLC) [Auto | Running] -- C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe -- (FreeAgentGoNext Service)SRV - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)SRV - [2008/12/23 08:35:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)SRV - [2008/10/20 11:36:40 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- c:\Program Files\Lenovo\System Update\SUService.exe -- (SUService)SRV - [2008/09/04 16:55:20 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)SRV - [2008/03/04 11:34:12 | 001,122,304 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe -- (TVT Scheduler)SRV - [2008/01/18 18:02:08 | 000,069,632 | ---- | M] (Nikon Corporation) [Auto | Running] -- C:\Program Files\Nikon\WT-4 Setup Utility\NkPtpEnum.exe -- (NkPtpEnumWT3)SRV - [2007/09/26 18:34:46 | 000,644,408 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe -- (ThinkVantage Registry Monitor Service)SRV - [2007/06/28 21:17:30 | 000,065,536 | ---- | M] (Lenovo ) [Auto | Running] -- C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe -- (AcPrfMgrSvc)SRV - [2007/06/28 21:14:52 | 000,184,320 | ---- | M] (Lenovo ) [Auto | Running] -- C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe -- (AcSvc)SRV - [2007/06/11 07:14:51 | 000,517,040 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\lxdicoms.exe -- (lxdi_device)SRV - [2007/05/31 03:02:06 | 000,036,400 | ---- | M] (Lenovo) [Auto | Running] -- C:\WINDOWS\system32\ibmpmsvc.exe -- (IBMPMSVC)SRV - [2007/04/16 11:33:18 | 000,647,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe -- (EvtEng) Intel®SRV - [2007/04/16 11:21:20 | 000,983,040 | ---- | M] (Intel Corporation ) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- (S24EventMonitor) Intel®SRV - [2007/04/16 11:14:24 | 000,327,680 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe -- (RegSrvc) Intel®SRV - [2007/03/02 17:49:00 | 000,037,680 | ---- | M] (Lenovo.) [Auto | Running] -- C:\WINDOWS\system32\TPHDEXLG.exe -- (TPHDEXLGSVC)SRV - [2007/02/27 17:35:04 | 000,266,295 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe -- (btwdins)SRV - [2007/02/08 13:11:32 | 000,569,344 | ---- | M] () [Auto | Running] -- C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe -- (TVT Backup Protection Service)SRV - [2007/02/08 13:09:58 | 000,950,272 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe -- (TVT Backup Service)SRV - [2007/02/08 11:40:16 | 000,045,056 | ---- | M] () [Auto | Running] -- C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe -- (tvtnetwk)SRV - [2007/01/31 15:55:42 | 000,096,370 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)SRV - [2007/01/30 18:45:42 | 000,722,496 | ---- | M] (IBM) [Auto | Running] -- C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe -- (TSSCoreService)SRV - [2007/01/29 20:05:02 | 000,108,080 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\WINDOWS\system32\IPSSVC.EXE -- (IPSSVC)SRV - [2006/05/23 21:08:06 | 000,622,700 | ---- | M] (Diskeeper Corporation) [Auto | Running] -- C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe -- (Diskeeper)SRV - [2005/10/06 19:12:30 | 000,855,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Media Connect 2\wmccds.exe -- (WMConnectCDS)SRV - [2002/09/24 17:39:48 | 000,151,552 | ---- | M] (Iomega Corporation) [Auto | Running] -- C:\Program Files\Iomega\AutoDisk\ADService.exe -- (_IOMEGA_ACTIVE_DISK_SERVICE_)SRV - [2002/09/04 15:11:04 | 000,073,728 | ---- | M] (Iomega Corporation) [Auto | Running] -- C:\Program Files\Iomega\System32\AppServices.exe -- (Iomega App Services)========== Driver Services (SafeList) ==========DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\UIUSYS.SYS -- (UIUSys)DRV - [2010/07/16 14:43:41 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)DRV - [2010/07/16 14:43:31 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)DRV - [2010/06/02 13:21:55 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)DRV - [2010/05/10 11:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)DRV - [2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)DRV - [2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)DRV - [2010/02/17 11:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)DRV - [2009/11/18 22:05:36 | 000,385,544 | ---- | M] (Paragon) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Uim_IM.sys -- (Uim_IM)DRV - [2009/11/18 22:05:34 | 000,040,560 | ---- | M] (Paragon Software Group) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\hotcore3.sys -- (hotcore3)DRV - [2009/11/18 22:05:34 | 000,034,392 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\UimBus.sys -- (UimBus)DRV - [2008/12/23 08:35:02 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\npf.sys -- (NPF)DRV - [2008/04/13 11:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)DRV - [2008/04/13 11:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)DRV - [2008/04/13 11:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)DRV - [2008/04/13 09:36:05 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)DRV - [2008/01/18 18:02:14 | 000,017,824 | ---- | M] (Nikon Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NkVBus.sys -- (VBus)DRV - [2007/11/10 14:04:40 | 000,047,616 | ---- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Haspnt.sys -- (Haspnt)DRV - [2007/10/30 22:41:30 | 000,033,536 | ---- | M] (Lenovo) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tvtfilter.sys -- (tvtfilter)DRV - [2007/10/30 22:40:28 | 000,007,012 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\pmemnt.sys -- (pmem)DRV - [2007/06/17 09:16:00 | 000,004,442 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TPPWRIF.SYS -- (TPPWRIF)DRV - [2007/05/31 03:01:30 | 000,021,424 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ibmpmdrv.sys -- (IBMPMDRV)DRV - [2007/05/01 19:57:20 | 005,706,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)DRV - [2007/04/30 06:37:20 | 002,206,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Intel®DRV - [2007/04/09 11:03:00 | 000,012,848 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TSMAPIP.SYS -- (TSMAPIP)DRV - [2007/04/02 11:24:08 | 000,004,224 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\IBMBLDID.sys -- (IBMTPCHK)DRV - [2007/03/29 15:19:36 | 000,012,416 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)DRV - [2007/03/24 07:43:46 | 000,251,800 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e1e5132.sys -- (e1express) Intel®DRV - [2007/03/06 23:51:08 | 000,311,808 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService)DRV - [2007/03/02 17:49:00 | 000,100,656 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\Apsx86.sys -- (Shockprf)DRV - [2007/03/02 17:47:00 | 000,019,760 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\ApsHM86.sys -- (TPDIGIMN)DRV - [2007/02/27 02:02:00 | 000,868,042 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)DRV - [2007/02/18 22:56:46 | 000,021,376 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\psadd.sys -- (psadd)DRV - [2007/02/12 10:36:54 | 000,277,784 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\iaStor.sys -- (iaStor)DRV - [2007/02/08 12:30:28 | 000,017,664 | ---- | M] (Lenovo Group Limited) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tvtpktfilter.sys -- (TVTPktFilter)DRV - [2007/01/24 02:27:00 | 000,067,960 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)DRV - [2006/12/21 19:56:00 | 000,988,800 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)DRV - [2006/12/21 19:56:00 | 000,209,664 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)DRV - [2006/12/21 19:55:00 | 000,730,112 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)DRV - [2006/11/06 01:24:56 | 000,012,080 | ---- | M] (Lenovo Group Limited) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PROCDD.SYS -- (PROCDD)DRV - [2006/09/13 12:42:44 | 000,035,264 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tvti2c.sys -- (TVTI2C)DRV - [2006/03/01 03:30:00 | 000,089,472 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS -- (DRVMCDB)DRV - [2006/02/02 05:20:00 | 000,094,332 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)DRV - [2006/02/02 05:20:00 | 000,087,036 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)DRV - [2006/02/02 05:20:00 | 000,086,652 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)DRV - [2006/02/02 05:20:00 | 000,025,628 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS -- (DLABOIOM)DRV - [2006/02/02 05:20:00 | 000,014,684 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)DRV - [2006/02/02 05:20:00 | 000,006,364 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS -- (DLAPoolM)DRV - [2006/02/02 05:20:00 | 000,002,496 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLADResN.SYS -- (DLADResN)DRV - [2005/11/18 12:02:50 | 000,005,660 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)DRV - [2005/11/18 12:02:10 | 000,022,684 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_N.SYS -- (DLARTL_N)DRV - [2005/11/18 05:20:00 | 000,040,544 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DRVNDDM.SYS -- (DRVNDDM)DRV - [2005/11/08 09:27:20 | 000,011,520 | ---- | M] (IBM Corp.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ANC.sys -- (ANC)DRV - [2005/07/12 11:55:00 | 000,013,840 | ---- | M] (Lenovo Group Limited) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tp4track.sys -- (Tp4Track)DRV - [2005/05/17 10:20:08 | 000,015,872 | ---- | M] (Atmel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\atmeltpm.sys -- (atmeltpm)DRV - [2004/08/03 15:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)DRV - [2004/07/14 13:54:42 | 000,676,864 | ---- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock)DRV - [2002/09/04 15:11:08 | 000,030,258 | ---- | M] (Iomega Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\iomdisk.sys -- (iomdisk)DRV - [2001/08/17 14:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)DRV - [2001/08/17 14:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)DRV - [2001/08/17 14:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)DRV - [2001/08/17 14:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)DRV - [2001/08/17 14:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)DRV - [2001/08/17 13:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)DRV - [2001/08/17 13:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)DRV - [2001/08/17 13:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)DRV - [2001/08/17 13:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)DRV - [2001/08/17 13:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)DRV - [2001/08/17 13:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)DRV - [2001/08/17 13:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)DRV - [2001/08/17 13:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)DRV - [2001/08/17 13:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)DRV - [2001/08/17 13:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)DRV - [2001/08/17 05:20:04 | 000,096,256 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ac97intc.sys -- (ac97intc) Intel® 82801 Audio Driver Install Service (WDM)DRV - [2001/06/07 17:56:38 | 000,018,120 | ---- | M] ( ) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\Artec48.sys -- (SampleScanner)========== Standard Registry (SafeList) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo.live.comIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ieIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.comIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.comIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.comIE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/welcome/thinkpad [binary data]IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.live.comIE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not foundIE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/welcome/thinkpad [binary data]IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.live.comIE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not foundIE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-30930638-406794206-4065462927-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.comIE - HKU\S-1-5-21-30930638-406794206-4065462927-1008\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1IE - HKU\S-1-5-21-30930638-406794206-4065462927-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/nwshp?hl=en&tab=wnIE - HKU\S-1-5-21-30930638-406794206-4065462927-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-30930638-406794206-4065462927-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>IE - HKU\S-1-5-21-30930638-406794206-4065462927-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5577FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/21 14:43:40 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Firefox\Extensions\\{B5EA4A79-9969-4E6B-88B8-1E2C62B43AB2}: C:\Documents and Settings\Gary1\Local Settings\Application Data\{B5EA4A79-9969-4E6B-88B8-1E2C62B43AB2} [2010/06/23 10:39:43 | 000,000,000 | ---D | M]O1 HOSTS File: ([2004/08/04 05:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.O3 - HKU\S-1-5-21-30930638-406794206-4065462927-1008\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)O3 - HKU\S-1-5-21-30930638-406794206-4065462927-1008\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)O3 - HKU\S-1-5-21-30930638-406794206-4065462927-1008\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)O4 - HKLM..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe (Iomega Corporation)O4 - HKLM..\Run: [AMSG] C:\Program Files\ThinkVantage\AMSG\Amsg.exe (LENOVO)O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)O4 - HKLM..\Run: [bLOG] C:\Program Files\ThinkPad\Utilities\BATLOGEX.DLL ()O4 - HKLM..\Run: [cssauth] C:\Program Files\Lenovo\Client Security Solution\cssauth.exe (Lenovo Group Limited)O4 - HKLM..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe (Iomega)O4 - HKLM..\Run: [DiskeeperSystray] C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe (Diskeeper Corporation)O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)O4 - HKLM..\Run: [EZEJMNAP] C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE (Lenovo Group Ltd.)O4 - HKLM..\Run: [instantAccess] C:\Program Files\TextBridge Pro 8.0\Bin\InstantAccess.exe ()O4 - HKLM..\Run: [iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\Imgicon.exe (Iomega)O4 - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)O4 - HKLM..\Run: [LPManager] C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE (Lenovo Group Limited)O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)O4 - HKLM..\Run: [PWRMGRTR] C:\Program Files\ThinkPad\Utilities\PWRMGRTR.DLL (Lenovo Group Limited)O4 - HKLM..\Run: [RegisterDropHandler] C:\Program Files\TextBridge Pro 8.0\Bin\RegisterDropHandler.exe ()O4 - HKLM..\Run: [soundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.)O4 - HKLM..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)O4 - HKLM..\Run: [TPFNF7] C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe (Lenovo Group Limited)O4 - HKLM..\Run: [TpShocks] C:\WINDOWS\System32\TpShocks.exe (Lenovo.)O4 - HKLM..\Run: [TrackPointSrv] C:\WINDOWS\System32\tp4serv.exe (Lenovo Group Limited)O4 - HKLM..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited)O4 - HKU\S-1-5-21-30930638-406794206-4065462927-1008..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)O4 - HKU\S-1-5-21-30930638-406794206-4065462927-1008..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)O4 - HKLM..\RunServices: [RegisterDropHandler] C:\Program Files\TextBridge Pro 8.0\Bin\RegisterDropHandler.exe ()O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software )O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit, Inc.)O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ScanPanel.lnk = C:\Program Files\ePlus48U\ScanPanel\ScnPanel.exe ()O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)O4 - Startup: C:\Documents and Settings\Gary1\Start Menu\Programs\Startup\Iomega Product Registration.lnk = C:\Program Files\Iomega\Registration\Register.exe (Leader Technologies)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-21-30930638-406794206-4065462927-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O8 - Extra context menu item: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()O9 - Extra 'Tools' menuitem : ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O15 - HKU\S-1-5-21-30930638-406794206-4065462927-1008\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)O15 - HKU\S-1-5-21-30930638-406794206-4065462927-1008\..Trusted Domains: turbotax.com ([]https in Trusted sites)O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4.../OGAControl.cab (Office Genuine Advantage Validation Tool)O16 - DPF: {1C3DE665-D259-4C72-9D7D-C51FCB4CCFB9} http://75.160.96.110:8081/SysCamInst.cab (Panasonic Network Camera)O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} http://www.linkedin.com/cab/LinkedInContactFinderControl.cab (LinkedIn ContactFinderControl)O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} http://www.facebook.com/controls/contactx.dll (ContactExtractor Class)O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0...oUploader55.cab (Facebook Photo Uploader 5 Control)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.)O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 65.117.224.80O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)O20 - Winlogon\Notify\ACNotify: DllName - ACNotify.dll - C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll (Lenovo )O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)O24 - Desktop WallPaper: C:\Documents and Settings\Gary1\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO24 - Desktop BackupWallPaper: C:\Documents and Settings\Gary1\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll (Microsoft Corporation)O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)O32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2006/04/30 00:13:35 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]O32 - AutoRun File - [2009/09/22 13:51:34 | 000,000,062 | ---- | M] () - D:\autorun.inf -- [ NTFS ]O34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*========== Files/Folders - Created Within 30 Days ==========[2010/07/16 14:43:38 | 000,012,536 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll[2010/07/16 10:35:43 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Gary1\Desktop\OTL.exe[2010/06/28 09:46:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Malwarebytes[2010/06/24 13:36:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Gary1\Application Data\SUPERAntiSpyware.com[2010/06/24 13:36:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com[2010/06/24 12:42:27 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware[2010/06/23 10:39:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Gary1\Local Settings\Application Data\{B5EA4A79-9969-4E6B-88B8-1E2C62B43AB2}[2010/06/23 10:38:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Gary1\Local Settings\Application Data\Windows Server[2010/06/23 10:37:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Gary1\Local Settings\Application Data\oqbkggbim[2010/03/26 19:24:08 | 000,018,120 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\Artec48.sys[2009/09/07 08:07:39 | 000,311,296 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdihcp.dll[2009/09/07 08:07:38 | 000,942,080 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiusb1.dll[2009/09/07 08:07:38 | 000,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiinpa.dll[2009/09/07 08:07:38 | 000,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiiesc.dll[2009/09/07 08:07:37 | 001,187,840 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiserv.dll[2009/09/07 08:07:37 | 000,614,400 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdipmui.dll[2009/09/07 08:07:37 | 000,532,480 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdilmpm.dll[2009/09/07 08:07:37 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiprox.dll[2009/09/07 08:07:37 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdipplc.dll[2009/09/07 08:07:35 | 000,671,744 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdihbn3.dll[2009/09/07 08:07:34 | 000,765,952 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdicomc.dll[2009/09/07 08:07:34 | 000,360,448 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdicomm.dll[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ][1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]========== Files - Modified Within 30 Days ==========[2010/07/16 17:54:57 | 000,000,316 | ---- | M] () -- C:\WINDOWS\tasks\PMTask.job[2010/07/16 17:53:23 | 000,002,278 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl[2010/07/16 17:53:18 | 000,000,278 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-30930638-406794206-4065462927-1008.job[2010/07/16 17:53:10 | 000,000,880 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job[2010/07/16 17:52:53 | 000,025,312 | ---- | M] () -- C:\WINDOWS\System32\PROCDB.INI[2010/07/16 17:52:20 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job[2010/07/16 17:51:54 | 000,000,480 | ---- | M] () -- C:\WINDOWS\System32\IPSCtrl.INI[2010/07/16 17:51:42 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT[2010/07/16 17:51:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2010/07/16 17:51:35 | 3194,269,696 | -HS- | M] () -- C:\hiberfil.sys[2010/07/16 17:49:38 | 009,961,472 | -H-- | M] () -- C:\Documents and Settings\Gary1\NTUSER.DAT[2010/07/16 17:49:05 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\Gary1\ntuser.ini[2010/07/16 17:22:28 | 000,006,741 | -H-- | M] () -- C:\ffastun.ffa[2010/07/16 17:22:27 | 002,854,912 | -H-- | M] () -- C:\ffastun.ffo[2010/07/16 17:21:52 | 026,419,200 | -H-- | M] () -- C:\ffastun0.ffx[2010/07/16 17:21:52 | 005,406,720 | -H-- | M] () -- C:\ffastun.ffl[2010/07/16 17:20:11 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job[2010/07/16 16:51:30 | 000,000,256 | ---- | M] () -- C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job[2010/07/16 14:43:41 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys[2010/07/16 14:43:38 | 000,012,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll[2010/07/16 14:43:31 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys[2010/07/16 14:28:18 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-30930638-406794206-4065462927-1008.job[2010/07/16 10:35:43 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Gary1\Desktop\OTL.exe[2010/07/16 09:42:38 | 062,044,352 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm[2010/07/14 15:08:35 | 000,000,275 | ---- | M] () -- C:\Documents and Settings\Gary1\Desktop\Kitsap Bank - Home Page.url[2010/07/14 10:29:54 | 000,002,495 | ---- | M] () -- C:\Documents and Settings\Gary1\Desktop\Excel 2003.lnk[2010/07/11 10:25:22 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\Gary1\Desktop\Word 2003.lnk[2010/07/10 22:40:11 | 000,002,187 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Safari.lnk[2010/07/10 21:54:26 | 000,000,375 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.ics[2010/07/08 09:54:08 | 000,046,080 | ---- | M] () -- C:\Documents and Settings\Gary1\My Documents\Identity Protection.doc[2010/07/07 10:15:23 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Wvobupapoxu.dat[2010/07/07 10:15:20 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Rsahexeko.bin[2010/06/25 17:23:13 | 000,000,619 | ---- | M] () -- C:\Documents and Settings\Gary1\Desktop\Facebook.url[2010/06/25 11:47:00 | 002,138,081 | ---- | M] () -- C:\Documents and Settings\Gary1\My Documents\New Account Traditional IRA, v11 Nafep Gold & Silver.pdf[2010/06/24 12:42:31 | 000,001,685 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Professional.lnk[2010/06/24 08:52:26 | 000,535,886 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI[2010/06/24 08:52:26 | 000,466,126 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat[2010/06/24 08:52:26 | 000,079,846 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat[2010/06/23 11:35:27 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ][1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]========== Files Created - No Company Name ==========[2010/07/08 09:54:07 | 000,046,080 | ---- | C] () -- C:\Documents and Settings\Gary1\My Documents\Identity Protection.doc[2010/06/25 11:47:00 | 002,138,081 | ---- | C] () -- C:\Documents and Settings\Gary1\My Documents\New Account Traditional IRA, v11 Nafep Gold & Silver.pdf[2010/06/24 12:42:31 | 000,001,685 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Professional.lnk[2010/06/23 10:39:44 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Wvobupapoxu.dat[2010/06/23 10:39:44 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Rsahexeko.bin[2010/03/26 19:24:21 | 000,172,032 | ---- | C] () -- C:\WINDOWS\Ausba4.dll[2010/03/26 19:24:21 | 000,011,412 | ---- | C] () -- C:\WINDOWS\Dusb4ar.ini[2010/03/26 19:24:21 | 000,002,651 | ---- | C] () -- C:\WINDOWS\Ausba4.ini[2010/03/26 19:24:21 | 000,001,246 | ---- | C] () -- C:\WINDOWS\ScnPanel.ini[2010/03/26 19:24:04 | 000,001,590 | ---- | C] () -- C:\WINDOWS\ePlus48U.ini[2009/09/07 08:11:54 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdivs.dll[2009/09/07 08:11:49 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\lxdicoin.dll[2009/09/07 08:11:03 | 000,692,224 | ---- | C] () -- C:\WINDOWS\System32\lxdidrs.dll[2009/09/07 08:11:03 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdicnv4.dll[2009/09/07 08:11:03 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxdicaps.dll[2009/09/07 08:10:11 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMON.DLL[2009/09/07 08:10:11 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\lxf3oem.dll[2009/09/07 08:10:11 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXF3FXPU.DLL[2009/09/07 08:10:11 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMRC.DLL[2009/09/07 08:07:54 | 000,000,060 | -H-- | C] () -- C:\WINDOWS\System32\lxdirwrd.ini[2009/09/07 08:07:39 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\lxdiinst.dll[2009/09/07 08:07:35 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdigrd.dll[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll[2009/02/28 16:17:06 | 000,024,576 | R--- | C] () -- C:\WINDOWS\System32\Arsetup.dll[2009/02/28 16:17:06 | 000,000,235 | R--- | C] () -- C:\WINDOWS\System32\Arsetup.ini[2008/12/23 08:33:18 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll[2008/08/20 09:45:20 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QFN.ini[2008/08/20 09:45:20 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QDQICK.ini[2008/02/10 19:29:53 | 000,000,120 | ---- | C] () -- C:\WINDOWS\MSMAIL32.INI[2008/02/10 19:17:21 | 000,000,192 | ---- | C] () -- C:\WINDOWS\maxlink.ini[2008/02/10 19:17:21 | 000,000,096 | ---- | C] () -- C:\WINDOWS\Tb98.ini[2008/02/10 19:17:08 | 000,046,512 | ---- | C] () -- C:\WINDOWS\System32\EPSN.DLL[2008/02/10 19:17:08 | 000,012,126 | ---- | C] () -- C:\WINDOWS\System32\PIXPCZ.DLL[2008/02/10 19:17:08 | 000,011,934 | ---- | C] () -- C:\WINDOWS\System32\PIXPNR.DLL[2008/02/10 19:17:08 | 000,009,136 | ---- | C] () -- C:\WINDOWS\System32\INETWH16.DLL[2008/01/22 18:31:09 | 000,000,508 | ---- | C] () -- C:\WINDOWS\ODBC.INI[2007/12/14 17:56:07 | 000,375,296 | ---- | C] () -- C:\WINDOWS\System32\tx32.dll[2007/12/14 17:56:05 | 000,000,202 | ---- | C] () -- C:\WINDOWS\System32\Ic32.ini[2007/11/24 14:15:54 | 000,000,166 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI[2007/11/10 14:05:13 | 000,000,126 | ---- | C] () -- C:\WINDOWS\WinInit.ini.backup[2007/11/10 14:04:40 | 000,000,383 | ---- | C] () -- C:\WINDOWS\System32\haspdos.sys[2007/11/10 13:23:53 | 000,000,723 | ---- | C] () -- C:\WINDOWS\ATM.INI[2007/10/30 23:01:56 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini[2007/10/30 22:39:55 | 000,004,224 | ---- | C] () -- C:\WINDOWS\System32\drivers\IBMBLDID.sys[2007/10/30 22:33:52 | 000,000,126 | ---- | C] () -- C:\WINDOWS\WinInit.ini[2007/10/30 22:33:09 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll[2007/10/30 22:33:09 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll[2007/10/30 22:33:09 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll[2007/10/30 22:33:09 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll[2007/10/30 22:33:09 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll[2007/10/30 22:33:09 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll[2007/10/30 22:27:08 | 000,910,304 | ---- | C] () -- C:\WINDOWS\System32\igmedkrn.dll[2007/10/30 22:27:08 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4825.dll[2007/10/30 22:25:33 | 000,012,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\TSMAPIP.SYS[2007/10/30 22:24:32 | 000,004,442 | ---- | C] () -- C:\WINDOWS\System32\drivers\TPPWRIF.SYS[2007/10/30 22:13:37 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\tp4uires.dll[2007/03/02 05:15:36 | 000,025,312 | ---- | C] () -- C:\WINDOWS\System32\PROCDB.INI[2007/03/02 05:15:25 | 000,000,480 | ---- | C] () -- C:\WINDOWS\System32\IPSCtrl.INI[2007/02/27 17:48:38 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll[2007/02/27 17:29:32 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll[2007/01/16 08:12:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini[2007/01/03 12:24:36 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini[2007/01/03 12:22:46 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini[2007/01/03 12:22:14 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini[2006/09/20 00:14:32 | 000,140,800 | ---- | C] () -- C:\WINDOWS\System32\dxfdrv32.dll[2006/09/05 14:20:36 | 000,079,400 | ---- | C] () -- C:\WINDOWS\System32\DEVMAN.DLL[2006/04/30 00:31:51 | 000,004,670 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI[2006/04/30 00:22:10 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini[2005/06/01 00:48:56 | 000,060,416 | ---- | C] () -- C:\WINDOWS\System32\clippoly.dll[2005/02/17 11:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest[2005/02/17 11:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest[2004/01/23 20:04:54 | 005,176,832 | ---- | C] () -- C:\WINDOWS\System32\Elvfce32.dll[2003/09/18 00:22:40 | 000,125,440 | ---- | C] () -- C:\WINDOWS\System32\cntour32.dll[2003/06/11 18:39:12 | 006,270,976 | ---- | C] () -- C:\WINDOWS\System32\cricu19.dll[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI[2002/07/30 22:37:04 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\U2LEXPO.dll[2002/02/01 11:00:00 | 000,620,544 | ---- | C] () -- C:\WINDOWS\System32\stlpmt45.dll[2001/11/14 12:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll[2001/09/13 23:40:40 | 000,145,408 | ---- | C] () -- C:\WINDOWS\System32\lulcdr32.dll[2001/06/28 16:07:26 | 000,143,872 | ---- | C] () -- C:\WINDOWS\System32\Demdrv32.dll[2000/11/04 00:23:28 | 000,128,512 | ---- | C] () -- C:\WINDOWS\System32\dlgdrv32.dll[2000/07/21 02:48:18 | 000,775,168 | ---- | C] () -- C:\WINDOWS\System32\WriteDB.dll[2000/06/21 14:49:58 | 000,136,192 | ---- | C] () -- C:\WINDOWS\System32\Ntfdrv32.dll[2000/03/20 14:54:28 | 000,134,144 | ---- | C] () -- C:\WINDOWS\System32\Dtmdrv32.dll[1999/11/22 04:22:00 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\Kechk32.dll[1999/11/08 20:01:24 | 000,132,096 | ---- | C] () -- C:\WINDOWS\System32\shpdrv32.dll[1999/03/17 13:43:44 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\Invdst32.dll[1998/12/10 06:14:48 | 000,306,176 | ---- | C] () -- C:\WINDOWS\System32\Splne32dll.dll[1998/09/28 23:58:12 | 000,031,232 | ---- | C] () -- C:\WINDOWS\System32\invd32.dll[1998/08/12 13:15:18 | 000,031,232 | ---- | C] () -- C:\WINDOWS\System32\invdrv32.dll[1998/07/10 06:31:00 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\Downtvdd.dll[1998/06/09 06:00:00 | 000,244,984 | ---- | C] () -- C:\WINDOWS\System32\TUTIL32.DLL[1998/04/07 01:00:00 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\ODBCMON.DLL[1998/04/07 01:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\ODBCSTF.DLL[1998/04/07 01:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL[1998/04/07 01:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL[1997/03/25 06:02:00 | 000,906,784 | ---- | C] () -- C:\WINDOWS\System32\owl52f.dll[1997/03/20 05:00:00 | 000,017,408 | ---- | C] () -- C:\WINDOWS\System32\delphimm.dll========== Alternate Data Streams ==========@Alternate Data Stream - 149 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1< End of report > Link to post Share on other sites More sharing options...
gpascoe Posted July 17, 2010 Author ID:285544 Share Posted July 17, 2010 I cannot get a Reply with the Extras.txt file to work. Link to post Share on other sites More sharing options...
Elise Posted July 17, 2010 ID:285654 Share Posted July 17, 2010 Did you try to attach extra.txt? If it just won't work, let me know, and we will skip if for now.Please try also to post GMERs log. If it gives you trouble, try to scan it with the sections option only checked. Link to post Share on other sites More sharing options...
gpascoe Posted July 17, 2010 Author ID:285724 Share Posted July 17, 2010 Did you try to attach extra.txt? If it just won't work, let me know, and we will skip if for now.Please try also to post GMERs log. If it gives you trouble, try to scan it with the sections option only checked.I've attached Extra.txt as gpascoe_Extras.txt. Were you able to receive it?I'll run GMERs next. Link to post Share on other sites More sharing options...
Elise Posted July 17, 2010 ID:285771 Share Posted July 17, 2010 I don't see extra.txt. but nevermind, lets just skip it for now. I will wait for GMER. Link to post Share on other sites More sharing options...
gpascoe Posted July 17, 2010 Author ID:285813 Share Posted July 17, 2010 Extras.TxtI don't see extra.txt. but nevermind, lets just skip it for now. I will wait for GMER.Extra.txt is attached (I think) Link to post Share on other sites More sharing options...
Elise Posted July 17, 2010 ID:285822 Share Posted July 17, 2010 Yes, this time I see it. Link to post Share on other sites More sharing options...
Elise Posted July 21, 2010 ID:287897 Share Posted July 21, 2010 Hi, are you still there? Link to post Share on other sites More sharing options...
gpascoe Posted July 21, 2010 Author ID:288089 Share Posted July 21, 2010 Hi, are you still there?Yes, still trying to get GMER to run. I cannot get Windows XP on my Lenovo ThinkPad X61 to run in Safe Mode - the F8 and other keys, and the Lenovo ThinkPad solutions keys do not take me to Safe Mode. Will update you later today or so. Thanks! Link to post Share on other sites More sharing options...
Elise Posted July 22, 2010 ID:288709 Share Posted July 22, 2010 In that case, just skip those steps and lets proceed with the instructions below. COMBOFIX---------------Please download ComboFix from one of these locations:BleepingcomputerForoSpywareDisable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)Double click on Combofix.exe and follow the prompts.As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:Click on Yes, to continue scanning for malware.When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Link to post Share on other sites More sharing options...
Staff screen317 Posted August 5, 2010 Staff ID:296343 Share Posted August 5, 2010 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts