Ski46 Posted March 30, 2011 ID:407744 Share Posted March 30, 2011 It appears my Desktop may be infected.I've included the latest scan of Malwarebytes' log file,defogger log file, and the DDS/GMER log files.I am using Norton 360 Version: 4.3.0.5 Anti-virus software. I ran a fullscan of Norton prior to Malwarebytes' and it returned no problems.I've checked the registry values at the reported locations and bothare set to "%1" %*.==============================================================================================================================================================defogger_disable by jpshortstuff (23.02.10.1)Log created at 10:18 on 30/03/2011 (Alan)Checking for autostart values...Unable to open HKCU\~\Run key (2)HKCU\~\Run values retrieved.HKLM\~\Run values retrieved.Checking for services/drivers...-=E.O.F=-==============================================================================================================================================================.DDS (Ver_11-03-05.01) - NTFSx86 Run by Alan at 10:33:03.04 on Wed 03/30/2011Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_24Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.23 [GMT -4:00].FW: Webroot Internet Security Essentials *Disabled* .============== Running Processes ===============.C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcssvchost.exesvchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Java\Java Update\jusched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\BigFix\BigFix.exeC:\Program Files\Windows Desktop Search\WindowsSearch.exesvchost.exeC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\ProcessGuard\dcsuserprot.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exeC:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exeC:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exeC:\Program Files\Secunia\PSI\sua.exeC:\WINDOWS\system32\slserv.exeC:\WINDOWS\System32\svchost.exe -k imgsvcC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\WINDOWS\system32\SearchIndexer.exeC:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\plugin-container.exeC:\WINDOWS\system32\SearchProtocolHost.exeC:\Documents and Settings\Alan\My Documents\Downloads\dds.scr.============== Pseudo HJT Report ===============.uStart Page = hxxp://www.verizon.net/central/vzc.portaluSearch Page = hxxp://www.google.comuSearch Bar = hxxp://www.google.com/ieuSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uDefault_Page_URL = hxxp://my.att.net/uInternet Settings,ProxyOverride = *.localuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%smSearchAssistant = hxxp://www.google.com/ieuURLSearchHooks: N/A: {0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLLBHO: Ask Search Assistant BHO: {0579b4b1-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLLBHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dllBHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dllBHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360\engine\4.3.0.5\coIEPlg.dllBHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360\engine\4.3.0.5\IPSBHO.DLLBHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dllBHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dllBHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dllBHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dllBHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllTB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360\engine\4.3.0.5\coIEPlg.dllTB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dllTB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dllTB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No FileTB: {4A32DB77-BE7B-461B-8A3E-7FE4DCE9A594} - No FileEB: {32683183-48a0-441b-a342-7c2a440a9478} - No FilemRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottimemRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -tStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\bigfix.lnk - c:\program files\bigfix\BigFix.exeStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exeIE: {6224f700-cba3-4071-b251-47cb894244cd} - c:\program files\icq\ICQ.exeIE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dllTrusted Zone: intuit.com\ttlcDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cabFilter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dllNotify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dllSEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLLSEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll.================= FIREFOX ===================.FF - ProfilePath - c:\docume~1\alan\applic~1\mozilla\firefox\profiles\gp6tilah.default\FF - prefs.js: browser.startup.homepage - hxxp://www.verizon.net/central/appmanager/portal/vzcentralFF - prefs.js: network.proxy.type - 1FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\coffplgn\components\coFFPlgn.dllFF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\ipsffplgn\components\IPSFFPl.dllFF - plugin: c:\documents and settings\alan\local settings\application data\yahoo!\browserplus\2.7.1\plugins\npybrowserplus_2.7.1.dllFF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dllFF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dllFF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dllFF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dllFF - plugin: c:\program files\microsoft\office live\npOLW.dllFF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dllFF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dllFF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dllFF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtensionFF - Ext: Norton IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\IPSFFPlgnFF - Ext: Norton Toolbar: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62} - c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\coFFPlgnFF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff.---- FIREFOX POLICIES ----FF - user.js: yahoo.homepage.dontask - true============= SERVICES / DRIVERS ===============.R0 ppa;Iomega Parallel Port Filter Driver;c:\windows\system32\drivers\ppa.sys [2004-5-31 17792]R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360\0403000.005\symds.sys [2011-3-26 328752]R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0403000.005\symefa.sys [2011-3-26 173104]R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\bashdefs\20110309.001\BHDrvx86.sys [2011-3-9 800376]R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0403000.005\cchpx86.sys [2011-3-26 501888]R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-2-17 66632]R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360\0403000.005\ironx86.sys [2011-3-26 116784]R2 DCSPGSRV;DiamondCS ProcessGuard Service v3.500;c:\program files\processguard\DCSUserProt.exe [2009-11-23 31744]R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2010-4-4 54752]R2 N360;Norton 360;c:\program files\norton 360\engine\4.3.0.5\ccsvchst.exe [2011-3-26 126392]R2 procguard;procguard;c:\windows\system32\drivers\procguard.sys [2009-11-23 26688]R2 Secunia Update Agent;Secunia Update Agent;c:\program files\secunia\psi\sua.exe [2011-1-10 399416]R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-5-29 102448]R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\ipsdefs\20110325.002\IDSXpx86.sys [2011-3-14 341944]R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\virusdefs\20110329.040\NAVENG.SYS [2011-3-30 86008]R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\virusdefs\20110329.040\NAVEX15.SYS [2011-3-30 1360760]S2 gupdate1c9e9f1280dd99a;Google Update Service (gupdate1c9e9f1280dd99a);c:\program files\google\update\GoogleUpdate.exe [2009-6-10 133104]S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]S3 NPF;Netgroup Packet Filter;c:\windows\system32\drivers\npf.sys [2004-12-10 30336]S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-2-17 12872]S3 Secunia PSI Agent;Secunia PSI Agent;c:\program files\secunia\psi\psia.exe [2011-1-10 993848]S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520].=============== File Associations ===============.comfile=???*no open command defined ***piffile=???*no open command defined ***.=============== Created Last 30 ================.2011-03-30 13:59:56 -------- d-----w- c:\program files\Trend Micro2011-03-28 22:50:11 -------- d-----w- c:\program files\iPod2011-03-28 22:49:42 -------- d-----w- c:\program files\iTunes2011-03-28 22:38:41 -------- d-----w- c:\program files\Bonjour2011-03-28 22:24:54 73728 ----a-w- c:\windows\system32\javacpl.cpl2011-03-26 17:10:28 20952 ----a-w- c:\windows\system32\drivers\mbam.sys2011-03-26 17:10:26 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2011-03-26 17:10:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2011-03-26 14:37:56 -------- d-----w- c:\program files\SpywareBlaster2011-03-26 12:11:52 361904 ----a-w- c:\windows\system32\drivers\n360\0403000.005\symtdi.sys2011-03-26 12:11:52 339504 ----a-w- c:\windows\system32\drivers\n360\0403000.005\symtdiv.sys2011-03-26 12:11:51 43696 ----a-w- c:\windows\system32\drivers\n360\0403000.005\srtspx.sys2011-03-26 12:11:51 328752 ----a-r- c:\windows\system32\drivers\n360\0403000.005\symds.sys2011-03-26 12:11:51 325680 ----a-w- c:\windows\system32\drivers\n360\0403000.005\srtsp.sys2011-03-26 12:11:51 173104 ----a-w- c:\windows\system32\drivers\n360\0403000.005\symefa.sys2011-03-26 12:11:51 116784 ----a-w- c:\windows\system32\drivers\n360\0403000.005\ironx86.sys2011-03-26 12:11:50 501888 ----a-w- c:\windows\system32\drivers\n360\0403000.005\cchpx86.sys2011-03-26 12:10:59 -------- d-----w- c:\windows\system32\drivers\n360\0403000.005.==================== Find3M ====================.2011-03-23 20:42:28 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll2011-02-03 01:40:23 472808 ----a-w- c:\windows\system32\deployJava1.dll2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll2010-12-31 13:10:33 1854976 ----a-w- c:\windows\system32\win32k.sys2003-03-31 12:00:00 94784 --sh--w- c:\windows\twain.dll2008-04-14 00:12:07 50688 --sh--w- c:\windows\twain_32.dll2010-09-18 06:53:25 974848 --sha-w- c:\windows\system32\mfc42.dll2008-04-14 00:12:01 57344 --sh--w- c:\windows\system32\msvcirt.dll2008-04-14 00:12:01 413696 --sha-w- c:\windows\system32\msvcp60.dll2008-04-14 00:12:01 343040 --sha-w- c:\windows\system32\msvcrt.dll2008-04-14 00:12:02 551936 --sh--w- c:\windows\system32\oleaut32.dll2008-04-14 00:12:02 84992 --sha-w- c:\windows\system32\olepro32.dll2008-04-14 00:12:32 11776 --sh--w- c:\windows\system32\regsvr32.exe.============= FINISH: 10:36:13.82 =============================================================================================================================================================================Malwarebytes' Anti-Malware 1.50.1.1100www.malwarebytes.orgDatabase version: 6218Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.187023/30/2011 2:36:47 PMmbam-log-2011-03-30 (14-36-47).txtScan type: Quick scanObjects scanned: 147859Time elapsed: 2 minute(s), 58 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 2Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:HKEY_CLASSES_ROOT\comfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (???* %*) Good: ("%1" %*) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\piffile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (???*), 58 second(s)) Good: ("%1" %*) -> Quarantined and deleted successfully.Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)Attach.zip Link to post Share on other sites More sharing options...
sjpritch25 Posted March 30, 2011 ID:407916 Share Posted March 30, 2011 Was mbam able to fix the file association or does it keep appearing another mbam scan? Link to post Share on other sites More sharing options...
Ski46 Posted April 1, 2011 Author ID:408768 Share Posted April 1, 2011 Was mbam able to fix the file association or does it keep appearing another mbam scan?mbam did not fix the file association. Each time I scan, I'm getting the same resultsas I initially posted. I haven't tried to fix the association. I don't want to changeanything on my system. Link to post Share on other sites More sharing options...
sjpritch25 Posted April 2, 2011 ID:409501 Share Posted April 2, 2011 Download OTL.exe to your desktop.Double-Click on OTL to run it.When the window appears, underneath Output at the top change it to Standard Output.Under the Standard Registry box change it to All.Under the Extra Registry box change it to All.Under Custom scan's and fixes section paste in the below in boldnetsvcs%SYSTEMDRIVE%\*.*%systemroot%\*. /mp /sCREATERESTOREPOINT%systemroot%\system32\*.dll /lockedfiles%systemroot%\Tasks\*.job /lockedfiles%systemroot%\System32\config\*.sav%systemroot%\system32\drivers\*.sys /90Check the boxes beside LOP Check and Purity Check.Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long. When the scan completes, it will open two notepad windows. OTL.txt and Extras.txt. These are saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. Link to post Share on other sites More sharing options...
Ski46 Posted April 2, 2011 Author ID:409533 Share Posted April 2, 2011 Download OTL.exe to your desktop.Double-Click on OTL to run it.When the window appears, underneath Output at the top change it to Standard Output.Under the Standard Registry box change it to All.Under the Extra Registry box change it to All.Under Custom scan's and fixes section paste in the below in boldnetsvcs%SYSTEMDRIVE%\*.*%systemroot%\*. /mp /sCREATERESTOREPOINT%systemroot%\system32\*.dll /lockedfiles%systemroot%\Tasks\*.job /lockedfiles%systemroot%\System32\config\*.sav%systemroot%\system32\drivers\*.sys /90Check the boxes beside LOP Check and Purity Check.Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long. When the scan completes, it will open two notepad windows. OTL.txt and Extras.txt. These are saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.I followed your instructions and here is the output of OTL.txt. I have to send another reply with Extras.txt. The Post was too long.OTL logfile created on: 4/1/2011 10:00:41 PM - Run 1OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Alan\My Documents\DownloadsWindows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy447.00 Mb Total Physical Memory | 126.00 Mb Available Physical Memory | 28.00% Memory free2.00 Gb Paging File | 1.00 Gb Available in Paging File | 75.00% Paging File freePaging file location(s): C:\pagefile.sys 1500 1500 [binary data]%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 111.79 Gb Total Space | 33.64 Gb Free Space | 30.09% Space Free | Partition Type: NTFSComputer Name: BRANICK | User Name: Alan | Logged in as Administrator.Boot Mode: Normal | Scan Mode: Current userCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days========== Processes (SafeList) ==========PRC - [2011/04/01 21:57:02 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Alan\My Documents\Downloads\OTL.exePRC - [2011/02/19 21:41:46 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exePRC - [2011/01/10 10:24:20 | 000,399,416 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\sua.exePRC - [2010/09/20 15:24:40 | 000,377,200 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360\Engine\4.3.0.5\mcui32.exePRC - [2010/02/25 20:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360\Engine\4.3.0.5\ccsvchst.exePRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exePRC - [2008/07/25 14:22:52 | 000,031,744 | ---- | M] (DiamondCS) -- C:\Program Files\ProcessGuard\DCSUserProt.exePRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exePRC - [2003/01/17 05:02:00 | 000,045,056 | ---- | M] ( ) -- C:\WINDOWS\system32\slserv.exePRC - [2002/07/31 14:22:26 | 001,742,384 | ---- | M] (BigFix Inc.) -- C:\Program Files\BigFix\BigFix.exe========== Modules (SafeList) ==========MOD - [2011/04/01 21:57:02 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Alan\My Documents\Downloads\OTL.exeMOD - [2010/09/20 15:26:01 | 000,415,088 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360\Engine\4.3.0.5\asoehook.dllMOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dllMOD - [2009/07/12 04:02:02 | 000,653,120 | R--- | M] (Microsoft Corporation) -- C:\Program Files\Norton 360\Engine\4.3.0.5\microsoft.vc90.crt\msvcr90.dllMOD - [2009/07/12 04:02:00 | 000,569,664 | R--- | M] (Microsoft Corporation) -- C:\Program Files\Norton 360\Engine\4.3.0.5\microsoft.vc90.crt\msvcp90.dll========== Win32 Services (SafeList) ==========SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)SRV - [2011/01/10 10:24:20 | 000,993,848 | ---- | M] (Secunia) [On_Demand | Stopped] -- C:\Program Files\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)SRV - [2011/01/10 10:24:20 | 000,399,416 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files\Secunia\PSI\sua.exe -- (Secunia Update Agent)SRV - [2010/02/25 20:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) [unknown | Running] -- C:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe -- (N360)SRV - [2009/09/29 10:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)SRV - [2008/07/25 14:22:52 | 000,031,744 | ---- | M] (DiamondCS) [Auto | Running] -- C:\Program Files\ProcessGuard\dcsuserprot.exe -- (DCSPGSRV)SRV - [2006/03/30 09:15:44 | 000,096,341 | ---- | M] (Canon Inc.) [Disabled | Stopped] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)SRV - [2003/01/17 05:02:00 | 000,045,056 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\slserv.exe -- (SLService)========== Driver Services (SafeList) ==========DRV - [2011/03/31 21:04:34 | 001,393,144 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20110401.020\NAVEX15.SYS -- (NAVEX15)DRV - [2011/03/31 21:04:24 | 000,086,136 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20110401.020\NAVENG.SYS -- (NAVENG)DRV - [2011/03/23 16:42:28 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)DRV - [2011/03/14 14:58:34 | 000,341,944 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20110330.001\IDSXpx86.sys -- (IDSxpx86)DRV - [2011/03/09 21:11:42 | 000,800,376 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20110309.001\BHDrvx86.sys -- (BHDrvx86)DRV - [2010/09/01 04:30:58 | 000,015,544 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\psi_mf.sys -- (PSI)DRV - [2010/05/29 04:00:00 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)DRV - [2010/05/29 04:00:00 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)DRV - [2010/05/06 00:01:59 | 000,361,904 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\N360\0403000.005\SYMTDI.SYS -- (SYMTDI)DRV - [2010/04/29 01:03:51 | 000,116,784 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\N360\0403000.005\Ironx86.SYS -- (SymIRON)DRV - [2010/04/21 23:02:20 | 000,173,104 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\N360\0403000.005\SYMEFA.SYS -- (SymEFA)DRV - [2010/04/21 22:29:50 | 000,325,680 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\N360\0403000.005\SRTSP.SYS -- (SRTSP)DRV - [2010/04/21 22:29:50 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\N360\0403000.005\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)DRV - [2010/02/25 20:22:57 | 000,501,888 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\N360\0403000.005\ccHPx86.sys -- (ccHP)DRV - [2010/02/17 10:25:50 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)DRV - [2010/02/17 10:15:58 | 000,066,632 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)DRV - [2010/02/17 10:15:58 | 000,012,872 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)DRV - [2009/10/14 23:50:05 | 000,328,752 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\N360\0403000.005\SYMDS.SYS -- (SymDS)DRV - [2009/08/05 22:48:42 | 000,054,752 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)DRV - [2008/07/25 14:33:06 | 000,026,688 | ---- | M] (DiamondCS) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\procguard.sys -- (procguard)DRV - [2008/05/06 17:06:00 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wdcsam.sys -- (WDC_SAM)DRV - [2008/01/04 21:34:36 | 000,023,920 | ---- | M] (Webroot Software Inc (www.webroot.com)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sskbfd.sys -- (SSKBFD)DRV - [2004/12/10 04:42:08 | 000,030,336 | ---- | M] (Politecnico di Torino) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\npf.sys -- (NPF)DRV - [2004/08/04 01:41:39 | 000,013,776 | ---- | M] (Smart Link) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\recagent.sys -- (RecAgent)DRV - [2004/02/09 07:06:22 | 000,015,360 | R--- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NetMotCM.sys -- (ndiscm)DRV - [2003/08/21 20:31:52 | 000,462,940 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)DRV - [2003/08/15 03:16:38 | 000,404,736 | ---- | M] (Sensaura Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)DRV - [2003/07/02 08:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\viaagp1.sys -- (viaagp1)DRV - [2003/02/16 20:33:00 | 001,293,192 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mtlstrm.sys -- (Mtlstrm)DRV - [2003/02/16 19:12:00 | 000,085,520 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\slnthal.sys -- (SlNtHal)DRV - [2003/02/16 19:11:00 | 000,516,616 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\slntamr.sys -- (Slntamr)DRV - [2003/02/16 19:08:00 | 000,210,128 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mtlmnt5.sys -- (Mtlmnt5)DRV - [2003/02/05 20:25:00 | 000,162,136 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ntmtlfax.sys -- (NtMtlFax)DRV - [2003/01/17 04:19:00 | 000,039,348 | ---- | M] (Vireo Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\slwdmsup.sys -- (SlWdmSup)DRV - [2001/12/18 11:38:10 | 000,041,729 | ---- | M] (Matsushita Kotobuki Electronics Industries,Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Mkeusbi.sys -- (DCamUSBMke)DRV - [2001/08/08 18:52:48 | 000,014,308 | ---- | M] (Matsushita Kotobuki Electronics Industries, Ltd.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\Mkemusb.sys -- (MKEMUSB)DRV - [2001/07/18 14:52:18 | 000,145,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ICAM3D2.SYS -- (ICAM3NT5) Intel®========== Standard Registry (All) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-onsIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRiskIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie'>http://www.google.com/ieIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie'>http://www.google.com/ieIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://my.att.net/IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htmIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.comIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = GoogleIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.verizon.net/central/vzc.portalIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie'>http://www.google.com/ieIE - HKCU\..\URLSearchHook: {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL (Ask.com)IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local========== FireFox ==========FF - prefs.js..browser.startup.homepage: "http://www.verizon.net/central/appmanager/portal/vzcentral"FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.2.1FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.14FF - prefs.js..network.proxy.no_proxies_on: "*.local"FF - prefs.js..network.proxy.type: 1FF - HKLM\software\mozilla\CompuServe 7.0\Extensions\\: FF - HKLM\software\mozilla\CompuServe 7.0\Extensions\\Components: C:\Program Files\Common Files\csshare\plugins0942 [2011/02/13 13:44:46 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\CompuServe 7.0\Extensions\\Plugins: C:\Program Files\Common Files\csshare\plugins0942 [2011/02/13 13:44:46 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/06/24 09:54:51 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Firefox\extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\FF - HKLM\software\mozilla\Firefox\extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\ [2011/03/26 08:10:46 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Firefox\extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\ [2011/03/23 16:58:03 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2011/03/27 22:19:56 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/30 14:56:04 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/28 20:44:18 | 000,000,000 | ---D | M][2010/02/10 11:12:27 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Alan\Application Data\Mozilla\Extensions[2010/02/10 11:12:27 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Alan\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}[2011/04/01 22:00:55 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Alan\Application Data\Mozilla\Firefox\Profiles\gp6tilah.default\extensions[2010/05/02 10:11:44 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Alan\Application Data\Mozilla\Firefox\Profiles\gp6tilah.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}[2011/03/19 13:16:18 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Alan\Application Data\Mozilla\Firefox\Profiles\gp6tilah.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}[2011/03/31 21:01:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions[2011/03/28 20:44:19 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}[2010/04/21 16:46:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}[2010/09/19 22:07:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}[2011/03/27 22:20:35 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}[2011/03/28 18:25:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}[2011/03/23 16:58:03 | 000,000,000 | ---D | M] (Norton Toolbar) -- C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\COFFPLGN[2011/03/26 08:10:46 | 000,000,000 | ---D | M] (Norton IPS) -- C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPLGN[2011/03/27 22:19:56 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF[2011/02/19 21:42:02 | 000,025,048 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll[2011/02/19 21:42:03 | 000,140,248 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll[2011/02/02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll[2011/02/19 21:42:04 | 000,066,520 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll[2007/03/22 20:23:30 | 000,017,248 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL[2011/01/21 17:11:12 | 000,095,672 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll[2010/12/18 17:14:26 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll[2010/12/18 17:14:26 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll[2010/12/18 17:14:26 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll[2010/12/18 17:14:26 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll[2010/12/18 17:14:26 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll[2010/12/18 17:14:27 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll[2010/12/18 17:14:27 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll[2010/12/18 17:14:27 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin8.dll[2011/02/18 22:02:57 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml[2011/02/18 22:02:57 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml[2011/02/18 22:02:57 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml[2011/02/18 22:02:57 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml[2011/02/18 22:02:57 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml[2011/02/18 22:02:57 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml[2011/02/18 22:02:57 | 000,001,096 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xmlO1 HOSTS File: ([2009/03/29 13:48:41 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\HOSTSO1 - Hosts: 127.0.0.1 localhostO2 - BHO: (Ask Search Assistant BHO) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL (Ask.com)O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\4.3.0.5\coieplg.dll (Symantec Corporation)O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\4.3.0.5\ipsbho.dll (Symantec Corporation)O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.3.0.5\coieplg.dll (Symantec Corporation)O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk = C:\Program Files\BigFix\BigFix.exe (BigFix Inc.)O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFolderOptions = 0O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)O9 - Extra Button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\Icq.exe ()O9 - Extra 'Tools' menuitem : ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\Icq.exe ()O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 71.250.0.12O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\ipp - No CLSID value foundO18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\msdaipp - No CLSID value foundO18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation)O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)O24 - Desktop Components:0 (My Current Home Page) - About:HomeO24 - Desktop WallPaper: C:\Documents and Settings\Alan\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO24 - Desktop BackupWallPaper: C:\Documents and Settings\Alan\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)O31 - SafeBoot: AlternateShell - cmd.exeO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2003/11/20 07:00:28 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]O34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35 - HKLM\..exefile [open] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- Reg Error: Invalid data type. File not foundO37 - HKLM\...exe [@ = exefile] -- "%1" %*NetSvcs: 6to4 - File not foundNetSvcs: AppMgmt - File not foundNetSvcs: Ias - File not foundNetSvcs: Iprip - File not foundNetSvcs: Irmon - File not foundNetSvcs: NWCWorkstation - File not foundNetSvcs: Nwsapagent - File not foundNetSvcs: WmdmPmSp - File not foundCREATERESTOREPOINTRestore point Set: OTL Restore Point (16902109354000384)========== Files/Folders - Created Within 30 Days ==========[2011/03/30 09:59:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\HijackThis[2011/03/30 09:59:56 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro[2011/03/30 08:28:39 | 000,000,000 | ---D | C] -- C:\Program Files\HijackThis[2011/03/28 18:52:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\iTunes[2011/03/28 18:50:11 | 000,000,000 | ---D | C] -- C:\Program Files\iPod[2011/03/28 18:49:42 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes[2011/03/28 18:38:41 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour[2011/03/28 18:38:28 | 000,000,000 | -HSD | C] -- C:\Config.Msi[2011/03/28 18:24:54 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl[2011/03/28 18:24:45 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe[2011/03/28 18:24:45 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe[2011/03/28 18:24:45 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe[2011/03/27 14:05:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alan\Application Data\Nero[2011/03/26 13:25:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware[2011/03/26 13:10:28 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys[2011/03/26 13:10:26 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys[2011/03/26 13:10:22 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware[2011/03/26 10:38:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP[2011/03/26 10:38:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SpywareBlaster[2011/03/26 10:37:56 | 000,000,000 | ---D | C] -- C:\Program Files\SpywareBlaster[2003/11/20 05:49:11 | 000,516,616 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\slntamr.sys[2003/11/20 05:49:11 | 000,085,520 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\slnthal.sys[2003/11/20 05:49:11 | 000,045,056 | ---- | C] ( ) -- C:\WINDOWS\System32\slserv.exe[2003/11/20 05:49:10 | 001,293,192 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\mtlstrm.sys[2003/11/20 05:49:10 | 000,210,128 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\mtlmnt5.sys[2003/11/20 05:49:10 | 000,162,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\ntmtlfax.sys[2003/11/19 22:54:50 | 000,014,976 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\winddx.sys[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ][2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]========== Files - Modified Within 30 Days ==========[2011/04/01 22:08:08 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job[2011/04/01 22:08:02 | 000,585,988 | ---- | M] () -- C:\WINDOWS\System32\pghash.dat[2011/04/01 21:52:42 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job[2011/04/01 19:45:26 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl[2011/04/01 19:44:51 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job[2011/04/01 19:44:41 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2011/04/01 19:44:39 | 469,291,008 | -HS- | M] () -- C:\hiberfil.sys[2011/03/31 22:37:02 | 000,000,529 | ---- | M] () -- C:\Documents and Settings\Alan\Desktop\Malwarebytes Forum Shortcut.CLP[2011/03/31 22:33:44 | 000,001,397 | ---- | M] () -- C:\Documents and Settings\Alan\Desktop\Clipboard.lnk[2011/03/30 14:29:25 | 000,006,715 | ---- | M] () -- C:\Documents and Settings\Alan\Desktop\Attach.zip[2011/03/30 10:18:03 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Alan\defogger_reenable[2011/03/30 09:59:59 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\Alan\Desktop\HijackThis.lnk[2011/03/28 18:52:52 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk[2011/03/28 18:41:01 | 000,711,684 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0403000.005\Cat.DB[2011/03/27 14:14:39 | 000,000,002 | ---- | M] () -- C:\WINDOWS\msoffice.ini[2011/03/27 14:10:16 | 000,000,161 | ---- | M] () -- C:\WINDOWS\disney.ini[2011/03/26 13:25:23 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk[2011/03/26 12:50:29 | 000,001,889 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Norton 360.LNK[2011/03/26 10:43:54 | 000,000,690 | ---- | M] () -- C:\Documents and Settings\Alan\Desktop\SpywareBlaster.lnk[2011/03/23 16:42:28 | 000,124,976 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS[2011/03/23 16:42:28 | 000,060,808 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL[2011/03/23 16:42:28 | 000,007,443 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT[2011/03/23 16:42:28 | 000,000,805 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF[2011/03/16 16:40:14 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK[2011/03/16 10:20:52 | 000,462,506 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat[2011/03/16 10:20:52 | 000,078,850 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ][2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]========== Files Created - No Company Name ==========[2011/03/31 22:37:02 | 000,000,529 | ---- | C] () -- C:\Documents and Settings\Alan\Desktop\Malwarebytes Forum Shortcut.CLP[2011/03/31 22:31:46 | 000,001,397 | ---- | C] () -- C:\Documents and Settings\Alan\Desktop\Clipboard.lnk[2011/03/30 14:29:25 | 000,006,715 | ---- | C] () -- C:\Documents and Settings\Alan\Desktop\Attach.zip[2011/03/30 10:18:03 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Alan\defogger_reenable[2011/03/30 09:59:58 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\Alan\Desktop\HijackThis.lnk[2011/03/28 18:52:51 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk[2011/03/27 14:14:39 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini[2011/03/26 13:10:28 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk[2011/03/26 10:38:05 | 000,000,690 | ---- | C] () -- C:\Documents and Settings\Alan\Desktop\SpywareBlaster.lnk[2009/11/23 23:00:32 | 000,585,988 | ---- | C] () -- C:\WINDOWS\System32\pghash.dat[2009/11/23 23:00:32 | 000,033,484 | ---- | C] () -- C:\WINDOWS\System32\pguard.dat[2009/11/08 18:32:48 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI[2009/03/01 14:08:33 | 000,000,164 | ---- | C] () -- C:\WINDOWS\install.dat[2008/08/28 21:07:30 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI[2008/07/25 21:16:52 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini[2008/05/26 21:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin[2008/05/26 21:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin[2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini[2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini[2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini[2007/06/14 19:29:20 | 000,000,083 | ---- | C] () -- C:\WINDOWS\webica.ini[2006/12/20 21:27:13 | 000,000,035 | ---- | C] () -- C:\WINDOWS\Ulead32.INI[2006/05/01 22:19:39 | 000,000,161 | ---- | C] () -- C:\WINDOWS\disney.ini[2005/08/28 12:00:13 | 000,012,800 | ---- | C] () -- C:\Documents and Settings\Alan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2005/07/17 12:58:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\musiceditor.INI[2005/07/17 10:59:42 | 000,000,024 | ---- | C] () -- C:\WINDOWS\magix.ini[2005/07/17 10:59:41 | 000,000,999 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini[2005/07/15 00:17:09 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll[2005/07/09 12:16:12 | 000,000,358 | ---- | C] () -- C:\WINDOWS\HEARLITE.INI[2004/12/10 04:42:08 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll[2004/11/12 23:55:47 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat[2004/11/02 20:22:30 | 000,065,864 | ---- | C] () -- C:\WINDOWS\System32\Digita.sys[2004/11/02 20:22:30 | 000,006,144 | ---- | C] () -- C:\WINDOWS\System32\ImgLibLead.dll[2004/11/02 20:22:29 | 000,100,864 | ---- | C] () -- C:\WINDOWS\System32\Dc50ip32.dll[2004/11/02 20:22:29 | 000,007,808 | ---- | C] () -- C:\WINDOWS\System32\dc240u.sys[2004/11/02 20:22:24 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL[2004/11/02 20:22:23 | 000,048,640 | ---- | C] () -- C:\WINDOWS\catalogSubInstaller.exe[2004/05/31 15:45:13 | 000,000,053 | ---- | C] () -- C:\WINDOWS\photoprn.ini[2004/05/31 15:45:12 | 000,000,113 | ---- | C] () -- C:\WINDOWS\pi2000.ini[2004/05/31 14:01:09 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll[2004/05/31 14:00:59 | 000,338,944 | ---- | C] () -- C:\WINDOWS\System32\LFFPX7.DLL[2004/05/31 14:00:59 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL[2004/05/31 14:00:21 | 000,000,034 | ---- | C] () -- C:\WINDOWS\h263test.ini[2004/05/31 13:59:04 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\InetIPLA6.dll[2004/05/31 13:59:04 | 000,516,096 | ---- | C] () -- C:\WINDOWS\System32\InetIPLM6.dll[2004/05/31 13:59:04 | 000,512,000 | ---- | C] () -- C:\WINDOWS\System32\InetIPLP6.dll[2004/05/31 13:59:04 | 000,503,808 | ---- | C] () -- C:\WINDOWS\System32\InetIPLPX.dll[2004/05/31 13:59:04 | 000,495,616 | ---- | C] () -- C:\WINDOWS\System32\InetIPLM5.dll[2004/05/31 13:59:04 | 000,491,520 | ---- | C] () -- C:\WINDOWS\System32\InetIPLP5.dll[2004/05/31 13:59:04 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\InetIPL.dll[2004/05/31 13:59:04 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\Cpuinf32.dll[2004/05/31 13:58:51 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll[2004/05/30 13:02:28 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI[2004/05/30 11:40:48 | 000,285,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\Onsio.sys[2004/05/30 11:40:48 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\drivers\Onsreged.sys[2004/05/30 10:56:06 | 000,000,064 | ---- | C] () -- C:\WINDOWS\QBWCD.INI[2004/05/30 10:56:05 | 000,006,472 | ---- | C] () -- C:\WINDOWS\Icoadb32.dat[2004/05/30 10:43:54 | 000,000,048 | ---- | C] () -- C:\WINDOWS\PerWin.ini[2003/11/20 08:00:12 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini[2003/11/20 07:37:40 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll[2003/11/20 07:28:10 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat[2003/11/20 07:27:40 | 000,000,132 | ---- | C] () -- C:\WINDOWS\winamp.ini[2003/11/20 07:27:07 | 000,000,310 | ---- | C] () -- C:\WINDOWS\net2fone.ini[2003/11/20 07:27:01 | 000,010,047 | ---- | C] () -- C:\WINDOWS\mozver.dat[2003/11/20 07:09:53 | 000,532,544 | ---- | C] () -- C:\WINDOWS\PIC.dll[2003/11/20 07:09:53 | 000,024,576 | ---- | C] () -- C:\WINDOWS\HKNTDLL.dll[2003/11/20 07:08:07 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini[2003/11/20 07:02:57 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat[2003/11/20 06:58:16 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat[2003/11/20 05:49:11 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\slextspk.dll[2003/11/20 05:49:11 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\SLGen.dll[2003/11/20 05:49:11 | 000,024,576 | ---- | C] () -- C:\WINDOWS\slrundll.exe[2003/11/20 05:49:10 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\coinst.dll[2003/11/20 05:49:04 | 000,001,094 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini[2003/11/20 05:49:04 | 000,000,468 | ---- | C] () -- C:\WINDOWS\System32\emver.ini[2003/11/20 05:48:28 | 000,462,506 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat[2003/11/20 05:48:28 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat[2003/11/20 05:48:28 | 000,078,850 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat[2003/11/20 05:48:28 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat[2003/11/20 05:48:26 | 000,004,486 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat[2003/11/20 05:48:24 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin[2003/11/20 05:48:22 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat[2003/11/20 05:48:13 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat[2003/11/20 05:48:13 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin[2003/11/20 05:47:59 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat[2003/11/20 05:47:48 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin[2003/11/19 22:54:50 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\SLLights.dll[2003/11/19 22:54:50 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\slmh.exe[2003/11/19 22:54:50 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\minirec.exe[2003/11/19 22:54:50 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\amr_cpl.dll[2003/11/19 22:54:50 | 000,061,440 | ---- | C] () -- C:\WINDOWS\SmCfg.exe[2003/11/19 22:53:38 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI[2003/11/19 22:52:51 | 000,317,952 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT[2003/10/15 19:22:00 | 000,090,384 | ---- | C] () -- C:\WINDOWS\System32\ctxsetup.exe[2003/01/07 16:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI[1999/01/22 14:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL========== LOP Check ==========[2007/06/14 19:41:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alan\Application Data\ICAClient[2003/11/20 07:22:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alan\Application Data\InterTrust[2006/05/01 22:20:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alan\Application Data\Leadertech[2005/10/10 12:09:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alan\Application Data\MAGIX[2005/07/15 00:17:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alan\Application Data\Robots[2007/09/09 13:08:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alan\Application Data\Simple Star[2004/06/01 22:46:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alan\Application Data\Template[2005/07/10 11:16:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alan\Application Data\Ulead Systems[2007/04/02 21:34:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alan\Application Data\Viewpoint[2007/04/09 20:10:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alan\Application Data\webex[2010/04/04 17:19:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alan\Application Data\Windows Desktop Search[2010/04/05 00:44:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alan\Application Data\Windows Search[2009/11/23 23:07:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AT&T Worldnet Service[2009/11/23 23:07:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ATT_TBBackup[2010/03/27 17:35:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PCSettings[2011/03/30 08:26:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP[2005/07/10 11:15:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ulead Systems[2003/11/20 07:29:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint[2009/03/29 15:01:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}[2010/04/02 14:30:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}[2009/12/31 15:05:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}[2009/04/28 21:35:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}========== Purity Check ==================== Custom Scans ==========< %SYSTEMDRIVE%\*.* >[2003/11/20 07:00:28 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT[2010/12/30 17:09:57 | 000,000,211 | RHS- | M] () -- C:\boot.ini[2007/06/14 19:29:22 | 000,000,000 | ---- | M] () -- C:\COMLOG.txt[2003/11/20 07:00:28 | 000,000,000 | RHS- | M] () -- C:\CONFIG.SYS[2009/06/18 21:23:02 | 000,135,168 | ---- | M] (Netsurfer, Inc.) -- C:\DHCPD.exe[2009/06/18 21:23:03 | 000,458,752 | ---- | M] (Netsurfer, Inc.) -- C:\Dist32.dll[2007/11/28 23:16:26 | 000,000,182 | ---- | M] () -- C:\drwtsn32.log[2003/04/17 20:57:50 | 000,000,310 | ---- | M] () -- C:\emachines.cmd[2011/04/01 19:44:39 | 469,291,008 | -HS- | M] () -- C:\hiberfil.sys[2009/02/10 23:09:38 | 000,000,164 | ---- | M] () -- C:\install.dat[2003/11/20 07:00:28 | 000,000,000 | RHS- | M] () -- C:\IO.SYS[2003/11/20 07:29:55 | 000,001,185 | -H-- | M] () -- C:\IPH.PH[2010/04/17 10:53:01 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt[2003/11/20 07:00:28 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS[2009/06/18 21:23:01 | 000,045,056 | ---- | M] (Netsurfer, Inc.) -- C:\NetUtils.dll[2009/06/18 21:22:52 | 000,000,036 | ---- | M] () -- C:\ns_info.ini[2004/11/25 12:09:20 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM[2008/09/20 23:32:32 | 000,250,048 | RHS- | M] () -- C:\ntldr[2011/04/01 19:44:28 | 1572,864,000 | -HS- | M] () -- C:\pagefile.sys[2008/08/28 21:17:34 | 000,013,030 | ---- | M] () -- C:\PDOXUSRS.NET[2009/06/18 21:23:00 | 000,790,528 | ---- | M] (Netsurfer, Inc.) -- C:\setup32.exe[2007/02/22 19:39:53 | 000,000,000 | ---- | M] () -- C:\SoftCast.fl[2009/06/18 21:25:22 | 000,000,000 | ---- | M] () -- C:\SoftCast.ini[2005/10/31 11:56:00 | 000,700,416 | ---- | M] (LimeWire) -- C:\StubInstaller.exe[2004/06/01 22:09:42 | 000,000,014 | ---- | M] () -- C:\win2.log[2009/06/18 21:23:02 | 000,344,064 | ---- | M] (Netsurfer, Inc.) -- C:\Yampa.exe[2011/03/27 14:11:03 | 000,000,150 | ---- | M] () -- C:\YServer.txt< %systemroot%\*. /mp /s >< %systemroot%\system32\*.dll /lockedfiles >[7 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]< %systemroot%\Tasks\*.job /lockedfiles >< %systemroot%\System32\config\*.sav >[2003/11/19 22:52:14 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav[2003/11/19 22:52:14 | 000,602,112 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav[2003/11/19 22:52:14 | 000,389,120 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav< %systemroot%\system32\drivers\*.sys /90 >[2011/03/23 16:42:28 | 000,124,976 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS========== Alternate Data Streams ==========@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34@Alternate Data Stream - 2628 bytes -> C:\WINDOWS\System32\OEMLOGO.BMP:Q30lsldxJoudresxAaaqpcawXc< End of report Link to post Share on other sites More sharing options...
Ski46 Posted April 2, 2011 Author ID:409534 Share Posted April 2, 2011 I added the output of Extras.txt in this reply.OTL Extras logfile created on: 4/1/2011 10:00:42 PM - Run 1OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Alan\My Documents\DownloadsWindows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy447.00 Mb Total Physical Memory | 126.00 Mb Available Physical Memory | 28.00% Memory free2.00 Gb Paging File | 1.00 Gb Available in Paging File | 75.00% Paging File freePaging file location(s): C:\pagefile.sys 1500 1500 [binary data]%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 111.79 Gb Total Space | 33.64 Gb Free Space | 30.09% Space Free | Partition Type: NTFSComputer Name: BRANICK | User Name: Alan | Logged in as Administrator.Boot Mode: Normal | Scan Mode: Current userCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days========== Extra Registry (All) ==================== File Associations ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].chm [@ = chm.file] -- C:\WINDOWS\hh.exe (Microsoft Corporation).com [@ = comfile] -- Reg Error: Invalid data type. File not found.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*.hlp [@ = hlpfile] -- C:\WINDOWS\System32\winhlp32.exe (Microsoft Corporation).hta [@ = htafile] -- C:\WINDOWS\System32\mshta.exe (Microsoft Corporation).html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation).inf [@ = inffile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation).ini [@ = inifile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation).url [@ = InternetShortcut] -- C:\WINDOWS\System32\rundll32.exe (Microsoft Corporation).js [@ = JSFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation).jse [@ = JSEFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation).pif [@ = piffile] -- Reg Error: Invalid data type. File not found.reg [@ = regfile] -- C:\WINDOWS\regedit.exe (Microsoft Corporation).txt [@ = txtfile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation).vbe [@ = VBEFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation).vbs [@ = VBSFile] -- Reg Error: Value error. File not found.wsf [@ = WSFFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation).wsh [@ = WSHFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>].html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)========== Shell Spawning ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)batfile [open] -- "%1" %*batfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)chm.file [open] -- "C:\WINDOWS\hh.exe" %1 (Microsoft Corporation)cmdfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)cmdfile [open] -- "%1" %*cmdfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)comfile [open] -- Reg Error: Invalid data type.cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*exefile [open] -- "%1" %*helpfile [open] -- winhlp32.exe %1 (Microsoft Corporation)hlpfile [open] -- %SystemRoot%\System32\winhlp32.exe %1 (Microsoft Corporation)htafile [open] -- C:\WINDOWS\system32\mshta.exe "%1" %* (Microsoft Corporation)htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)https [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)inffile [open] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)inffile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)inifile [open] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)inifile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)InternetShortcut [open] -- "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\ieframe.dll",OpenURL %l (Microsoft Corporation)InternetShortcut [print] -- "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)jsfile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)jsfile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)jsfile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)jsefile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)jsefile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)jsefile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)piffile [open] -- Reg Error: Invalid data type.regfile [edit] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)regfile [open] -- regedit.exe "%1" (Microsoft Corporation)regfile [merge] -- Reg Error: Key error.regfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.txtfile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)txtfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)txtfile [printto] -- %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)vbefile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)vbefile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)vbefile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)vbsfile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)vbsfile [open] -- Reg Error: Value error.vbsfile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)wsffile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)wsffile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)wsffile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)wshfile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)========== Security Center Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"AntiVirusDisableNotify" = 0"FirewallDisableNotify" = 0"UpdatesDisableNotify" = 0"AntiVirusOverride" = 0"FirewallOverride" = 0[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]"DisableMonitoring" = 1[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]"DisableMonitoring" = 1[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]"DisableMonitoring" = 1[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]========== System Restore Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]"DisableSR" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]"Start" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]"Start" = 2========== Firewall Settings ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall" = 0"DoNotAllowExceptions" = 0"DisableNotifications" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002========== Authorized Applications List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation)"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]"C:\StubInstaller.exe" = C:\StubInstaller.exe:*:Disabled:LimeWire swarmed installer -- (LimeWire)"C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe" = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe:*:Disabled:Kodak Software Updater"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe" = C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)"C:\WINDOWS\system32\sessmgr.exe" = C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)"C:\Program Files\TurboTax\Deluxe 2006\32bit\ttax.exe" = C:\Program Files\TurboTax\Deluxe 2006\32bit\ttax.exe:LocalSubNet:Disabled:TurboTax -- (Intuit, Inc.)"C:\Program Files\TurboTax\Deluxe 2006\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Deluxe 2006\32bit\updatemgr.exe:LocalSubNet:Disabled:TurboTax Update Manager -- (Intuit, Inc.)"C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax -- (Intuit, Inc.)"C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager -- (Intuit, Inc.)"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)"C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe" = C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe:LocalSubNet:Disabled:Intuit Update Shared Downloads Server -- (Intuit Inc.)"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation)"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service -- (Apple Inc.)"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)========== HKEY_LOCAL_MACHINE Uninstall List ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0"{10A44844-4465-456E-8C97-80BDD4F68845}" = Windows Live ID Sign-in Assistant"{139E303E-1050-497F-98B1-9AE87B15C463}" = Windows Live Family Safety"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool"{206FD69B-F9FE-4164-81BD-D52552BC9C23}" = GearDrvs"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java 6 Update 24"{29521505-F489-4822-ADFA-32C6DEE4F114}" = TurboTax 2008 WinPerUserEducation"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour"{2b02f821-a9b9-458c-80e5-3ea8c0de8471}" = QuickBooks Basic Edition 2004"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support"{2E7595EC-4FB1-4E29-93D4-9083C8A9B107}" = TurboTax ItsDeductible 2005"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java 6 Update 3"{345C90FB-FA10-11D5-9C2A-0080C85A0C2D}" = Microtek FineReader OCR Engine"{34C44CC0-5F50-11D5-8740-000102495CCE}" = Avaya IVR Designer 5.1"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP"{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset"{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine"{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport"{3B1D6DF0-EAA2-012B-AE51-000000000000}" = TurboTax 2009 wnjiper"{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth"{49FC50FC-F965-40D9-89B4-CBFF80941033}" = Windows Movie Maker 2.0"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe Link to post Share on other sites More sharing options...
sjpritch25 Posted April 2, 2011 ID:409985 Share Posted April 2, 2011 Go to Start ---> Type Run ---> Type sc start eventlog and press enter. Let me know if you get any errors.I've attached a file call associationsfix.zip, please extract associationsfix.reg to your desktop. Double-click on associationsfix.reg and allow it to be merged into windows registry. Reboot the machine. Run another scan with mbam and post the log. How is everything running?associationfix.zip Link to post Share on other sites More sharing options...
Ski46 Posted April 3, 2011 Author ID:410051 Share Posted April 3, 2011 Go to Start ---> Type Run ---> Type sc start eventlog and press enter. Let me know if you get any errors.I've attached a file call associationsfix.zip, please extract associationsfix.reg to your desktop. Double-click on associationsfix.reg and allow it to be merged into windows registry. Reboot the machine. Run another scan with mbam and post the log. How is everything running?Everything is running fine. I haven't noticed anything unusual. I ran sc start eventlog and I didn't receive any errors. I ran associationsfix.reg, rebooted the machine, updated the mbam database, and ran another scan. Here isthe output of the scan:Malwarebytes' Anti-Malware 1.50.1.1100www.malwarebytes.orgDatabase version: 6252Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.187024/2/2011 9:52:24 PMmbam-log-2011-04-02 (21-52-23).txtScan type: Quick scanObjects scanned: 148096Time elapsed: 1 minute(s), 8 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
sjpritch25 Posted April 3, 2011 ID:410054 Share Posted April 3, 2011 Well i want to make sure eventlog is runningGo to Start --> Run ---> Type services.msc and press enter. Make sure you see eventlog in the services and that its running. Let me know otherwise. Thanks Link to post Share on other sites More sharing options...
Ski46 Posted April 3, 2011 Author ID:410318 Share Posted April 3, 2011 Well i want to make sure eventlog is runningGo to Start --> Run ---> Type services.msc and press enter. Make sure you see eventlog in the services and that its running. Let me know otherwise. ThanksEvent Log is listed in the Services and it is Started and the Startup Type is Automatic. Link to post Share on other sites More sharing options...
sjpritch25 Posted April 4, 2011 ID:410611 Share Posted April 4, 2011 Good How is everything running?? Link to post Share on other sites More sharing options...
Ski46 Posted April 4, 2011 Author ID:410615 Share Posted April 4, 2011 Good How is everything running??Everything is running fine. Was the system infected or was something in the registry broken? Should I continue using the systems normally, i.e., run Secunia, update Super Spyware, etc. Also, should I defrogger enable? Link to post Share on other sites More sharing options...
sjpritch25 Posted April 4, 2011 ID:411101 Share Posted April 4, 2011 Yes you can use it as usual.Go ahead and click on otl.exe and click on the cleanup button. Go to Start --> Accessories --> System Tools ---> System Resotre and create a new restore point. Link to post Share on other sites More sharing options...
Ski46 Posted April 4, 2011 Author ID:411106 Share Posted April 4, 2011 Yes you can use it as usual.Go ahead and click on otl.exe and click on the cleanup button. Go to Start --> Accessories --> System Tools ---> System Resotre and create a new restore point.Thank you very much for all your help. I really appreciate it. Link to post Share on other sites More sharing options...
sjpritch25 Posted April 5, 2011 ID:411167 Share Posted April 5, 2011 No problem and safe surfing Link to post Share on other sites More sharing options...
Staff screen317 Posted April 28, 2011 Staff ID:422432 Share Posted April 28, 2011 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts