Am i clean? Am i clean?
GMER 1.0.15.15530 - GMER - Rootkit Detector and Remover Welcome aboard Read all of my instructions very carefully .If you're stuck, or you're not sure about certain step, always ask before doing anything else. Please refrain from running tools or applying updates other than those I suggest. Never run more than one scan at a time. Keep updating me regarding your computer behavior, good, or bad. The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know. If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum. I close my topics if you have not replied in 5 days .All logs have to be pasted.
GMER 1.0.15.15530 - GMER - Rootkit Detector and Remover Malwarebytes SpywareInfo.com
Attach.txt part of DDS log is missing.Here Here **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop** Please, never rename Combofix unless instructed. Close any open browsers. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Very Important! disable your anti-virus , script blocking and any anti-malware real-time protection before "unpredictable results" .Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. NOTE1. Recovery Console NOTE 2. always do so .Close any open browsers. WARNING: Combofix will disconnect your machine from the Internet as soon as it startsPlease do not attempt to re-connect your machine back to the Internet until Combofix has completely finished. If there is no internet connection after running Combofix, then restart your computer to restore back your connection. Double click on combofix.exe & follow the prompts. When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall**Note 2 for AVG users : ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.AVG Remover to uninstall it: AVG - Download tools **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion" , restart computer to fix the issue. Make sure, you re-enable your security programs, when you're done with Combofix. NOTE. 1. Run Combofix from Safe Mode .2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name .exeBEFORE saving it to your desktop.Do NOT run it yet. Rkill (courtesy of BleepingComputer.com ) which may help allow other programs to run.Run as Administrator Rkill.com Rkill.scr Rkill.pif Rkill.exe Double-click on the Rkill desktop icon to run the tool. If using Vista or Windows 7 right-click on it and choose Run As Administrator A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully. If not, delete the file, then download and use the one provided in Link 2 . If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs. Do not reboot until instructed. If the tool does not run from any of the links provided, please let me know. immediately run your_name .exenormal mode still doesn't work, run BOTH tools from safe mode .rKill and Combofix .DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
ComboFix 10-11-30.02 - Robert Smillie 30/11/2010 21:25:09.1.2 - x86
The log looks clean now OTL Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. Under the Custom Scan box paste this in: Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt . These are saved in the same location as OTL. Please copy (Edit->Select All, Edit->Copy ) the contents of these files, one at a time, and post them back here.
OTL Extras logfile created on: 03/12/2010 15:08:40 - Run 1========== Extra Registry (SafeList) ========== ========== File Associations ========== ========== Shell Spawning ========== ========== Security Center Settings ========== ========== System Restore Settings ========== ========== Firewall Settings ========== ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== ========== Last 10 Event Log Errors ========== ========== Processes (SafeList) ========== ========== Modules (SafeList) ========== ========== Win32 Services (SafeList) ========== ========== Driver Services (SafeList) ========== ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== Google Toolbar AOL.co.uk Google Toolbar Google Toolbar ========== FireFox ========== js ..browser.search.defaultenginename: "AOL Search"js ..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=3235&invocationType=tbff50sbox&query ="js ..browser.search.selectedEngine: "Ask"js ..browser.search.useDBForOrder: truejs ..browser.startup.homepage: "http://www.plusnetwork.com"js ..extensions.enabledItems: {7affbfae-c4e2-4915-8c0f-00fa3ec610a1}:5.5.18.6js ..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0js ..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=3235&invocationType=TBab-en-gb-web-aol-V55-winff&query="js ..network.proxy.no_proxies_on: "localhost,*.local"http://www.bebo.com/files/BeboUploader.5.8.05.cab (Reg Error: Key error.)http://download.macromedia.com/pub/s...irector/sw.cab (Shockwave ActiveX Control)https://moneymanager.egg.com/Pinsafe...nttracking.cab (Reg Error: Key error.)http://www.update.microsoft.com/micr...?1202746562812 (MUWebControl Class)Page not found | Facebook (Reg Error: Key error.)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_12)http://messenger.zone.msn.com/binary...o.cab56649.cab (Reg Error: Key error.)Pixcetera.com (Reg Error: Key error.)http://game07.zylom.com/activex/zylomgamesplayer.cab (Reg Error: Key error.)https://ukplay.toontown.com/download....21/ttinst.cab (Reg Error: Key error.)http://messenger.zone.msn.com/binary...t.cab56907.cab (Reg Error: Key error.)http://java.sun.com/update/1.5.0/jin...ndows-i586.cab (Reg Error: Key error.)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_07)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_12)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_12)http://gfx1.hotmail.com/mail/w4/pr01...l/MSNPUpld.cab (Reg Error: Key error.)http://messenger.zone.msn.com/binary...r.cab56986.cab (Reg Error: Key error.)========== Files/Folders - Created Within 30 Days ========== ========== Files - Modified Within 30 Days ========== ========== Files Created - No Company Name ========== ========== LOP Check ========== ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > < %systemroot%\Fonts\*.com > < %systemroot%\Fonts\*.dll > < %systemroot%\Fonts\*.ini > < %systemroot%\Fonts\*.ini2 > < %systemroot%\Fonts\*.exe > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.jpg > < %systemroot%\*.png > < %systemroot%\*.scr > < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* > < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\System32\config\*.sav > < %PROGRAMFILES%\bak. /s > < %systemroot%\system32\bak. /s > < %ALLUSERSPROFILE%\Start Menu\*.lnk /x > < %systemroot%\system32\config\systemprofile\*.dat /x > < %systemroot%\*.config > < %systemroot%\system32\*.db > < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x > < %USERPROFILE%\Desktop\*.exe > < %PROGRAMFILES%\Common Files\*.* > < %systemroot%\*.src > < %systemroot%\install\*.* > < %systemroot%\system32\DLL\*.* > < %systemroot%\system32\HelpFiles\*.* > < %systemroot%\system32\rundll\*.* > < %systemroot%\winn32\*.* > < %systemroot%\Java\*.* > < %systemroot%\system32\test\*.* > < %systemroot%\system32\Rundll32\*.* > < %systemroot%\AppPatch\Custom\*.* > < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x > < %PROGRAMFILES%\PC-Doctor\Downloads\*.* > < %PROGRAMFILES%\Internet Explorer\*.tmp > < %PROGRAMFILES%\Internet Explorer\*.dat > < %USERPROFILE%\My Documents\*.exe > < %USERPROFILE%\*.exe > < %systemroot%\ADDINS\*.* > < %systemroot%\assembly\*.bak2 > < %systemroot%\Config\*.* > < %systemroot%\REPAIR\*.bak2 > < %systemroot%\SECURITY\Database\*.sdb /x > < %systemroot%\SYSTEM\*.bak2 > < %systemroot%\Web\*.bak2 > < %systemroot%\Driver Cache\*.* > < %PROGRAMFILES%\Mozilla Firefox\0*.exe > < %ProgramFiles%\Microsoft Common\*.* > < %ProgramFiles%\TinyProxy. > < %USERPROFILE%\Favorites\*.url /x > < %systemroot%\system32\*.bk > < %systemroot%\*.te > < %systemroot%\system32\system32\*.* > < %ALLUSERSPROFILE%\*.dat /x > < %systemroot%\system32\drivers\*.rmv > < dir /b "%systemroot%\system32\*.exe" | find /i " " /c > < dir /b "%systemroot%\*.exe" | find /i " " /c > < %PROGRAMFILES%\Microsoft\*.* > < %systemroot%\System32\Wbem\proquota.exe > < %PROGRAMFILES%\Mozilla Firefox\*.dat > < %USERPROFILE%\Cookies\*.txt /x > < %SystemRoot%\system32\fonts\*.* > < %systemroot%\system32\winlog\*.* > < %systemroot%\system32\Language\*.* > < %systemroot%\system32\Settings\*.* > < %systemroot%\system32\*.quo > < %SYSTEMROOT%\AppPatch\*.exe > < %SYSTEMROOT%\inf\*.exe > < %SYSTEMROOT%\Installer\*.exe > < %systemroot%\system32\config\*.bak2 > < %systemroot%\system32\Computers\*.* > < %SystemRoot%\system32\Sound\*.* > < %SystemRoot%\system32\SpecialImg\*.* > < %SystemRoot%\system32\code\*.* > < %SystemRoot%\system32\draft\*.* > < %SystemRoot%\system32\MSSSys\*.* > < %ProgramFiles%\Javascript\*.* > < %systemroot%\pchealth\helpctr\System\*.exe /s > < %systemroot%\Web\*.exe > < %systemroot%\system32\msn\*.* > < %systemroot%\system32\*.tro > < %AppData%\Microsoft\Installer\msupdates\*.* > < %ProgramFiles%\Messenger\*.* > < %systemroot%\system32\systhem32\*.* > < %systemroot%\system\*.exe > < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\WindowsUpdate\Auto > < Update\Results\Install|LastSuccessTime /rs > ========== Alternate Data Streams ==========
OTL Extras logfile created on: 03/12/2010 15:08:40 - Run 1 OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Robert Smillie\Desktop\Anti virus programs Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy 1,023.00 Mb Total Physical Memory | 392.00 Mb Available Physical Memory | 38.00% Memory free 2.00 Gb Paging File | 2.00 Gb Available in Paging File | 77.00% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 232.88 Gb Total Space | 192.15 Gb Free Space | 82.51% Space Free | Partition Type: NTFS Computer Name: HOME-A92CE30BAF | User Name: Robert Smillie | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\] ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] ========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows NT\SystemRestore] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Sr] "Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SrService] "Start" = 2 ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dowsFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dowsFirewall\DomainProfile] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dowsFirewall\StandardProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\DomainPr ofile] "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile] "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile\GloballyOpenPorts\List] ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\DomainPr ofile\AuthorizedApplications\List] "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile\AuthorizedApplications\List] "C:\WINDOWS\system32\ftp.exe" = C:\WINDOWS\system32\ftp.exe:*:Enabled:File Transfer Program -- (Microsoft Corporation) "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe" = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe:*========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall] "{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center "{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack "{0A06D517-BEE7-2D03-9792-CF1A30E29A70}" = Skins "{139E303E-1050-497F-98B1-9AE87B15C463}" = Windows Live Family Safety "{1481D8E3-EA17-7697-3738-F5AA7784C902}" = ccc-utility "{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer "{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate "{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool "{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSONAttach To Email "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 12 "{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant "{2EB81825-E9EE-44F4-8F51-1240C3898DC6}" = EPSON File Manager "{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support "{31DABA20-10A1-4746-9D9F-57955B8DFF66}" = Free Games Offer, Desktop Shortcut "{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0 "{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3 "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5 "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7 "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform "{3D78F2A2-C893-4ABD-B5FE-AD7011837755}" = EPSON Easy Photo Print "{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works "{4C0F15CA-2032-5D72-F209-A89E02A5FE0F}" = CCC Help English "{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3 "{59A67AEF-CABF-32CA-5407-55049E899A11}" = Catalyst Control Center Graphics Light "{5AD96CF5-2627-4F29-9D2D-72FCD85F6355}" = AVG 2011 "{621C02EA-AAFF-4026-A903-165D59529A16}" = Driver Detective "{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail "{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3 "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{6B9B0C6F-E5FA-4633-A640-AB98A272ECCA}" = Safari "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec "{7CCEBC24-62DB-4280-A8EC-BFA49F167920}" = Software Update for Web Folders "{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page "{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86) "{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player "{8C2690CF-5B74-4F93-8139-7B5644CD6A3B}" = MobileMe Control Panel "{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger "{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12 "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007 "{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007 "{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007 "{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007 "{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007 "{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007 "{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{926CC8AE-8414-43DF-8EB4-CF26D9C3C663}" = "{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007 "{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007 "{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007 "{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007 "{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007 "{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007 "{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{901A5511-070B-20DF-2F5A-5FA29C302C2A}" = Catalyst Control Center Graphics Full Existing "{93EA9C3E-BDFD-4309-A605-9B5BBC0CCEFD}" = Camera RAW Plug-In for EPSON Creativity Suite "{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant "{943803CB-20FA-F4EB-E4A6-A3B055A1DC2E}" = ccc-core-preinstall "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector "{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar "{9EE5A621-A673-37C4-E31A-A7D5696B6F29}" = Catalyst Control Center Graphics Previews Common "{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI "{A23061AF-5361-433C-B7F0-CE5F79A22C49}" = AVG 2011 "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1 "{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter "{B2F6B336-798D-77C2-21C9-392D4B0188F9}" = Catalyst Control Center Core Implementation "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy "{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player "{B78EAA23-2D9B-CD91-6ABF-B96EC49BBA37}" = ccc-core-static "{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86) "{BEAD39CD-901D-4267-8B8B-EAA83CB4B70D}" = Pivot Stickfigure Animator "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C43048A9-742C-4DAD-90D2-E3B53C9DB825}" = Logitech QuickCam Software "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{CE7062BD-BE6F-4153-9654-3D72D0C1CC17}" = Zoo Tycoon 2 - African Adventure "{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader "{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery "{D9758C4B-CDD0-536F-D90E-9D74AFC3A35E}" = Catalyst Control Center Graphics Full New "{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update "{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime "{EDDF99D9-9FE3-4871-A7DB-D1522C51EE9A}" = Microsoft .NET Compact Framework 2.0 SP2 "{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support "{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard "{F17F7703-1E72-40C1-A0DD-E5B365661033}" = Nero 7 Essentials "{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call "{FAE36873-1941-4076-A9A5-48812B5EA0B7}" = iTunes "{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour "{FF477885-5EA8-40D0-ADF3-D4C1B86FAEA4}" = EPSON Print CD "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Shockwave Player" = Adobe Shockwave Player 11.5 "All ATI Software" = ATI - Software Uninstall Utility "Ask.com Search Assistant" = Ask.com Search Assistant 1.0.2 "ATI Display Driver" = ATI Display Driver "AVG" = AVG 2011 "CamStudio" = CamStudio "CCleaner" = CCleaner "CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_20001 4F1" = SoftV92 Data Fax Modem with SmartCP "Coupon Printer2.0" = Coupon Printer "Disney Toontown Online_UK" = Disney Toontown Online UK_LIVE "Disney's Toontown Online" = Disney's Toontown Online "Easy Gif Animator Extension" = Easy Gif Animator Extension "Easy GIF Animator_is1" = Easy GIF Animator 4.9 "ENTERPRISE" = Microsoft Office Enterprise 2007 "EPSON Printer and Utilities" = EPSON Printer Software "EPSON Scanner" = EPSON Scan "EPSON Stylus Photo RX585_RX610 User’s Guide" = EPSON Stylus Photo RX585_RX610 Manual "ffdshow" = ffdshow (remove only) "FontCreator6_is1" = High-Logic FontCreator 6.0 "GamewareBAMZOOKiCBBCTools1_is1" = BAMZOOKi v3.1 (build 115.158) "GIF Movie Gear_is1" = GIF Movie Gear 4.2 "Google Chrome" = Google Chrome "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "ie8" = Windows Internet Explorer 8 "InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email "InstallShield_{621C02EA-AAFF-4026-A903-165D59529A16}" = Driver Detective "InstallShield_{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD "InstallShield_{CE7062BD-BE6F-4153-9654-3D72D0C1CC17}" = Zoo Tycoon 2 - African Adventure "Keepsake_Catwalk" = Keepsake Catwalk "Logitech Print Service" = Logitech Print Service "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Messenger Plus! Live" = Messenger Plus! Live "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "MSNINST" = MSN "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "Picasa 3" = Picasa 3 "QcDrv" = Logitech® Camera Driver "ViewpointMediaPlayer" = Viewpoint Media Player "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Windows Media Player 11 "Windows XP Service Pack" = Windows XP Service Pack 3 "WinLiveSuite_Wave3" = Windows Live Essentials "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "Yahoo! Messenger" = Yahoo! Messenger "Yahoo! Software Update" = Yahoo! Software Update "Zoo Tycoon 2" = Zoo Tycoon 2 ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 25/10/2010 13:06:55 | Computer Name = HOME-A92CE30BAF | Source = crypt32 | ID = 131083 Description = Failed extract of third-party root list from auto update cab at: with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. Error - 25/10/2010 13:06:55 | Computer Name = HOME-A92CE30BAF | Source = crypt32 | ID = 131083 Description = Failed extract of third-party root list from auto update cab at: with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. Error - 04/11/2010 20:17:07 | Computer Name = HOME-A92CE30BAF | Source = Microsoft Office 12 | ID = 5000 Description = EventType officelifeboathang, P1 winword.exe, P2 12.0.6545.5000, P3 ntdll.dll, P4 5.1.2600.5755, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL. Error - 06/11/2010 02:57:04 | Computer Name = HOME-A92CE30BAF | Source = Windows Search Service | ID = 3024 Description = The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again. Context: Windows Application, SystemIndex Catalog Error - 06/11/2010 03:03:35 | Computer Name = HOME-A92CE30BAF | Source = Application Hang | ID = 1002 Description = Hanging application WINWORD.EXE, version 12.0.6545.5000, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 10/11/2010 19:32:53 | Computer Name = HOME-A92CE30BAF | Source = Windows Search Service | ID = 3024 Description = The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again. Context: Application, SystemIndex Catalog Error - 13/11/2010 12:07:00 | Computer Name = HOME-A92CE30BAF | Source = Application Hang | ID = 1002 Description = Hanging application wabmig.exe, version 6.0.2900.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 19/11/2010 19:27:54 | Computer Name = HOME-A92CE30BAF | Source = Application Hang | ID = 1002 Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 20/11/2010 03:50:01 | Computer Name = HOME-A92CE30BAF | Source = Application Hang | ID = 1002 Description = Hanging application SDUpdate.exe, version 1.6.0.12, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 20/11/2010 03:53:36 | Computer Name = HOME-A92CE30BAF | Source = Application Hang | ID = 1002 Description = Hanging application SDUpdate.exe, version 1.6.0.12, hang module hungapp, version 0.0.0.0, hang address 0x00000000. [ System Events ] Error - 30/11/2010 17:15:40 | Computer Name = HOME-A92CE30BAF | Source = Service Control Manager | ID = 7001 Description = The fssfltr service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: %%31 Error - 30/11/2010 17:15:40 | Computer Name = HOME-A92CE30BAF | Source = Service Control Manager | ID = 7001 Description = The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: %%31 Error - 30/11/2010 17:15:40 | Computer Name = HOME-A92CE30BAF | Source = Service Control Manager | ID = 7001 Description = The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: %%31 Error - 30/11/2010 17:15:40 | Computer Name = HOME-A92CE30BAF | Source = Service Control Manager | ID = 7001 Description = The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: %%31 Error - 30/11/2010 17:15:40 | Computer Name = HOME-A92CE30BAF | Source = Service Control Manager | ID = 7001 Description = The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: %%31 Error - 30/11/2010 17:15:40 | Computer Name = HOME-A92CE30BAF | Source = Service Control Manager | ID = 7001 Description = The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: %%31 Error - 30/11/2010 17:15:40 | Computer Name = HOME-A92CE30BAF | Source = Service Control Manager | ID = 7001 Description = The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: %%31 Error - 30/11/2010 17:15:40 | Computer Name = HOME-A92CE30BAF | Source = Service Control Manager | ID = 7026 Description = The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip Error - 30/11/2010 17:16:27 | Computer Name = HOME-A92CE30BAF | Source = DCOM | ID = 10005 Description = DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} Error - 30/11/2010 17:18:18 | Computer Name = HOME-A92CE30BAF | Source = DCOM | ID = 10005 Description = DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} < End of report > OTL logfile created on: 03/12/2010 15:08:40 - Run 1 OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Robert Smillie\Desktop\Anti virus programs Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy 1,023.00 Mb Total Physical Memory | 392.00 Mb Available Physical Memory | 38.00% Memory free 2.00 Gb Paging File | 2.00 Gb Available in Paging File | 77.00% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 232.88 Gb Total Space | 192.15 Gb Free Space | 82.51% Space Free | Partition Type: NTFS Computer Name: HOME-A92CE30BAF | User Name: Robert Smillie | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2010/12/03 15:05:02 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Robert Smillie\Desktop\Anti virus programs\OTL.exe PRC - [2010/11/10 19:08:04 | 000,724,048 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe PRC - [2010/11/10 19:08:02 | 006,127,184 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe PRC - [2010/10/27 05:15:24 | 001,073,504 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgnsx.exe PRC - [2010/10/27 05:14:50 | 001,047,904 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgemcx.exe PRC - [2010/10/22 04:58:18 | 000,265,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe PRC - [2010/10/22 04:57:54 | 002,745,696 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgtray.exe PRC - [2010/10/22 04:57:38 | 000,652,640 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgrsx.exe PRC - [2010/10/22 04========== Modules (SafeList) ========== MOD - [2010/12/03 15:05:02 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Robert Smillie\Desktop\Anti virus programs\OTL.exe MOD - [2010/08/23 16:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt) SRV - [2010/11/10 19:08:02 | 006,127,184 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent) SRV - [2010/10/22 04:58:18 | 000,265,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd) SRV - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2010/05/14 10:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort) SRV - [2009/08/05 21:48:42 | 000,704,864 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc) SRV - [2008/11/09 20:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService) SRV - [2002/09/20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default)) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\ROBERT~1\LOCALS~1\Temp\catchme.sys -- (catchme) DRV - [2010/11/09 22:20:58 | 000,299,984 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix) DRV - [2010/09/13 15:27:24 | 000,025,680 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH) DRV - [2010/09/07 03:48:56 | 000,034,384 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86) DRV - [2010/09/07 03:48:54 | 000,249,424 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86) DRV - [2010/09/07 03:48:50 | 000,026,064 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86) DRV - [2010/08/19 20:42:38 | 000,030,288 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter) DRV - [2010/08/19 20:42:36 | 000,123,472 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver) DRV - [2010/08/19 20:42:34 | 000,026,192 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys -- (AVGIDSShim) DRV - [2010/07/12 04:33:54 | 000,030,432 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avgfwdx.sys -- (Avgfwfd) DRV - [2010/07/12 04:33:54 | 000,030,432 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgfwdx.sys -- (Avgfwdx) DRV - [2009/08/05 21:48:42 | 000,054,752 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr) DRV - [2008/08/21 04:52:41 | 003,299,840 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2008/04/13 18:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM) DRV - [2008/02/11 09:38:06 | 000,015,781 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mdc8021x.sys -- (MDC8021X) AEGIS Protocol (IEEE 802.1x) DRV - [2005/04/20 08:44:12 | 000,124,672 | R--- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SiSGbeXP.sys -- (SiSGbeXP) DRV - [2005/03/01 12:01:40 | 000,392,704 | ---- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt) DRV - [2004/10/08 11:59:11 | 000,326,656 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Camdrl.sys -- (CamDrL) Logitech QuickCam Pro 3000(CamDrl) DRV - [2004/10/08 11:57:48 | 000,022,016 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta) DRV - [2004/09/14 12:55:44 | 000,088,960 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MidiSyn.sys -- (MidiSyn) DRV - [2003/11/13 18:19:48 | 000,210,304 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2) DRV - [2003/11/13 18:18:36 | 000,679,808 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf) DRV - [2003/11/13 18:17:00 | 001,042,816 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP) DRV - [2003/01/10 21:13:04 | 000,033,588 | R--- | M] (America Online, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Google Toolbar IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.micros oft:en-US&ie=utf8&oe=utf8 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = AOL.co.uk IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = Google Toolbar IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Google Toolbar IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyOverride" = localhost;*.local ========== FireFox ========== FF - prefs.js ..browser.search.defaultenginename: "AOL Search" FF - prefs.js ..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=3235&invocationType=tbff50sbox&query =" FF - prefs.js ..browser.search.selectedEngine: "Ask" FF - prefs.js ..browser.search.useDBForOrder: true FF - prefs.js ..browser.startup.homepage: "http://www.plusnetwork.com" FF - prefs.js ..extensions.enabledItems: {7affbfae-c4e2-4915-8c0f-00fa3ec610a1}:5.5.18.6 FF - prefs.js ..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0 FF - prefs.js ..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=3235&invocationType=TBab-en-gb-web-aol-V55-winff&query=" FF - prefs.js ..network.proxy.no_proxies_on: "localhost,*.local" FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5 b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\ [2010/11/30 21:53:26 | 000,000,000 | ---D | M] [2008/12/22 22:00:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert Smillie\Application Data\Mozilla\Extensions [2009/01/01 13:38:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert Smillie\Application Data\Mozilla\Firefox\Profiles\nh397cjo.default\ext ensions [2008/12/27 21:59:27 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Robert Smillie\Application Data\Mozilla\Firefox\Profiles\nh397cjo.default\ext ensions\{7affbfae-c4e2-4915-8c0f-00fa3ec610a1} [2008/12/27 22:05:29 | 000,001,774 | ---- | M] () -- C:\Documents and Settings\Robert Smillie\Application Data\Mozilla\Firefox\Profiles\nh397cjo.default\sea rchplugins\aol-search.xml [2010/01/18 15:47:13 | 000,001,681 | ---- | M] () -- C:\Documents and Settings\Robert Smillie\Application Data\Mozilla\Firefox\Profiles\nh397cjo.default\sea rchplugins\ask.uk.xml [2009/01/05 15:49:53 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2008/10/09 14:03:07 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2008/06/18 06:43:04 | 000,086,016 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll [2008/10/04 20:24:00 | 003,695,008 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\NPSWF32.dll O1 HOSTS File: ([2010/11/30 21:30:10 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) O2 - BHO: (Easy Gif Animator Toolbar Helper) - {96372AB6-15EB-4316-B497-71C741BC548C} - C:\Program Files\Easy Gif Animator Extension\v3.3.0.2\EasyGifAnimator_Toolbar.dll () O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found. O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION) O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (Easy Gif Animator Toolbar) - {35065594-9169-4A34-B167-FC4865038E53} - C:\Program Files\Easy Gif Animator Extension\v3.3.0.2\EasyGifAnimator_Toolbar.dll () O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION) O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (Easy Gif Animator Toolbar) - {35065594-9169-4A34-B167-FC4865038E53} - C:\Program Files\Easy Gif Animator Extension\v3.3.0.2\EasyGifAnimator_Toolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION) O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.) O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [MFARestart] C:\Documents and Settings\All Users\Application Data\MFAData\pack\avgrunasx.exe File not found O4 - HKCU..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (Google Inc.) O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDrives = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDrives = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5) O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} http://www.bebo.com/files/BeboUploader.5.8.05.cab (Reg Error: Key error.) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/s...irector/sw.cab (Shockwave ActiveX Control) O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} https://moneymanager.egg.com/Pinsafe...nttracking.cab (Reg Error: Key error.) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/micr...?1202746562812 (MUWebControl Class) O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} Page not found | Facebook (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary...o.cab56649.cab (Reg Error: Key error.) O16 - DPF: {BE71A78B-77DB-451C-A761-59B37022D544} Pixcetera.com (Reg Error: Key error.) O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} http://game07.zylom.com/activex/zylomgamesplayer.cab (Reg Error: Key error.) O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} https://ukplay.toontown.com/download....21/ttinst.cab (Reg Error: Key error.) O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary...t.cab56907.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jin...ndows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01...l/MSNPUpld.cab (Reg Error: Key error.) O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary...r.cab56986.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll File not found O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop WallPaper: C:\Documents and Settings\Robert Smillie\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Robert Smillie\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008/02/09 19:55:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.) O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.) Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.) Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation) Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point (16902109354000384) ========== Files/Folders - Created Within 30 Days ========== [2010/11/30 22:02:11 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2010/11/30 21:53:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG10 [2010/11/30 21:53:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\AVG [2010/11/30 21:41:52 | 000,000,000 | --SD | C] -- C:\BobSmillie28274B [2010/11/30 21:35:54 | 000,000,000 | -HSD | C] -- C:\RECYCLER [2010/11/30 21:23:50 | 000,000,000 | RHSD | C] -- C:\cmdcons [2010/11/30 21:20:49 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2010/11/30 21:20:49 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2010/11/30 21:20:49 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2010/11/30 21:20:49 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2010/11/30 21:20:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2010/11/30 21:20:41 | 000,000,000 | ---D | C] -- C:\BobSmillie [2010/11/30 20:48:25 | 000,000,000 | ---D | C] -- C:\Qoobox [2010/11/27 10:19:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Robert Smillie\Desktop\Anti virus scan results [2010/11/27 10:18:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Robert Smillie\Desktop\Anti virus programs [2010/11/26 16:31:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Robert Smillie\Application Data\Malwarebytes [2010/11/26 16:31:20 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/11/26 16:31:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2010/11/26 16:31:16 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010/11/26 16:31:16 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010/11/20 19:00:57 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2010/11/20 19:00:38 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2010/11/20 18:48:46 | 000,000,000 | ---D | C] -- C:\Program Files\Safari [2010/11/12 17:13:48 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Robert Smillie\Recent [2010/11/12 17:02:15 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2010/11/12 17:01:26 | 002,810,112 | ---- | C] (Piriform Ltd) -- C:\Documents and Settings\Robert Smillie\Desktop\ccsetup300.exe [2010/11/10 18:22:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Robert Smillie\Application Data\Windows Search [2010/11/09 22:20:58 | 000,299,984 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys [2010/11/06 07:08:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe [2010/11/06 06========== Files - Modified Within 30 Days ========== [2010/12/03 14:38:16 | 000,000,440 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{A0034571-0EBB-4498-B640-A1049143BCA4}.job [2010/12/03 14:25:01 | 000,000,900 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2010/12/03 08:30:37 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2010/12/03 08:30:27 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010/12/03 08:30:25 | 000,044,964 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap [2010/12/02 19:25:37 | 100,786,927 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm [2010/12/01 00:42:54 | 000,636,239 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavifw.avm [2010/11/30 21:54:45 | 000,000,690 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk [2010/11/30 21:30:10 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010/11/30 21:23:54 | 000,000,327 | RHS- | M] () -- C:\boot.ini [2010/11/30 21:03:25 | 003,982,824 | R--- | M] () -- C:\Documents and Settings\Robert Smillie\Desktop\BobSmillie.exe [2010/11/27 17:47:05 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010/11/23 17:01:50 | 000,427,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20101125-162138.backup [2010/11/21 22:09:26 | 000,427,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20101123-170150.backup [2010/11/20 23:35:04 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk [2010/11/20 18:48:57 | 000,001,854 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Safari.lnk [2010/11/20 18:48:57 | 000,001,854 | ---- | M] () -- C:\Documents and Settings\Robert Smillie\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk [2010/11/20 17:45:56 | 000,427,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20101121-220926.backup [2010/11/20 08:31:21 | 000,427,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20101120-174556.backup [2010/11/20 07:52:39 | 000,427,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20101120-083121.backup [2010/11/16 15:36:39 | 000,010,415 | ---- | M] () -- C:\Documents and Settings\Robert Smillie\My Documents\Garden and Home auth No..docx [2010/11/16 15:01:24 | 000,002,515 | ---- | M] () -- C:\Documents and Settings\Robert Smillie\Desktop\Microsoft Office Word 2007.lnk [2010/11/13 16:55:17 | 000,426,907 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20101120-075238.backup [2010/11/12 17:08:50 | 000,264,918 | ---- | M] () -- C:\Documents and Settings\Robert Smillie\Desktop\cc_20101112_170837.reg [2010/11/12 17:02:16 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk [2010/11/12 17:01:35 | 002,810,112 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\Robert Smillie\Desktop\ccsetup300.exe [2010/11/10 18========== Files Created - No Company Name ========== [2010/12/02 19:25:37 | 100,786,927 | ---- | C] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm [2010/12/01 00:42:54 | 000,636,239 | ---- | C] () -- C:\WINDOWS\System32\drivers\AVG\iavifw.avm [2010/11/30 21:54:45 | 000,000,690 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk [2010/11/30 21:23:54 | 000,000,211 | ---- | C] () -- C:\Boot.bak [2010/11/30 21:23:51 | 000,260,272 | RHS- | C] () -- C:\cmldr [2010/11/30 21:20:49 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe [2010/11/30 21:20:49 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2010/11/30 21:20:49 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe [2010/11/30 21:20:49 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2010/11/30 21:20:49 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2010/11/30 21:03:25 | 003,982,824 | R--- | C] () -- C:\Documents and Settings\Robert Smillie\Desktop\BobSmillie.exe [2010/11/20 18:48:57 | 000,001,854 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Safari.lnk [2010/11/20 18:48:57 | 000,001,854 | ---- | C] () -- C:\Documents and Settings\Robert Smillie\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk [2010/11/16 15:36:39 | 000,010,415 | ---- | C] () -- C:\Documents and Settings\Robert Smillie\My Documents\Garden and Home auth No..docx [2010/11/12 17:08:45 | 000,264,918 | ---- | C] () -- C:\Documents and Settings\Robert Smillie\Desktop\cc_20101112_170837.reg [2010/11/12 17:02:16 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk [2010/11/08 22:01:41 | 004,247,040 | ---- | C] () -- C:\Documents and Settings\Robert Smillie\My Documents\HUMAN-LIKEFLOWERS.pps [2010/11/08 12:30:38 | 000,076,800 | ---- | C] () -- C:\Documents and Settings\Robert Smillie\My Documents\DOC1047579.doc [2010/11/04 17:13:53 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\Robert Smillie\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk [2010/11/04 12:29:57 | 000,026,112 | ---- | C] () -- C:\Documents and Settings\Robert Smillie\My Documents\SongChildrensDownInMyHeart.doc [2010/11/03 23:01:32 | 000,046,592 | ---- | C] () -- C:\Documents and Settings\Robert Smillie\My Documents\William.doc [2009/06/05 17:12:03 | 000,000,021 | ---- | C] () -- C:\WINDOWS\.picasa.ini [2009/05/06 09:36:40 | 000,076,407 | ---- | C] () -- C:\Documents and Settings\Robert Smillie\Application Data\Smiley.ico [2009/02/01 19:57:04 | 000,000,050 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2008/12/19 19:33:06 | 000,000,111 | ---- | C] () -- C:\WINDOWS\ka.ini [2008/10/10 18:58:55 | 000,000,031 | -H-- | C] () -- C:\WINDOWS\UKCpInfo.sys [2008/07/20 00:01:48 | 000,000,148 | ---- | C] () -- C:\WINDOWS\wininit.ini [2008/04/02 14:42:13 | 000,000,004 | ---- | C] () -- C:\WINDOWS\msoffice.ini [2008/03/26 15:52:54 | 000,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI [2008/03/25 16========== LOP Check ========== [2009/05/20 11:07:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\162CE [2009/05/07 09:51:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\302E [2009/05/06 09:36:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\33DA [2010/11/30 21:55:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10 [2010/10/28 16:50:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9 [2010/10/28 21:42:08 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files [2008/02/10 22:13:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EPSON [2008/05/22 22:39:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft [2010/01/18 15:47:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Messenger Plus! [2010/11/30 21:45:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData [2008/05/28 14:33:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters [2010/11/30 20:52:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2008/02/10 22:17:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UDL [2008/02/11 09:28:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint [2009/03/20 15:45:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\VUG [2008/04/22 09:36:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Zylom [2009/04/04 17:44:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3} [2010/09/04 18:07:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2009/10/10 18:41:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} [2009/05/02 20:03:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} [2010/10/28 21:44:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert Smillie\Application Data\AVG10 [2009/05/25 07:49:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert Smillie\Application Data\Bamzooki [2008/03/13 15:18:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert Smillie\Application Data\EPSON [2009/07/10 08:37:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert Smillie\Application Data\FontCreator [2008/02/11 14:30:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert Smillie\Application Data\FotoWire [2008/02/11 22:12:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert Smillie\Application Data\Grisoft [2008/03/17 13:55:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert Smillie\Application Data\MSNInstaller [2010/11/02 17:15:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert Smillie\Application Data\OpenCandy [2008/02/11 13:52:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert Smillie\Application Data\Simple Star [2008/02/12 14:10:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert Smillie\Application Data\Template [2009/08/09 19:27:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert Smillie\Application Data\Viewpoint [2010/11/06 06========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2008/02/09 19:55:00 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT [2005/01/24 11:36:50 | 010,810,909 | ---- | M] () -- C:\avg70free_300a419.exe [2009/03/20 15:46:55 | 000,000,211 | ---- | M] () -- C:\Boot.bak [2010/11/30 21:23:54 | 000,000,327 | RHS- | M] () -- C:\boot.ini [2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr [2008/02/09 19:55:00 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS [2008/02/09 19:55:00 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2008/02/11 14:29:42 | 000,000,183 | ---- | M] () -- C:\LogiSetup.log [2008/02/09 19:55:00 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2004/08/04 12:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM [2008/08/27 22:42:54 | 000,250,048 | RHS- | M] () -- C:\ntldr [2010/12/03 08:30:21 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys [2008/10/13 23:03:02 | 000,002,510 | ---- | M] () -- C:\playground.log [2008/04/02 14:59:47 | 000,004,104 | ---- | M] () -- C:\RndisAdaptorMgr.log [2008/02/09 21:50:12 | 000,000,164 | ---- | M] () -- C:\soundmax.log [2008/04/11 14:32:33 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm [2008/09/24 08:25:53 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm [2008/09/24 08:25:53 | 000,000,148 | -H-- | M] () -- C:\sqmdata02.sqm [2009/01/07 15:25:26 | 000,000,268 | -H-- | M] () -- C:\sqmdata03.sqm [2009/02/12 18:36:52 | 000,000,304 | -H-- | M] () -- C:\sqmdata04.sqm [2009/02/13 11:07:35 | 000,000,268 | -H-- | M] () -- C:\sqmdata05.sqm [2009/03/03 15:16:08 | 000,000,268 | -H-- | M] () -- C:\sqmdata06.sqm [2009/03/03 15:16:08 | 000,000,136 | -H-- | M] () -- C:\sqmdata07.sqm [2009/03/03 15:16:08 | 000,000,136 | -H-- | M] () -- C:\sqmdata08.sqm [2009/04/02 19:02:39 | 000,000,268 | -H-- | M] () -- C:\sqmdata09.sqm [2009/04/02 19:02:40 | 000,000,136 | -H-- | M] () -- C:\sqmdata10.sqm [2009/04/02 19:02:40 | 000,000,136 | -H-- | M] () -- C:\sqmdata11.sqm [2008/04/11 14:32:33 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm [2008/09/24 08:25:53 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm [2008/09/24 08:25:53 | 000,000,136 | -H-- | M] () -- C:\sqmnoopt02.sqm [2009/01/07 15:25:26 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm [2009/02/12 18:36:52 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm [2009/02/13 11:07:35 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm [2009/03/03 15:16:08 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt06.sqm [2009/03/03 15:16:08 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm [2009/03/03 15:16:08 | 000,000,136 | -H-- | M] () -- C:\sqmnoopt08.sqm [2009/04/02 19:02:39 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm [2009/04/02 19:02:39 | 000,000,136 | -H-- | M] () -- C:\sqmnoopt10.sqm [2008/04/02 14:59:46 | 000,004,815 | ---- | M] () -- C:\St121PrismAdaptorMgr.log [2008/04/02 14:59:47 | 000,032,030 | ---- | M] () -- C:\StInstall.log [2008/04/02 14:59:43 | 000,000,784 | ---- | M] () -- C:\XPWiFiAdaptorMgr.log < %systemroot%\Fonts\*.com > [2006/04/18 14:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont [2006/06/29 13:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont [2006/04/18 14:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont [2006/06/29 13:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont < %systemroot%\Fonts\*.dll > < %systemroot%\Fonts\*.ini > [2008/02/09 19:54:38 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini < %systemroot%\Fonts\*.ini2 > < %systemroot%\Fonts\*.exe > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > [2008/07/06 12:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpi pelineprintproc.dll [2006/10/26 19< %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.jpg > < %systemroot%\*.png > < %systemroot%\*.scr > [2006/05/18 19:20:35 | 000,319,488 | ---- | M] (Nero AG / Nero Inc.) -- C:\WINDOWS\Nero PhotoShow.scr [2009/07/10 11:15:46 | 000,306,544 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WLXPGSS.SCR < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* > < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\System32\config\*.sav > [2008/02/09 19:42:58 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav [2008/02/09 19:42:58 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav [2008/02/09 19:42:58 | 000,897,024 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav < %PROGRAMFILES%\bak. /s > < %systemroot%\system32\bak. /s > < %ALLUSERSPROFILE%\Start Menu\*.lnk /x > [2008/08/27 22:49:32 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini < %systemroot%\system32\config\systemprofile\*.dat /x > [2008/02/09 19< %systemroot%\*.config > < %systemroot%\system32\*.db > < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x > [2008/02/09 20:04:58 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Robert Smillie\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini [2008/02/09 20:04:57 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Robert Smillie\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf < %USERPROFILE%\Desktop\*.exe > [2008/10/13 16:29:42 | 036,663,808 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Documents and Settings\Robert Smillie\Desktop\8-9_xp32_dd_ccc_wdm_enu_68898.exe [2010/11/30 21:03:25 | 003,982,824 | R--- | M] () -- C:\Documents and Settings\Robert Smillie\Desktop\BobSmillie.exe [2010/11/12 17:01:35 | 002,810,112 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\Robert Smillie\Desktop\ccsetup300.exe [2010/11/08 10:07:16 | 011,701,704 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Robert Smillie\Desktop\windows-kb890830-v3.12.exe < %PROGRAMFILES%\Common Files\*.* > < %systemroot%\*.src > < %systemroot%\install\*.* > < %systemroot%\system32\DLL\*.* > < %systemroot%\system32\HelpFiles\*.* > < %systemroot%\system32\rundll\*.* > < %systemroot%\winn32\*.* > < %systemroot%\Java\*.* > < %systemroot%\system32\test\*.* > < %systemroot%\system32\Rundll32\*.* > < %systemroot%\AppPatch\Custom\*.* > < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x > < %PROGRAMFILES%\PC-Doctor\Downloads\*.* > < %PROGRAMFILES%\Internet Explorer\*.tmp > < %PROGRAMFILES%\Internet Explorer\*.dat > < %USERPROFILE%\My Documents\*.exe > < %USERPROFILE%\*.exe > < %systemroot%\ADDINS\*.* > < %systemroot%\assembly\*.bak2 > < %systemroot%\Config\*.* > < %systemroot%\REPAIR\*.bak2 > < %systemroot%\SECURITY\Database\*.sdb /x > < %systemroot%\SYSTEM\*.bak2 > < %systemroot%\Web\*.bak2 > < %systemroot%\Driver Cache\*.* > < %PROGRAMFILES%\Mozilla Firefox\0*.exe > < %ProgramFiles%\Microsoft Common\*.* > < %ProgramFiles%\TinyProxy. > < %USERPROFILE%\Favorites\*.url /x > [2008/02/09 20:04:57 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Robert Smillie\Favorites\Desktop.ini < %systemroot%\system32\*.bk > < %systemroot%\*.te > < %systemroot%\system32\system32\*.* > < %ALLUSERSPROFILE%\*.dat /x > < %systemroot%\system32\drivers\*.rmv > < dir /b "%systemroot%\system32\*.exe" | find /i " " /c > < dir /b "%systemroot%\*.exe" | find /i " " /c > < %PROGRAMFILES%\Microsoft\*.* > < %systemroot%\System32\Wbem\proquota.exe > < %PROGRAMFILES%\Mozilla Firefox\*.dat > < %USERPROFILE%\Cookies\*.txt /x > [2009/02/13 12:14:05 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\Robert Smillie\Cookies\desktop.ini [2010/12/03 15:08:32 | 000,294,912 | ---- | M] () -- C:\Documents and Settings\Robert Smillie\Cookies\index.dat < %SystemRoot%\system32\fonts\*.* > < %systemroot%\system32\winlog\*.* > < %systemroot%\system32\Language\*.* > < %systemroot%\system32\Settings\*.* > < %systemroot%\system32\*.quo > < %SYSTEMROOT%\AppPatch\*.exe > < %SYSTEMROOT%\inf\*.exe > [2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe < %SYSTEMROOT%\Installer\*.exe > < %systemroot%\system32\config\*.bak2 > < %systemroot%\system32\Computers\*.* > < %SystemRoot%\system32\Sound\*.* > < %SystemRoot%\system32\SpecialImg\*.* > < %SystemRoot%\system32\code\*.* > < %SystemRoot%\system32\draft\*.* > < %SystemRoot%\system32\MSSSys\*.* > < %ProgramFiles%\Javascript\*.* > < %systemroot%\pchealth\helpctr\System\*.exe /s > < %systemroot%\Web\*.exe > < %systemroot%\system32\msn\*.* > < %systemroot%\system32\*.tro > < %AppData%\Microsoft\Installer\msupdates\*.* > < %ProgramFiles%\Messenger\*.* > [2008/04/14 00:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll [2007/04/02 18:07:22 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif [2008/05/02 14:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll [2008/04/13 17:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll [2008/04/14 00:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe [2007/04/02 18:07:23 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav [2007/04/02 18:07:23 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav [2007/04/02 18:07:24 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav [2007/04/02 18:07:27 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav [2007/04/02 18:04:01 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm < %systemroot%\system32\systhem32\*.* > < %systemroot%\system\*.exe > < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\WindowsUpdate\Auto > < Update\Results\Install|LastSuccessTime /rs > ========== Alternate Data Streams ========== @Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4 @Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP
OTL logfile created on: 03/12/2010 15:08:40 - Run 1========== Processes (SafeList) ========== ========== Modules (SafeList) ========== ========== Win32 Services (SafeList) ========== ========== Driver Services (SafeList) ========== ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== Google Toolbar AOL.co.uk Google Toolbar Google Toolbar ========== FireFox ========== js ..browser.search.defaultenginename: "AOL Search"js ..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=3235&invocationType=tbff50sbox&query ="js ..browser.search.selectedEngine: "Ask"js ..browser.search.useDBForOrder: truejs ..browser.startup.homepage: "http://www.plusnetwork.com"js ..extensions.enabledItems: {7affbfae-c4e2-4915-8c0f-00fa3ec610a1}:5.5.18.6js ..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0js ..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=3235&invocationType=TBab-en-gb-web-aol-V55-winff&query="js ..network.proxy.no_proxies_on: "localhost,*.local"http://www.bebo.com/files/BeboUploader.5.8.05.cab (Reg Error: Key error.)http://download.macromedia.com/pub/s...irector/sw.cab (Shockwave ActiveX Control)https://moneymanager.egg.com/Pinsafe...nttracking.cab (Reg Error: Key error.)http://www.update.microsoft.com/micr...?1202746562812 (MUWebControl Class)Page not found | Facebook (Reg Error: Key error.)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_12)http://messenger.zone.msn.com/binary...o.cab56649.cab (Reg Error: Key error.)Pixcetera.com (Reg Error: Key error.)http://game07.zylom.com/activex/zylomgamesplayer.cab (Reg Error: Key error.)https://ukplay.toontown.com/download....21/ttinst.cab (Reg Error: Key error.)http://messenger.zone.msn.com/binary...t.cab56907.cab (Reg Error: Key error.)http://java.sun.com/update/1.5.0/jin...ndows-i586.cab (Reg Error: Key error.)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_07)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_12)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_12)http://gfx1.hotmail.com/mail/w4/pr01...l/MSNPUpld.cab (Reg Error: Key error.)http://messenger.zone.msn.com/binary...r.cab56986.cab (Reg Error: Key error.)========== Files/Folders - Created Within 30 Days ========== ========== Files - Modified Within 30 Days ========== ========== Files Created - No Company Name ========== ========== LOP Check ========== ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > < %systemroot%\Fonts\*.com > < %systemroot%\Fonts\*.dll > < %systemroot%\Fonts\*.ini > < %systemroot%\Fonts\*.ini2 > < %systemroot%\Fonts\*.exe > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.jpg > < %systemroot%\*.png > < %systemroot%\*.scr > < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* > < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\System32\config\*.sav > < %PROGRAMFILES%\bak. /s > < %systemroot%\system32\bak. /s > < %ALLUSERSPROFILE%\Start Menu\*.lnk /x > < %systemroot%\system32\config\systemprofile\*.dat /x > < %systemroot%\*.config > < %systemroot%\system32\*.db > < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x > < %USERPROFILE%\Desktop\*.exe > < %PROGRAMFILES%\Common Files\*.* > < %systemroot%\*.src > < %systemroot%\install\*.* > < %systemroot%\system32\DLL\*.* > < %systemroot%\system32\HelpFiles\*.* > < %systemroot%\system32\rundll\*.* > < %systemroot%\winn32\*.* > < %systemroot%\Java\*.* > < %systemroot%\system32\test\*.* > < %systemroot%\system32\Rundll32\*.* > < %systemroot%\AppPatch\Custom\*.* > < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x > < %PROGRAMFILES%\PC-Doctor\Downloads\*.* > < %PROGRAMFILES%\Internet Explorer\*.tmp > < %PROGRAMFILES%\Internet Explorer\*.dat > < %USERPROFILE%\My Documents\*.exe > < %USERPROFILE%\*.exe > < %systemroot%\ADDINS\*.* > < %systemroot%\assembly\*.bak2 > < %systemroot%\Config\*.* > < %systemroot%\REPAIR\*.bak2 > < %systemroot%\SECURITY\Database\*.sdb /x > < %systemroot%\SYSTEM\*.bak2 > < %systemroot%\Web\*.bak2 > < %systemroot%\Driver Cache\*.* > < %PROGRAMFILES%\Mozilla Firefox\0*.exe > < %ProgramFiles%\Microsoft Common\*.* > < %ProgramFiles%\TinyProxy. > < %USERPROFILE%\Favorites\*.url /x > < %systemroot%\system32\*.bk > < %systemroot%\*.te > < %systemroot%\system32\system32\*.* > < %ALLUSERSPROFILE%\*.dat /x > < %systemroot%\system32\drivers\*.rmv > < dir /b "%systemroot%\system32\*.exe" | find /i " " /c > < dir /b "%systemroot%\*.exe" | find /i " " /c > < %PROGRAMFILES%\Microsoft\*.* > < %systemroot%\System32\Wbem\proquota.exe > < %PROGRAMFILES%\Mozilla Firefox\*.dat > < %USERPROFILE%\Cookies\*.txt /x > < %SystemRoot%\system32\fonts\*.* > < %systemroot%\system32\winlog\*.* > < %systemroot%\system32\Language\*.* > < %systemroot%\system32\Settings\*.* > < %systemroot%\system32\*.quo > < %SYSTEMROOT%\AppPatch\*.exe > < %SYSTEMROOT%\inf\*.exe > < %SYSTEMROOT%\Installer\*.exe > < %systemroot%\system32\config\*.bak2 > < %systemroot%\system32\Computers\*.* > < %SystemRoot%\system32\Sound\*.* > < %SystemRoot%\system32\SpecialImg\*.* > < %SystemRoot%\system32\code\*.* > < %SystemRoot%\system32\draft\*.* > < %SystemRoot%\system32\MSSSys\*.* > < %ProgramFiles%\Javascript\*.* > < %systemroot%\pchealth\helpctr\System\*.exe /s > < %systemroot%\Web\*.exe > < %systemroot%\system32\msn\*.* > < %systemroot%\system32\*.tro > < %AppData%\Microsoft\Installer\msupdates\*.* > < %ProgramFiles%\Messenger\*.* > < %systemroot%\system32\systhem32\*.* > < %systemroot%\system\*.exe > < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\WindowsUpdate\Auto > < Update\Results\Install|LastSuccessTime /rs > ========== Alternate Data Streams ========== ========== Extra Registry (SafeList) ========== ========== File Associations ========== ========== Shell Spawning ========== ========== Security Center Settings ========== ========== System Restore Settings ========== ========== Firewall Settings ========== ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== ========== Last 10 Event Log Errors ==========
Newbie
56 -------- d-----w- c:\docume~1\robert~1\applic~1\Windows Desktop Search
39 - System Checkpoint
isabled:Logitech Desktop Messenger -- (Logitech)
