Internet Security 2010 yeah

my computer logs on but can't use task manager or just about anything else Really need some help plz im begging you.

im going to use hijack this right now.

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 4:09:50 PM, on 1/7/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\winupdate86.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\InternetSecurity2010\IS2010.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Absolute Poker\TrendMicro\HiJackThis\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\SYSTEM32\NOTEPAD.EXE
C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: Shell=Explorer.exe logon.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\winlogon86.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Antivirus Plus BHO - {C2B5AAB8-2183-4be7-81A6-F11493C45872} - C:\Documents and Settings\Steve Collins\Application Data\AntiVirus Plus\AntiVirus Plus.70367201.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [winupdate86.exe] C:\WINDOWS\system32\winupdate86.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [zehuwafob] Rundll32.exe "c:\windows\system32\dirupahu.dll",a
O4 - HKLM\..\Run: [AntiVirus Plus] "C:\WINDOWS\system32\rundll32.exe" "C:\Documents and Settings\Steve Collins\Application Data\AntiVirus Plus\AntiVirus Plus.70367201.dll", start 70367201
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] F:\Documents\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AntiVirus Plus] "C:\WINDOWS\system32\rundll32.exe" "C:\Documents and Settings\Steve Collins\Application Data\AntiVirus Plus\AntiVirus Plus.70367201.dll", start 70367201 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AntiVirus Plus] "C:\WINDOWS\system32\rundll32.exe" "C:\Documents and Settings\Steve Collins\Application Data\AntiVirus Plus\AntiVirus Plus.70367201.dll", start 70367201 (User 'Default user')
O4 - S-1-5-18 Startup: AntiVirus Plus.lnk = C:\WINDOWS\SYSTEM32\RUNDLL32.EXE (User 'SYSTEM')
O4 - .DEFAULT Startup: AntiVirus Plus.lnk = C:\WINDOWS\SYSTEM32\RUNDLL32.EXE (User 'Default user')
O4 - Startup: AntiVirus Plus.lnk = C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AntiVirus Plus.lnk = C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: absoƖute Poker - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\Documents and Settings\Steve Collins\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (HKCU)
O9 - Extra 'Tools' menuitem: absoƖute Poker - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\Documents and Settings\Steve Collins\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (HKCU)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - https://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1123808924330
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by107fd.bay107.hotmail.msn.com/activex/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD40AD12-5457-49AB-8A08-8A2B41281FC7}: NameServer = 193.104.110.38,4.2.2.1,192.168.0.1
O21 - SSODL: SwUpdate - {009541A0-3B00-1F1C-00F3-040224001C01} - C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\swupdate.dll
O21 - SSODL: lemalezat - {3bec323f-7023-47f6-9240-6f2c5e692601} - c:\windows\system32\bujokatu.dll (file missing)
O21 - SSODL: vunodiguz - {f065e614-d020-4316-bd9b-c877b962bd41} - c:\windows\system32\dirupahu.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: mujuzedij - {3bec323f-7023-47f6-9240-6f2c5e692601} - c:\windows\system32\bujokatu.dll (file missing)
O22 - SharedTaskScheduler: kupuhivus - {f065e614-d020-4316-bd9b-c877b962bd41} - c:\windows\system32\dirupahu.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\Dfsdks.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 12866 bytes

found this site http://www.spywarefixpro.com/remove-internet-security-2010/

took forever to update spyware doctor its scanning right now
thanks for everything this a neat site. will bookmark

do i need anything else like malwarebytes or do anything else do i still have to delete the files with internet secruity on them?



plus all i did was hit ctrl alt del right when you see that sign youve herps have fun with them and as fast as i could stop winlogon86 ithink thats what it is not but yeah finally updated spyware doctor hope this helps.

Give MBAM a try if you can.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

malewarebytes wont install off my cruzer stick to my computer but i got spywaredoctor to update finally found the internet security 2010 plus a bunch of trojans and stuff this is my new hijackthis file after my computer started i still had that warning thing before i see the desktop plus found out how to kill process
with taskmgr just find the taskmgr file and change the name to iexplore i did that by going to c drive windows system32 and finding taskmgr and pressing ctrl+c then ctrl+v and it makes a copy of taskmgr in the bottom of the system32 file and changed the name so now taskmgr works but my system restore isnt working and spywaredoctor i think needs a setup restore before fixing the virus's is that right or no?

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 12:26:21 AM, on 1/8/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spyware Doctor\pctsGui.exe
C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Absolute Poker\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: Shell=Explorer.exe logon.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\winlogon86.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Antivirus Plus BHO - {C2B5AAB8-2183-4be7-81A6-F11493C45872} - C:\Documents and Settings\Steve Collins\Application Data\AntiVirus Plus\AntiVirus Plus.70367201.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [winupdate86.exe] C:\WINDOWS\system32\winupdate86.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [zehuwafob] Rundll32.exe "c:\windows\system32\dirupahu.dll",a
O4 - HKLM\..\Run: [AntiVirus Plus] "C:\WINDOWS\system32\rundll32.exe" "C:\Documents and Settings\Steve Collins\Application Data\AntiVirus Plus\AntiVirus Plus.70367201.dll", start 70367201
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AntiVirus Plus] "C:\WINDOWS\system32\rundll32.exe" "C:\Documents and Settings\Steve Collins\Application Data\AntiVirus Plus\AntiVirus Plus.70367201.dll", start 70367201 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AntiVirus Plus] "C:\WINDOWS\system32\rundll32.exe" "C:\Documents and Settings\Steve Collins\Application Data\AntiVirus Plus\AntiVirus Plus.70367201.dll", start 70367201 (User 'Default user')
O4 - S-1-5-18 Startup: AntiVirus Plus.lnk = C:\WINDOWS\SYSTEM32\RUNDLL32.EXE (User 'SYSTEM')
O4 - .DEFAULT Startup: AntiVirus Plus.lnk = C:\WINDOWS\SYSTEM32\RUNDLL32.EXE (User 'Default user')
O4 - Startup: AntiVirus Plus.lnk = C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AntiVirus Plus.lnk = C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: absoƖute Poker - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\Documents and Settings\Steve Collins\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (HKCU)
O9 - Extra 'Tools' menuitem: absoƖute Poker - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\Documents and Settings\Steve Collins\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (HKCU)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - https://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1123808924330
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by107fd.bay107.hotmail.msn.com/activex/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD40AD12-5457-49AB-8A08-8A2B41281FC7}: NameServer = 193.104.110.38,4.2.2.1,192.168.0.1
O21 - SSODL: SwUpdate - {009541A0-3B00-1F1C-00F3-040224001C01} - C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\swupdate.dll
O21 - SSODL: lemalezat - {3bec323f-7023-47f6-9240-6f2c5e692601} - c:\windows\system32\bujokatu.dll (file missing)
O21 - SSODL: vunodiguz - {f065e614-d020-4316-bd9b-c877b962bd41} - c:\windows\system32\dirupahu.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: mujuzedij - {3bec323f-7023-47f6-9240-6f2c5e692601} - c:\windows\system32\bujokatu.dll (file missing)
O22 - SharedTaskScheduler: kupuhivus - {f065e614-d020-4316-bd9b-c877b962bd41} - c:\windows\system32\dirupahu.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\Dfsdks.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 12475 bytes

Hello.

• Download combofix from here
  Link 1
  Link 2
  
  1. If you are using Firefox, make sure that your download settings are as follows:
  
  * Tools->Options->Main tab
  * Set to "Always ask me where to Save the files".
  
  2. During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  3. It is important you rename Combofix during the download, but not after.
  4. Please do not rename Combofix to other names, but only to the one indicated.
  5. Close any open browsers.
  6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

cant get malewarebytes to load it says unable to execute file: c\documents and settins\malewarebytes anti maleware\mbam.exe

create process falied: code 2
the system cannot find the file specified


what should i do i also tryed to save it to c\programs\malewarebytes sorry for the double post im on my uncles laptop and it wont open combofix link or rkill.com file on mybleeping site it won load the page
it just keeps saying problem loading page do you know how to fix that to? if not thats ok he also had internet secruity 2010 but his just went away whats up with that?

are there any other links that might work this computer wont open the page.
can i fix this computer so it will open your links.

Try this link instead:
http://www.forospyware.com/sUBs/ComboFix.exe

yeah it opened i seen it earlier but its in a different language?

which one do i download?

Referal check, that sucks. Ignore my last link, guess we'll need to use something else.

Download OTL by OldTimer to your Desktop.

• Close all windows and double click OTL.exe
  
• Click Run Scan and let the program run uninterrupted
  
• It will produce two logs for you, one will pop up - OTL.txt, the other will be saved on your Desktop - Extras.txt. Post both logs in this thread.
  
• You may need to use two posts to get it all.
  

OTL Extras logfile created on: 1/8/2010 1:17:16 PM - Run 1
OTL by OldTimer - Version 3.1.21.2 Folder = C:\Documents and Settings\Steve Collins\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 248.00 Mb Available Physical Memory | 49.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 63.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 52.86 Gb Total Space | 39.35 Gb Free Space | 74.43% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: INSPIRON1150
Current User Name: Steve Collins
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with Paint Shop Pro Studio] -- "C:\Program Files\Jasc Software Inc\Paint Shop Pro Studio\\Paint Shop Pro Studio.exe" "/Browse" "%L" (Jasc Software, Inc.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- File not found
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- File not found
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL -- File not found
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger -- (America Online, Inc.)
"C:\WINDOWS\Temp\alg.exe" = C:\WINDOWS\Temp\alg.exe:*:Enabled:Application Layer Gateway Service -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- (Lime Wire, LLC)
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" = C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer -- (Microsoft Corporation)
"C:\Program Files\Yahoo!\Messenger\YPager.exe" = C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger -- ()
"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server -- (Yahoo! Inc.)
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Disabled:AOL -- File not found
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Disabled:AOL -- File not found
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Disabled:AOL -- File not found
"C:\Program Files\Dell Inc\Dell Picture Studio v3.0\launch.exe" = C:\Program Files\Dell Inc\Dell Picture Studio v3.0\launch.exe:*:Disabled:Jasc Paint Shop Photo Album 5 Application -- (Jasc Software)
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger -- (America Online, Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Computer, Inc.)
"C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe" = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater -- ()
"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe" = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare -- ()
"C:\WINDOWS\Temp\alg.exe" = C:\WINDOWS\Temp\alg.exe:*:Enabled:Application Layer Gateway Service -- File not found
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Explorer -- (Microsoft Corporation)
"C:\Program Files\Executive Software\Diskeeper\DkService.exe" = C:\Program Files\Executive Software\Diskeeper\DkService.exe:*:Enabled:DkService -- (Executive Software International, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}" = Notifier
"{01B06D09-CF96-4878-A0F4-B6217150BB1B}" = Microsoft Money 2003
"{02B42D23-10F2-4862-ADA4-3DF1EA0021B2}" = Microsoft Money 2003 System Pack
"{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}" = HiJackThis
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{154508C0-07C5-4659-A7A0-E49968750D21}" = HLPPDOCK
"{20227921-DB38-4810-9162-DDC6FCA936E7}" = Dell Home Systems Services Agreement
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 17
"{2A6282FF-B75B-463F-90F5-0A43732F690D}" = Broadcom Management Programs
"{3248F0A8-6813-11D6-A77B-00B0D0150040}" = J2SE Runtime Environment 5.0 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{32A3A4F4-B792-11D6-A78A-00B0D0150040}" = J2SE Development Kit 5.0 Update 4
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
"{38441BE7-79B0-42B8-8297-833704F949FE}" = HLPIndex
"{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353}" = OTtBPSDK
"{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}" = Google Earth
"{4102037D-E8E0-48E0-B203-E521D194FB71}" = NETGEAR WG111v2 wireless USB 2.0 adapter
"{417B79C9-CDB4-477F-952D-840CEFC57A6C}" = AccessDirect
"{4192EAC0-6B36-4723-B216-D0E86E7757AC}" = Jasc Paint Shop Photo Album 5
"{432C3720-37BF-4BD7-8E49-F38E090246D0}" = CR2
"{48C82F7A-F100-4DAB-A310-8E18BF2159E1}" = ESSvpot
"{4F677FC7-7AA8-412B-A957-F13CBE1C7331}" = ESSSONIC
"{501BADCD-F8F7-44CB-AC3F-6ED25C1A28B5}" = iTunes
"{54C8FE84-89C4-40E8-976C-439EB0729BD6}" = CardRd81
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{6ACA2FD2-4C4A-42F3-AFB5-7B433BBDF6DB}" = InterVideo WinDVD 6
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{78C496B9-5A6B-4692-8C2E-AFFFC34E4961}" = Jasc Paint Shop Pro Studio, Dell Editon
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{87843A41-7808-4F2E-B13F-25C1E67CF2FD}" = ESShelp
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
"{8BB4B58A-A402-4DE8-8FCD-287E60B88DD8}" = ESSCT
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{929408E6-D265-4174-805F-81D1D914E2A4}" = QuickTime
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}" = ESScore
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5B3EB8A-4071-42F0-8E8E-7A8342AA8E69}" = ESSvpaht
"{AA67205C-3E80-4062-9198-253A059DEE38}" = Diskeeper Professional Edition
"{AADAC983-FDE9-42FA-8FD9-7BB324155593}" = HLPRFO
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0.8
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{AF06CAE4-C134-44B1-B699-14FBDB63BD37}" = Dell Picture Studio v3.0
"{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}" = KSU
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{CA60320D-6A16-49C8-A34F-84EEF4799567}" = ESSTUTOR
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F71760CD-0F8B-4DCC-B7B7-6B223CC3843C}" = OTtBP
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"{FDF9943A-3D5C-46B3-9679-586BD237DDEE}" = SKIN0001
"274c5407c4fa26908310cb5c1c410000" = NetBeans IDE 4.1
"3D World Atlas" = 3D World Atlas
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AOL Instant Messenger" = AOL Instant Messenger
"AOL Toolbar" = AOL Toolbar 2.0
"Ashampoo WinOptimizer 2010 Advanced_is1" = Ashampoo WinOptimizer 2010 Advanced
"Audacity_is1" = Audacity 1.2.4
"AVG7Uninstall" = AVG Free Edition
"BCM V.92 56K Modem" = BCM V.92 56K Modem
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Utility
"Browser Defender_is1" = Browser Defender 2.0.6.11
"BSPlayerf" = BS.Player FREE
"CTDVDAudio Plugin" = Creative DVD Audio Plugin for Audigy Series
"DellSupport" = Dell Support 5.0.0 (630)
"Deluxe Menu" = Deluxe Menu
"DreamCast Factory_is1" = DreamCast Factory v0.9.5 (FULL)
"Generations Deluxe 6" = Generations Deluxe 6
"InstallShield_{2A6282FF-B75B-463F-90F5-0A43732F690D}" = Broadcom Management Programs
"InstallShield_{501BADCD-F8F7-44CB-AC3F-6ED25C1A28B5}" = iTunes
"InstallShield_{929408E6-D265-4174-805F-81D1D914E2A4}" = QuickTime
"InterActual Player" = InterActual Player
"Lemonade Tycoon 2_is1" = Lemonade Tycoon 2
"LimeWire" = LimeWire 4.6.0
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Nero - Burning Rom!UninstallKey" = Ahead Nero Burning ROM
"Quicken 2002 New User Edition" = Quicken 2002 New User Edition
"RealPlayer 6.0" = RealPlayer Basic
"RegCure" = RegCure
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.3
"Spyware Doctor" = Spyware Doctor 7.0
"StreetPlugin" = Learn2 Player (Uninstall Only)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"ViewpointMediaPlayer" = Viewpoint Media Player
"WGA" = Windows Genuine Advantage Validation Tool
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Customizations" = Yahoo! extras
"Yahoo! Internet Mail" = Yahoo! Internet Mail
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Absolute Poker" = absoƖute Poker
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/24/2009 2:16:40 PM | Computer Name = INSPIRON1150 | Source = AVG7 | ID = 100
Description = 2009-12-24 18:16:40,352 INSPIRON1150 [001440:001452] ERROR 000 AVG7.AM
service module run failed: Error 0x80040154

Error - 12/25/2009 10:19:51 AM | Computer Name = INSPIRON1150 | Source = AVG7 | ID = 100
Description = 2009-12-25 14:19:51,192 INSPIRON1150 [001440:001452] ERROR 000 AVG7.AM
service module run failed: Error 0x80040154

Error - 12/26/2009 3:30:51 PM | Computer Name = INSPIRON1150 | Source = AVG7 | ID = 100
Description = 2009-12-26 19:30:51,753 INSPIRON1150 [001440:001452] ERROR 000 AVG7.AM
service module run failed: Error 0x80040154

Error - 12/26/2009 4:23:38 PM | Computer Name = INSPIRON1150 | Source = AVG7 | ID = 100
Description = 2009-12-26 20:23:38,922 INSPIRON1150 [001444:001456] ERROR 000 AVG7.AM
service module run failed: Error 0x80040154

Error - 12/26/2009 6:03:47 PM | Computer Name = INSPIRON1150 | Source = AVG7 | ID = 100
Description = 2009-12-26 22:03:47,893 INSPIRON1150 [001440:001452] ERROR 000 AVG7.AM
service module run failed: Error 0x80040154

Error - 12/27/2009 11:32:27 AM | Computer Name = INSPIRON1150 | Source = AVG7 | ID = 100
Description = 2009-12-27 15:32:27,473 INSPIRON1150 [001440:001452] ERROR 000 AVG7.AM
service module run failed: Error 0x80040154

Error - 12/27/2009 6:36:11 PM | Computer Name = INSPIRON1150 | Source = AVG7 | ID = 100
Description = 2009-12-27 22:36:11,221 INSPIRON1150 [001448:001460] ERROR 000 AVG7.AM
service module run failed: Error 0x80040154

Error - 12/28/2009 8:57:47 PM | Computer Name = INSPIRON1150 | Source = AVG7 | ID = 100
Description = 2009-12-29 00:57:47,211 INSPIRON1150 [001440:001452] ERROR 000 AVG7.AM
service module run failed: Error 0x80040154

Error - 12/29/2009 10:25:27 AM | Computer Name = INSPIRON1150 | Source = AVG7 | ID = 100
Description = 2009-12-29 14:25:27,222 INSPIRON1150 [001056:001068] ERROR 000 AVG7.AM
service module run failed: Error 0x80040154

Error - 12/29/2009 11:14:50 AM | Computer Name = INSPIRON1150 | Source = AVG7 | ID = 100
Description = 2009-12-29 15:14:50,082 INSPIRON1150 [001060:001072] ERROR 000 AVG7.AM
service module run failed: Error 0x80040154

[ System Events ]
Error - 1/8/2010 12:52:26 PM | Computer Name = INSPIRON1150 | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service MDM with arguments
"" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}

Error - 1/8/2010 12:57:26 PM | Computer Name = INSPIRON1150 | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service MDM with arguments
"" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}

Error - 1/8/2010 1:10:26 PM | Computer Name = INSPIRON1150 | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service MDM with arguments
"" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}

Error - 1/8/2010 1:12:08 PM | Computer Name = INSPIRON1150 | Source = DCOM | ID = 10010
Description = The server {0002DF01-0000-0000-C000-000000000046} did not register
with DCOM within the required timeout.

Error - 1/8/2010 1:15:26 PM | Computer Name = INSPIRON1150 | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service MDM with arguments
"" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}

Error - 1/8/2010 1:41:27 PM | Computer Name = INSPIRON1150 | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service MDM with arguments
"" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}

Error - 1/8/2010 1:46:26 PM | Computer Name = INSPIRON1150 | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service MDM with arguments
"" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}

Error - 1/8/2010 2:12:16 PM | Computer Name = INSPIRON1150 | Source = DCOM | ID = 10010
Description = The server {0002DF01-0000-0000-C000-000000000046} did not register
with DCOM within the required timeout.

Error - 1/8/2010 2:15:27 PM | Computer Name = INSPIRON1150 | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service MDM with arguments
"" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}

Error - 1/8/2010 2:20:27 PM | Computer Name = INSPIRON1150 | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service MDM with arguments
"" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}


< End of report >

OTL logfile created on: 1/8/2010 1:17:15 PM - Run 1
OTL by OldTimer - Version 3.1.21.2 Folder = C:\Documents and Settings\Steve Collins\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 248.00 Mb Available Physical Memory | 49.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 63.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 52.86 Gb Total Space | 39.35 Gb Free Space | 74.43% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: INSPIRON1150
Current User Name: Steve Collins
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/01/08 13:07:36 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Steve Collins\Desktop\OTL.exe
PRC - [2009/12/12 23:49:52 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009/11/18 12:47:14 | 01,243,088 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\pctsTray.exe
PRC - [2009/11/06 14:29:22 | 01,141,712 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\pctsSvc.exe
PRC - [2009/10/30 11:18:16 | 00,359,624 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\pctsAuxs.exe
PRC - [2007/06/13 05:23:07 | 01,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/04/03 07:11:35 | 00,049,664 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG Free\avgupsvc.exe
PRC - [2005/09/20 08:36:20 | 00,114,688 | ---- | M] (Intel Corporation) -- C:\WINDOWS\SYSTEM32\igfxpers.exe
PRC - [2005/09/20 08:32:24 | 00,077,824 | ---- | M] (Intel Corporation) -- C:\WINDOWS\SYSTEM32\hkcmd.exe
PRC - [2005/09/20 08:32:16 | 00,159,744 | ---- | M] (Intel Corporation) -- C:\WINDOWS\SYSTEM32\igfxsrvc.exe
PRC - [2004/01/06 11:47:06 | 00,327,792 | ---- | M] (Executive Software International, Inc.) -- C:\Program Files\Executive Software\Diskeeper\DkService.exe


========== Modules (SafeList) ==========

MOD - [2099/01/01 12:00:00 | 00,093,696 | -HS- | M] () -- C:\WINDOWS\SYSTEM32\dirupahu.dll
MOD - [2099/01/01 12:00:00 | 00,053,760 | -HS- | M] () -- C:\WINDOWS\SYSTEM32\dowikabu.dll
MOD - [2010/01/08 13:07:36 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Steve Collins\Desktop\OTL.exe
MOD - [2009/12/13 00:47:25 | 00,081,920 | ---- | M] (Adobe Systems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\swupdate.dll
MOD - [2009/10/30 11:18:16 | 00,147,024 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\PCTGMhk.dll
MOD - [2009/09/09 22:54:58 | 00,155,184 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\smum32.dll
MOD - [2007/03/08 10:36:28 | 00,033,280 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\kbdsock.dll
MOD - [2006/08/25 10:45:55 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/12/12 23:49:52 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009/11/10 10:28:08 | 00,112,592 | ---- | M] (Threat Expert Ltd.) [Auto | Stopped] -- C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)
SRV - [2009/11/06 14:29:22 | 01,141,712 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\Spyware Doctor\pctsSvc.exe -- (sdCoreService)
SRV - [2009/10/30 11:18:16 | 00,359,624 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)
SRV - [2009/08/24 21:16:36 | 00,406,016 | ---- | M] (mst software GmbH, Germany) [On_Demand | Stopped] -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\Dfsdks.exe -- (DfSdkS)
SRV - [2009/01/18 08:13:50 | 00,418,816 | ---- | M] (GRISOFT, s.r.o.) [Auto | Stopped] -- C:\Program Files\Grisoft\AVG Free\avgamsvr.exe -- (Avg7Alrt)
SRV - [2008/11/09 15:48:14 | 00,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Stopped] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2007/04/03 07:11:35 | 00,049,664 | ---- | M] (GRISOFT, s.r.o.) [Auto | Running] -- C:\Program Files\Grisoft\AVG Free\avgupsvc.exe -- (Avg7UpdSvc)
SRV - [2005/12/20 20:54:34 | 00,323,584 | ---- | M] (Apple Computer, Inc.) [On_Demand | Stopped] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPodService)
SRV - [2005/04/04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005/03/30 15:46:56 | 00,411,920 | ---- | M] (Eastman Kodak Company) [On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\KodakCCS.exe -- (KodakCCS)
SRV - [2004/02/20 17:14:04 | 00,045,056 | ---- | M] () [Disabled | Stopped] -- C:\WINDOWS\System32\WLTRYSVC.EXE -- (WLTRYSVC)
SRV - [2004/01/06 11:47:06 | 00,327,792 | ---- | M] (Executive Software International, Inc.) [Auto | Running] -- C:\Program Files\Executive Software\Diskeeper\DkService.exe -- (Diskeeper)


========== Driver Services (SafeList) ==========

DRV - [2009/11/20 14:56:02 | 00,021,035 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\AegisP.sys -- (AegisP) AEGIS Protocol (IEEE 802.1x)
DRV - [2009/11/09 11:20:12 | 00,207,792 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\PCTCore.sys -- (PCTCore)
DRV - [2009/01/18 08:14:02 | 00,010,760 | ---- | M] (GRISOFT, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgclean.sys -- (AvgClean)
DRV - [2009/01/18 08:13:44 | 00,821,856 | ---- | M] (GRISOFT, s.r.o.) [Kernel | System | Stopped] -- C:\WINDOWS\System32\Drivers\avg7core.sys -- (Avg7Core)
DRV - [2007/11/13 05:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\secdrv.sys -- (Secdrv)
DRV - [2007/04/03 07:12:22 | 00,027,776 | ---- | M] (GRISOFT, s.r.o.) [Kernel | System | Stopped] -- C:\WINDOWS\System32\Drivers\avg7rsxp.sys -- (Avg7RsXP)
DRV - [2007/04/03 07:12:22 | 00,004,224 | ---- | M] (GRISOFT, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avg7rsw.sys -- (Avg7RsW)
DRV - [2007/04/03 07:11:40 | 00,004,960 | ---- | M] (GRISOFT, s.r.o.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\avgtdi.sys -- (AvgTdi)
DRV - [2005/09/20 09:00:54 | 01,302,332 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ialmnt5.sys -- (ialm)
DRV - [2005/06/16 13:41:02 | 00,037,150 | ---- | M] (Eastman Kodak Company) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\DcCam.sys -- (DcCam)
DRV - [2005/04/01 11:43:02 | 00,066,048 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\EAPPkt.sys -- (EAPPkt)
DRV - [2005/03/31 07:00:08 | 00,152,081 | ---- | M] (Eastman Kodak Company) [Kernel | System | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\ExportIt.sys -- (Exportit)
DRV - [2005/03/31 06:47:56 | 00,070,262 | ---- | M] (Eastman Kodak Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\DcPtp.sys -- (DcPTP)
DRV - [2005/03/31 06:47:50 | 00,008,022 | ---- | M] (Eastman Kodak Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\DcLps.sys -- (DcLps)
DRV - [2005/03/31 06:47:48 | 00,038,673 | ---- | M] (Eastman Kodak Company) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\DCFS2k.sys -- (DCFS2K)
DRV - [2005/03/31 06:47:42 | 00,061,564 | ---- | M] (Eastman Kodak Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\DcFpoint.sys -- (DcFpoint)
DRV - [2005/02/18 01:28:33 | 00,008,552 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\asctrm.sys -- (ASCTRM)
DRV - [2005/02/18 01:16:15 | 00,015,781 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mdc8021x.sys -- (MDC8021X) AEGIS Protocol (IEEE 802.1x)
DRV - [2005/02/02 01:21:04 | 00,014,408 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2004/12/01 03:22:00 | 00,087,488 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\drvmcdb.sys -- (drvmcdb)
DRV - [2004/11/23 02:56:00 | 00,040,480 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\drvnddm.sys -- (drvnddm)
DRV - [2004/11/16 01:05:00 | 00,100,603 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnudfa.sys -- (tfsnudfa)
DRV - [2004/11/16 01:05:00 | 00,098,714 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnudf.sys -- (tfsnudf)
DRV - [2004/11/16 01:05:00 | 00,086,554 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnifs.sys -- (tfsnifs)
DRV - [2004/11/16 01:05:00 | 00,034,843 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsncofs.sys -- (tfsncofs)
DRV - [2004/11/16 01:05:00 | 00,025,883 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnboio.sys -- (tfsnboio)
DRV - [2004/11/16 01:05:00 | 00,015,227 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnopio.sys -- (tfsnopio)
DRV - [2004/11/16 01:05:00 | 00,006,363 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnpool.sys -- (tfsnpool)
DRV - [2004/11/16 01:05:00 | 00,004,123 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsndrct.sys -- (tfsndrct)
DRV - [2004/11/16 01:05:00 | 00,002,239 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsndres.sys -- (tfsndres)
DRV - [2004/11/15 16:37:52 | 00,264,440 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\stac97.sys -- (STAC97) Audio Driver (WDM)
DRV - [2004/09/23 01:03:00 | 00,020,576 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20)
DRV - [2004/08/04 06:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\PTILINK.SYS -- (Ptilink)
DRV - [2004/08/04 00:07:44 | 00,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2004/08/04 00:07:44 | 00,041,088 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2004/08/03 23:29:56 | 01,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\NV4_MINI.SYS -- (nv)
DRV - [2004/08/03 23:08:44 | 00,025,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\usbser.sys -- (usbser)
DRV - [2004/07/14 11:29:04 | 00,005,627 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\sscdbhk5.sys -- (sscdbhk5)
DRV - [2004/07/14 11:28:50 | 00,023,545 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ssrtln.sys -- (ssrtln)
DRV - [2004/06/30 11:39:36 | 00,016,128 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS -- (APPDRV)
DRV - [2004/05/13 20:19:22 | 00,182,688 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\SynTP.sys -- (SynTP)
DRV - [2004/03/19 11:54:24 | 00,038,912 | R--- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\P2k.sys -- (P2k)
DRV - [2004/02/20 17:13:50 | 00,312,960 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\BCMWL5.SYS -- (BCM43XX)
DRV - [2004/02/13 11:46:00 | 00,017,153 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci)
DRV - [2004/01/02 11:44:22 | 00,044,032 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2003/08/29 06:59:24 | 01,101,696 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys -- (BCMModem)
DRV - [2001/08/17 15:07:44 | 00,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 15:07:42 | 00,030,688 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 15:07:40 | 00,028,384 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 15:07:36 | 00,032,640 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 15:07:34 | 00,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 14:52:22 | 00,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 14:52:20 | 00,045,312 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 14:52:20 | 00,040,320 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 14:52:18 | 00,049,024 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 14:52:16 | 00,179,584 | ---- | M] (Mylex Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 14:52:12 | 00,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 14:52:00 | 00,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 14:51:58 | 00,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 14:51:56 | 00,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 14:51:54 | 00,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
DRV - [2001/08/17 13:56:16 | 00,007,552 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\SONYPVU1.SYS -- (SONYPVU1) Sony USB Filter Driver (SONYPVU1)
DRV - [2001/08/17 13:12:10 | 00,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\E100B325.SYS -- (E100B) Intel(R)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (America Online, Inc.)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



O1 HOSTS File: (734 bytes) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll (Microsoft Corporation)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (UberButton Class) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo!)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\SYSTEM32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (YahooTaggedBM Class) - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll (Yahoo! Inc.)
O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (America Online, Inc.)
O2 - BHO: (no name) - {C2B5AAB8-2183-4be7-81A6-F11493C45872} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (America Online, Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (America Online, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AntiVirus Plus] File not found
O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS\SYSTEM32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxpers] C:\WINDOWS\SYSTEM32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxtray] C:\WINDOWS\SYSTEM32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [ISTray] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [winupdate86.exe] C:\WINDOWS\SYSTEM32\winupdate86.exe (TJbFla)
O4 - HKLM..\Run: [zehuwafob] C:\WINDOWS\System32\dirupahu.DLL ()
O4 - HKCU..\Run: [Google Update] C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)
O4 - HKCU..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe File not found
O4 - HKCU..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe File not found
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Documents and Settings\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnceEx: [] File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O8 - Extra context menu item: &AOL Toolbar Search - c:\Program Files\AOL\AOL Toolbar 2.0\resources\en-us\local\search.html ()
O8 - Extra context menu item: &Yahoo! Search - C:\Program Files\Yahoo!\Common [2009/11/25 20:11:09 | 00,000,000 | ---D | M]
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Yahoo! &Dictionary - C:\Program Files\Yahoo!\Common [2009/11/25 20:11:09 | 00,000,000 | ---D | M]
O8 - Extra context menu item: Yahoo! &Maps - C:\Program Files\Yahoo!\Common [2009/11/25 20:11:09 | 00,000,000 | ---D | M]
O8 - Extra context menu item: Yahoo! &SMS - C:\Program Files\Yahoo!\Common [2009/11/25 20:11:09 | 00,000,000 | ---D | M]
O9 - Extra Button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (America Online, Inc.)
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo!)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra Button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: parker.com ([polprod] https in Trusted sites)
O15 - HKCU\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll (Installation Support)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} https://upload.facebook.com/controls/FacebookPhotoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1123808924330 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} http://www.pcpitstop.com/mhLbl.cab (mhLabel Class)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab (ZoneIntro Class)
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.4.0/jinstall-1_4_0-windows-i586.cab (Java Plug-in 1.4.0)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab (Java Plug-in 1.5.0_04)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab (PopCapLoader Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} http://by107fd.bay107.hotmail.msn.com/activex/HMAtchmt.ocx (Hotmail Attachments Control)
O20 - AppInit_DLLs: (dowikabu.dll) - C:\WINDOWS\System32\dowikabu.dll ()
O20 - AppInit_DLLs: (c:\windows\system32\dirupahu.dll) - C:\WINDOWS\SYSTEM32\dirupahu.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (logon.exe) - C:\WINDOWS\System32\logon.exe ()
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\winlogon86.exe) - C:\WINDOWS\SYSTEM32\winlogon86.exe (TJbFla)
O20 - HKLM Winlogon: GinaDLL - (RtlGina2.dll) - C:\WINDOWS\System32\RtlGina2.dll ()
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O21 - SSODL: lemalezat - {3bec323f-7023-47f6-9240-6f2c5e692601} - CLSID or File not found.
O21 - SSODL: SwUpdate - {009541A0-3B00-1F1C-00F3-040224001C01} - C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\swupdate.dllget\flashplayer\current\polarbear\ultrashim.cab File not found
O21 - SSODL: vunodiguz - {f065e614-d020-4316-bd9b-c877b962bd41} - C:\WINDOWS\SYSTEM32\dirupahu.dll ()
O22 - SharedTaskScheduler: {3bec323f-7023-47f6-9240-6f2c5e692601} - mujuzedij - Reg Error: Key error. File not found
O22 - SharedTaskScheduler: {f065e614-d020-4316-bd9b-c877b962bd41} - kupuhivus - C:\WINDOWS\SYSTEM32\dirupahu.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 14:04:08 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{24c0009e-e2bb-11de-b514-000b7d199291}\Shell - "" = AutoRun
O33 - MountPoints2\{24c0009e-e2bb-11de-b514-000b7d199291}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{24c0009e-e2bb-11de-b514-000b7d199291}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O33 - MountPoints2\{c1c15677-b4a4-11dd-b363-0011436c0a69}\Shell\AutoRun\command - "" = setupSNK.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/01/08 13:16:52 | 00,513,536 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Steve Collins\Desktop\OTL.exe
[2010/01/08 12:23:02 | 05,061,520 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Steve Collins\Desktop\iexplore.exe
[2010/01/08 10:26:00 | 00,135,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\Copy (3) of TASKMGR.EXE
[2010/01/08 10:25:13 | 00,135,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\iexplore.EXE
[2010/01/08 10:23:15 | 00,135,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\Copy of TASKMGR.EXE
[2010/01/07 17:32:40 | 00,024,064 | ---- | C] (TJbFla) -- C:\WINDOWS\System32\winupdate86.exe
[2010/01/07 16:02:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Application Data\AntiVirus Plus
[2010/01/05 18:06:54 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/05 18:06:45 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/01/05 18:06:43 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/05 18:05:48 | 00,000,000 | ---D | C] -- C:\Program Files\TrendMicro
[2010/01/05 16:16:52 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\RegCure
[2010/01/05 16:16:51 | 00,000,000 | ---D | C] -- C:\Program Files\RegCure
[2010/01/05 14:11:03 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/05 13:39:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Threat Expert
[2010/01/05 13:04:18 | 01,640,400 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDCore.dll
[2010/01/05 13:04:18 | 00,165,840 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDRes.dll
[2010/01/05 13:04:18 | 00,149,456 | ---- | C] (PC Tools) -- C:\WINDOWS\SGDetectionTool.dll
[2010/01/05 13:04:10 | 00,233,136 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctgntdi.sys
[2010/01/05 13:03:54 | 00,207,792 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTCore.sys
[2010/01/05 13:03:54 | 00,087,784 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTAppEvent.sys
[2010/01/05 13:03:46 | 00,070,408 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctplsg.sys
[2010/01/05 13:03:39 | 00,000,000 | ---D | C] -- C:\Program Files\Spyware Doctor
[2010/01/05 13:03:39 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2010/01/05 13:03:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Application Data\PC Tools
[2010/01/05 13:03:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PC Tools
[2010/01/05 13:03:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/01/04 22:40:10 | 00,000,000 | ---D | C] -- C:\Program Files\InternetSecurity2010
[2010/01/04 22:24:08 | 00,024,064 | ---- | C] (TJbFla) -- C:\WINDOWS\System32\winlogon86.exe
[2010/01/04 22:23:57 | 00,044,544 | ---- | C] (tzuk) -- C:\afburr.exe
[2010/01/04 22:23:56 | 00,024,064 | ---- | C] (TJbFla) -- C:\khkil.exe
[2009/12/30 01:22:14 | 00,028,160 | ---- | C] (mst software GmbH, Germany) -- C:\WINDOWS\System32\DfSdkBt.exe
[2009/12/30 01:22:08 | 00,000,000 | ---D | C] -- C:\Program Files\Ashampoo
[2009/12/29 20:30:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Temp
[2009/12/24 14:55:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Application Data\Absolute Poker
[2009/12/24 14:55:00 | 00,000,000 | ---D | C] -- C:\Program Files\Absolute Poker
[2009/12/24 14:54:51 | 00,000,000 | ---D | C] -- C:\Program Files\_uninstallation_info
[2009/12/23 14:19:53 | 10,832,920 | ---- | C] (ashampoo GmbH & Co. KG ) -- C:\Documents and Settings\Steve Collins\Desktop\ashampoo_winoptimizer_2010_advanced_6[1].50_6644.exe
[2009/12/17 02:08:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Desktop\SLOT
[2009/12/17 01:03:22 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2009/12/17 00:05:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Desktop\tonys stuff
[2009/12/13 06:27:18 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe
[2009/12/12 23:50:52 | 00,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[2009/12/12 23:50:52 | 00,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2009/12/12 23:50:52 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2009/12/12 23:50:52 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2009/12/12 23:50:52 | 00,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2009/12/11 03:01:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Conduit
[2009/12/11 03:01:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\BS_Player
[2009/12/11 03:01:20 | 00,000,000 | ---D | C] -- C:\Program Files\BS_Player
[2009/12/11 03:01:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Application Data\BSplayer Pro
[2009/12/11 03:00:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Application Data\BSplayer
[2009/12/11 03:00:57 | 00,000,000 | ---D | C] -- C:\Program Files\Webteh
[2009/12/10 16:39:10 | 00,000,000 | ---D | C] -- C:\Program Files\RegistryFix8
[2009/12/06 16:57:20 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/12/06 15:38:47 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/12/06 15:38:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/12/06 15:38:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/12/06 14:24:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\AVG7
[2005/02/23 16:08:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\McAfee.com Personal Firewall
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2099/01/01 12:00:00 | 00,114,176 | -HS- | M] () -- C:\WINDOWS\System32\nudegoya.exe
[2099/01/01 12:00:00 | 00,093,696 | -HS- | M] () -- C:\WINDOWS\System32\dirupahu.dll
[2099/01/01 12:00:00 | 00,061,952 | -HS- | M] () -- C:\WINDOWS\System32\xnetini.kdd
[2099/01/01 12:00:00 | 00,061,952 | -HS- | M] () -- C:\WINDOWS\System32\kavunize.dll
[2099/01/01 12:00:00 | 00,053,760 | -HS- | M] () -- C:\WINDOWS\System32\wuleluzu.dll
[2099/01/01 12:00:00 | 00,053,760 | -HS- | M] () -- C:\WINDOWS\System32\nadojizu.dll
[2099/01/01 12:00:00 | 00,053,760 | -HS- | M] () -- C:\WINDOWS\System32\kejajumo.dll
[2099/01/01 12:00:00 | 00,053,760 | -HS- | M] () -- C:\WINDOWS\System32\dowikabu.dll
[2099/01/01 12:00:00 | 00,045,568 | -HS- | M] () -- C:\WINDOWS\System32\rugozeko.dll
[2099/01/01 12:00:00 | 00,045,568 | -HS- | M] () -- C:\WINDOWS\System32\kamideva.dll
[2099/01/01 12:00:00 | 00,039,424 | -HS- | M] () -- C:\WINDOWS\System32\zeginizo.dll
[2099/01/01 12:00:00 | 00,039,424 | -HS- | M] () -- C:\WINDOWS\System32\surosubo.dll
[2099/01/01 12:00:00 | 00,039,424 | -HS- | M] () -- C:\WINDOWS\System32\dakegopu.dll
[2099/01/01 12:00:00 | 00,002,048 | -HS- | M] () -- C:\WINDOWS\System32\haniyuga.dll
[2010/01/08 13:26:16 | 00,006,456 | -H-- | M] () -- C:\WINDOWS\System32\wijokipo
[2010/01/08 13:07:36 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Steve Collins\Desktop\OTL.exe
[2010/01/08 13:05:30 | 00,001,053 | ---- | M] () -- C:\WINDOWS\QUICKEN.INI
[2010/01/08 13:00:00 | 00,000,296 | ---- | M] () -- C:\WINDOWS\tasks\bwcpkovy.job
[2010/01/08 12:35:00 | 00,001,010 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2431532243-2449587419-2770306861-1006UA.job
[2010/01/08 12:29:00 | 00,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/01/08 11:34:51 | 00,095,360 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\atapi.sys
[2010/01/08 10:11:16 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\AVR10.exe
[2010/01/08 10:11:16 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\41.exe
[2010/01/08 10:11:12 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\winhelper86.dll
[2010/01/08 10:11:01 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL
[2010/01/08 10:09:39 | 00,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/01/08 10:09:39 | 00,000,394 | ---- | M] () -- C:\WINDOWS\tasks\RegCure Startup.job
[2010/01/08 10:09:26 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/01/08 10:09:23 | 00,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2010/01/08 10:09:20 | 53,519,1552 | -HS- | M] () -- C:\hiberfil.sys
[2010/01/08 08:48:43 | 05,578,752 | ---- | M] () -- C:\Documents and Settings\Steve Collins\ntuser.dat
[2010/01/08 08:48:43 | 00,000,278 | -HS- | M] () -- C:\Documents and Settings\Steve Collins\NTUSER.INI
[2010/01/08 01:00:17 | 00,002,599 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Desktop\HiJackThis.lnk
[2010/01/07 20:35:00 | 00,000,958 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2431532243-2449587419-2770306861-1006Core.job
[2010/01/07 16:15:48 | 05,061,520 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Steve Collins\Desktop\iexplore.exe
[2010/01/07 16:02:08 | 00,004,286 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Application Data\avp.ico
[2010/01/07 16:02:08 | 00,001,834 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Start Menu\Programs\Startup\AntiVirus Plus.lnk
[2010/01/07 16:02:08 | 00,001,834 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AntiVirus Plus.lnk
[2010/01/05 16:35:31 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\14265.exe
[2010/01/05 16:17:01 | 00,000,406 | ---- | M] () -- C:\WINDOWS\tasks\RegCure Program Check.job
[2010/01/05 16:16:58 | 00,000,388 | ---- | M] () -- C:\WINDOWS\tasks\RegCure.job
[2010/01/05 14:15:22 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\10563.exe
[2010/01/05 13:55:22 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\7480.exe
[2010/01/05 13:32:27 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\640.exe
[2010/01/05 13:12:26 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\1086.exe
[2010/01/05 13:03:49 | 00,001,643 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2010/01/05 05:30:57 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\12883.exe
[2010/01/05 05:10:57 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\5155.exe
[2010/01/05 04:50:57 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\22439.exe
[2010/01/04 23:34:26 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\15084.exe
[2010/01/04 22:54:31 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\18467.exe
[2010/01/04 22:30:43 | 00,000,419 | ---- | M] () -- C:\WINDOWS\System32\uses32.dat
[2010/01/04 22:30:43 | 00,000,100 | ---- | M] () -- C:\WINDOWS\System32\flags.ini
[2010/01/04 22:24:29 | 00,000,046 | ---- | M] () -- C:\p2hhr.bat
[2010/01/04 22:24:23 | 00,015,000 | ---- | M] () -- C:\WINDOWS\System32\nt9slkt.dll
[2010/01/04 22:24:10 | 00,000,001 | ---- | M] () -- C:\s
[2010/01/04 22:23:58 | 00,044,544 | ---- | M] (tzuk) -- C:\afburr.exe
[2010/01/04 22:23:58 | 00,024,064 | ---- | M] (TJbFla) -- C:\WINDOWS\System32\winupdate86.exe
[2010/01/04 22:23:58 | 00,024,064 | ---- | M] (TJbFla) -- C:\WINDOWS\System32\winlogon86.exe
[2010/01/04 22:23:58 | 00,024,064 | ---- | M] (TJbFla) -- C:\khkil.exe
[2010/01/04 22:23:55 | 00,052,736 | ---- | M] () -- C:\eujbmv.exe
[2010/01/04 22:23:54 | 00,027,136 | ---- | M] () -- C:\jdmhvwpg.exe
[2010/01/04 22:23:53 | 00,022,016 | ---- | M] () -- C:\vwylecru.exe
[2010/01/03 21:18:16 | 00,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2010/01/03 21:18:16 | 00,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for
[2009/12/31 17:42:19 | 06,291,456 | -H-- | M] () -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\IconCache.db
[2009/12/30 14:55:24 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/12/30 14:54:58 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/12/30 01:22:15 | 00,001,799 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\One-Click-Optimizer.lnk
[2009/12/30 01:22:15 | 00,000,861 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Ashampoo WinOptimizer 2010 Advanced.lnk
[2009/12/29 23:57:38 | 00,002,004 | ---- | M] () -- C:\Documents and Settings\Steve Collins\My Documents\1229 new.bsl
[2009/12/29 21:06:28 | 00,017,920 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/29 20:34:47 | 00,002,344 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Desktop\Google Chrome.lnk
[2009/12/29 19:56:06 | 00,001,536 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Desktop\NO$GBA.INP
[2009/12/29 09:26:19 | 05,141,504 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2009/12/29 09:26:19 | 03,897,344 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\ESBK.mb
[2009/12/24 15:05:27 | 00,000,734 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Desktop\Absolute Poker.lnk
[2009/12/24 14:53:50 | 00,002,955 | ---- | M] () -- C:\Documents and Settings\Steve Collins\My Documents\new@1.bsl
[2009/12/24 14:47:17 | 00,228,840 | ---- | M] () -- C:\Documents and Settings\Steve Collins\My Documents\AbsolutePoker_Setup.exe
[2009/12/23 14:19:53 | 10,832,920 | ---- | M] (ashampoo GmbH & Co. KG ) -- C:\Documents and Settings\Steve Collins\Desktop\ashampoo_winoptimizer_2010_advanced_6[1].50_6644.exe
[2009/12/17 00:09:43 | 00,000,040 | ---- | M] () -- C:\WINDOWS\nero.INI
[2009/12/13 07:25:12 | 00,004,836 | ---- | M] () -- C:\Documents and Settings\Steve Collins\My Documents\links to It's Always Sunny In Philadelphia.rtf
[2009/12/12 23:49:51 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[2009/12/12 23:49:51 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2009/12/12 23:49:51 | 00,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2009/12/12 23:49:51 | 00,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2009/12/12 23:49:51 | 00,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2009/12/12 20:15:01 | 00,000,775 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Desktop\BS.Player FREE.lnk
[2009/12/12 19:45:10 | 00,002,854 | ---- | M] () -- C:\WINDOWS\System32\critical_warning.html
[2009/12/11 18:30:00 | 00,000,366 | ---- | M] () -- C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (D7WK0V61-Steve Collins).job
[2009/12/10 16:46:02 | 00,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2099/01/01 12:00:00 | 00,114,176 | -HS- | C] () -- C:\WINDOWS\System32\nudegoya.exe
[2099/01/01 12:00:00 | 00,093,696 | -HS- | C] () -- C:\WINDOWS\System32\dirupahu.dll
[2099/01/01 12:00:00 | 00,061,952 | -HS- | C] () -- C:\WINDOWS\System32\xnetini.kdd
[2099/01/01 12:00:00 | 00,061,952 | -HS- | C] () -- C:\WINDOWS\System32\kavunize.dll
[2099/01/01 12:00:00 | 00,053,760 | -HS- | C] () -- C:\WINDOWS\System32\wuleluzu.dll
[2099/01/01 12:00:00 | 00,053,760 | -HS- | C] () -- C:\WINDOWS\System32\nadojizu.dll
[2099/01/01 12:00:00 | 00,053,760 | -HS- | C] () -- C:\WINDOWS\System32\kejajumo.dll
[2099/01/01 12:00:00 | 00,053,760 | -HS- | C] () -- C:\WINDOWS\System32\dowikabu.dll
[2099/01/01 12:00:00 | 00,045,568 | -HS- | C] () -- C:\WINDOWS\System32\rugozeko.dll
[2099/01/01 12:00:00 | 00,045,568 | -HS- | C] () -- C:\WINDOWS\System32\kamideva.dll
[2099/01/01 12:00:00 | 00,039,424 | -HS- | C] () -- C:\WINDOWS\System32\zeginizo.dll
[2099/01/01 12:00:00 | 00,039,424 | -HS- | C] () -- C:\WINDOWS\System32\surosubo.dll
[2099/01/01 12:00:00 | 00,039,424 | -HS- | C] () -- C:\WINDOWS\System32\dakegopu.dll
[2099/01/01 12:00:00 | 00,006,456 | -H-- | C] () -- C:\WINDOWS\System32\wijokipo
[2099/01/01 12:00:00 | 00,002,048 | -HS- | C] () -- C:\WINDOWS\System32\haniyuga.dll
[2010/01/08 10:11:16 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\AVR10.exe
[2010/01/07 16:05:28 | 00,002,599 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Desktop\HiJackThis.lnk
[2010/01/07 16:02:08 | 00,004,286 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Application Data\avp.ico
[2010/01/07 16:02:08 | 00,001,834 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Start Menu\Programs\Startup\AntiVirus Plus.lnk
[2010/01/07 16:02:08 | 00,001,834 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AntiVirus Plus.lnk
[2010/01/07 16:01:12 | 00,000,296 | ---- | C] () -- C:\WINDOWS\tasks\bwcpkovy.job
[2010/01/05 16:35:31 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\14265.exe
[2010/01/05 16:16:59 | 00,000,406 | ---- | C] () -- C:\WINDOWS\tasks\RegCure Program Check.job
[2010/01/05 16:16:58 | 00,000,394 | ---- | C] () -- C:\WINDOWS\tasks\RegCure Startup.job
[2010/01/05 16:16:57 | 00,000,388 | ---- | C] () -- C:\WINDOWS\tasks\RegCure.job
[2010/01/05 14:15:22 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\10563.exe
[2010/01/05 13:55:22 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\7480.exe
[2010/01/05 13:32:27 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\640.exe
[2010/01/05 13:12:26 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\1086.exe
[2010/01/05 13:04:19 | 00,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll
[2010/01/05 13:04:18 | 01,152,444 | ---- | C] () -- C:\WINDOWS\UDB.zip
[2010/01/05 13:04:18 | 00,000,882 | ---- | C] () -- C:\WINDOWS\RegSDImport.xml
[2010/01/05 13:04:18 | 00,000,880 | ---- | C] () -- C:\WINDOWS\RegISSImport.xml
[2010/01/05 13:04:18 | 00,000,131 | ---- | C] () -- C:\WINDOWS\IDB.zip
[2010/01/05 13:04:10 | 00,007,387 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctgntdi.cat
[2010/01/05 13:03:54 | 00,007,412 | ---- | C] () -- C:\WINDOWS\System32\drivers\PCTAppEvent.cat
[2010/01/05 13:03:54 | 00,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctcore.cat
[2010/01/05 13:03:49 | 00,001,643 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2010/01/05 13:03:46 | 00,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctplsg.cat
[2010/01/05 05:30:57 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\12883.exe
[2010/01/05 05:10:57 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\5155.exe
[2010/01/05 04:50:57 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\22439.exe
[2010/01/05 04:30:57 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\41.exe
[2010/01/04 23:34:26 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\15084.exe
[2010/01/04 22:54:31 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\18467.exe
[2010/01/04 22:30:43 | 00,000,419 | ---- | C] () -- C:\WINDOWS\System32\uses32.dat
[2010/01/04 22:30:43 | 00,000,100 | ---- | C] () -- C:\WINDOWS\System32\flags.ini
[2010/01/04 22:25:48 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\winhelper86.dll
[2010/01/04 22:24:29 | 00,000,046 | ---- | C] () -- C:\p2hhr.bat
[2010/01/04 22:24:23 | 00,015,000 | ---- | C] () -- C:\WINDOWS\System32\nt9slkt.dll
[2010/01/04 22:24:10 | 00,000,001 | ---- | C] () -- C:\s
[2010/01/04 22:23:54 | 00,052,736 | ---- | C] () -- C:\eujbmv.exe
[2010/01/04 22:23:53 | 00,027,136 | ---- | C] () -- C:\jdmhvwpg.exe
[2010/01/04 22:23:52 | 00,022,016 | ---- | C] () -- C:\vwylecru.exe
[2010/01/03 21:18:16 | 00,054,156 | -H-- | C] () -- C:\WINDOWS\QTFont.qfn
[2010/01/03 21:18:16 | 00,001,409 | ---- | C] () -- C:\WINDOWS\QTFont.for
[2009/12/30 01:22:15 | 00,001,799 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\One-Click-Optimizer.lnk
[2009/12/30 01:22:15 | 00,000,861 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Ashampoo WinOptimizer 2010 Advanced.lnk
[2009/12/29 23:57:38 | 00,002,004 | ---- | C] () -- C:\Documents and Settings\Steve Collins\My Documents\1229 new.bsl
[2009/12/29 20:34:47 | 00,002,344 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Desktop\Google Chrome.lnk
[2009/12/29 20:30:34 | 00,001,010 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2431532243-2449587419-2770306861-1006UA.job
[2009/12/29 20:30:33 | 00,000,958 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2431532243-2449587419-2770306861-1006Core.job
[2009/12/24 15:05:27 | 00,000,734 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Desktop\Absolute Poker.lnk
[2009/12/24 14:53:50 | 00,002,955 | ---- | C] () -- C:\Documents and Settings\Steve Collins\My Documents\new@1.bsl
[2009/12/24 14:47:11 | 00,228,840 | ---- | C] () -- C:\Documents and Settings\Steve Collins\My Documents\AbsolutePoker_Setup.exe
[2009/12/13 13:25:05 | 00,609,726 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Desktop\102_1633.JPG
[2009/12/12 21:56:47 | 00,004,836 | ---- | C] () -- C:\Documents and Settings\Steve Collins\My Documents\links to It's Always Sunny In Philadelphia.rtf
[2009/12/12 20:15:01 | 00,000,775 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Desktop\BS.Player FREE.lnk
[2009/12/10 16:46:02 | 00,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009/12/09 14:30:42 | 05,578,752 | ---- | C] () -- C:\Documents and Settings\Steve Collins\ntuser.dat
[2009/11/20 14:55:50 | 00,036,864 | ---- | C] () -- C:\WINDOWS\System32\RtlGina2.dll
[2009/11/20 14:55:48 | 00,966,765 | ---- | C] () -- C:\WINDOWS\System32\acAuth.dll
[2009/11/20 14:55:47 | 00,356,352 | ---- | C] () -- C:\WINDOWS\System32\SCMLib.dll
[2009/11/18 06:55:16 | 00,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
[2009/08/21 14:42:28 | 00,000,034 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2008/11/20 16:18:03 | 00,044,544 | ---- | C] () -- C:\WINDOWS\System32\gif89.dll
[2008/11/20 16:17:20 | 00,000,474 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2007/11/27 15:23:18 | 00,000,000 | ---- | C] () -- C:\WINDOWS\browser.INI
[2007/06/29 20:04:25 | 00,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
[2007/06/29 10:48:20 | 00,000,047 | ---- | C] () -- C:\WINDOWS\SPIDERCM.INI
[2007/05/22 18:15:22 | 00,000,027 | ---- | C] () -- C:\WINDOWS\INTUIT.INI
[2007/05/10 20:45:21 | 00,000,185 | ---- | C] () -- C:\WINDOWS\intuprof.ini
[2007/05/10 20:45:13 | 00,001,053 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
[2006/02/12 17:56:03 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/12/28 13:07:52 | 00,045,056 | R--- | C] () -- C:\Program Files\SetAttrib.exe
[2005/06/23 02:41:00 | 00,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2005/06/23 02:41:00 | 00,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2005/06/23 02:41:00 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2005/06/23 02:41:00 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2005/06/23 02:41:00 | 00,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2005/06/23 02:41:00 | 00,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2005/06/23 02:40:26 | 00,122,880 | ---- | C] () -- C:\WINDOWS\System32\cddvdint.dll
[2005/06/20 03:30:10 | 00,000,141 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2005/02/26 16:29:19 | 00,196,608 | ---- | C] () -- C:\WINDOWS\System32\avisynth.dll
[2005/02/26 16:17:13 | 00,017,920 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/02/26 13:22:07 | 00,000,136 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\fusioncache.dat
[2005/02/24 19:19:15 | 00,003,654 | ---- | C] () -- C:\WINDOWS\System32\drivers\Sonyhcp.dll
[2005/02/24 18:31:15 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/02/23 21:06:10 | 00,000,040 | ---- | C] () -- C:\WINDOWS\nero.INI
[2005/02/23 18:20:08 | 00,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2005/02/23 16:07:51 | 00,000,004 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Application Data\QSPMShare
[2005/02/18 01:31:26 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/02/18 01:21:40 | 00,000,264 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/02/18 01:13:50 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
[2005/02/18 00:23:14 | 00,000,517 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/09/15 22:49:44 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/08/10 14:13:12 | 00,000,780 | ---- | C] () -- C:\WINDOWS\ORUN32.INI
[2001/09/17 14:20:02 | 00,009,216 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2000/09/08 16:53:50 | 00,073,839 | ---- | C] () -- C:\WINDOWS\System32\KodakOneTouch.dll
[1998/08/16 06:00:00 | 00,004,096 | ---- | C] () -- C:\WINDOWS\System32\sysres.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 186 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
< End of report >

Please run OTL.exe.

• Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :OTL
  O2 - BHO: (no name) - {C2B5AAB8-2183-4be7-81A6-F11493C45872} - No CLSID value found.
  O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
  O4 - HKLM..\Run: [AntiVirus Plus] File not found
  O4 - HKLM..\Run: [winupdate86.exe] C:\WINDOWS\SYSTEM32\winupdate86.exe (TJbFla)
  O4 - HKLM..\Run: [zehuwafob] C:\WINDOWS\System32\dirupahu.DLL ()
  O4 - HKCU..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe File not found
  O4 - HKLM..\RunOnceEx: [] File not found
  O20 - AppInit_DLLs: (dowikabu.dll) - C:\WINDOWS\System32\dowikabu.dll ()
  O20 - AppInit_DLLs: (c:\windows\system32\dirupahu.dll) - C:\WINDOWS\SYSTEM32\dirupahu.dll ()
  O20 - HKLM Winlogon: Shell - (logon.exe) - C:\WINDOWS\System32\logon.exe ()
  O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\winlogon86.exe) - C:\WINDOWS\SYSTEM32\winlogon86.exe (TJbFla)
  O20 - HKLM Winlogon: GinaDLL - (RtlGina2.dll) - C:\WINDOWS\System32\RtlGina2.dll ()
  O21 - SSODL: lemalezat - {3bec323f-7023-47f6-9240-6f2c5e692601} - CLSID or File not found.
  O21 - SSODL: vunodiguz - {f065e614-d020-4316-bd9b-c877b962bd41} - C:\WINDOWS\SYSTEM32\dirupahu.dll ()
  O22 - SharedTaskScheduler: {3bec323f-7023-47f6-9240-6f2c5e692601} - mujuzedij - Reg Error: Key error. File not found
  O22 - SharedTaskScheduler: {f065e614-d020-4316-bd9b-c877b962bd41} - kupuhivus - C:\WINDOWS\SYSTEM32\dirupahu.dll ()
  O33 - MountPoints2\{24c0009e-e2bb-11de-b514-000b7d199291}\Shell - "" = AutoRun
  O33 - MountPoints2\{24c0009e-e2bb-11de-b514-000b7d199291}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{24c0009e-e2bb-11de-b514-000b7d199291}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
  O33 - MountPoints2\{c1c15677-b4a4-11dd-b363-0011436c0a69}\Shell\AutoRun\command - "" = setupSNK.exe
  O33 - MountPoints2\E\Shell - "" = AutoRun
  O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
  [2010/01/04 22:40:10 | 00,000,000 | ---D | C] -- C:\Program Files\InternetSecurity2010
  [2010/01/04 22:24:08 | 00,024,064 | ---- | C] (TJbFla) -- C:\WINDOWS\System32\winlogon86.exe
  [2010/01/04 22:23:57 | 00,044,544 | ---- | C] (tzuk) -- C:\afburr.exe
  [2010/01/04 22:23:56 | 00,024,064 | ---- | C] (TJbFla) -- C:\khkil.exe
  [2009/12/30 01:22:14 | 00,028,160 | ---- | C] (mst software GmbH, Germany) -- C:\WINDOWS\System32\DfSdkBt.exe
  [2099/01/01 12:00:00 | 00,114,176 | -HS- | M] () -- C:\WINDOWS\System32\nudegoya.exe
  [2099/01/01 12:00:00 | 00,093,696 | -HS- | M] () -- C:\WINDOWS\System32\dirupahu.dll
  [2099/01/01 12:00:00 | 00,061,952 | -HS- | M] () -- C:\WINDOWS\System32\xnetini.kdd
  [2099/01/01 12:00:00 | 00,061,952 | -HS- | M] () -- C:\WINDOWS\System32\kavunize.dll
  [2099/01/01 12:00:00 | 00,053,760 | -HS- | M] () -- C:\WINDOWS\System32\wuleluzu.dll
  [2099/01/01 12:00:00 | 00,053,760 | -HS- | M] () -- C:\WINDOWS\System32\nadojizu.dll
  [2099/01/01 12:00:00 | 00,053,760 | -HS- | M] () -- C:\WINDOWS\System32\kejajumo.dll
  [2099/01/01 12:00:00 | 00,053,760 | -HS- | M] () -- C:\WINDOWS\System32\dowikabu.dll
  [2099/01/01 12:00:00 | 00,045,568 | -HS- | M] () -- C:\WINDOWS\System32\rugozeko.dll
  [2099/01/01 12:00:00 | 00,045,568 | -HS- | M] () -- C:\WINDOWS\System32\kamideva.dll
  [2099/01/01 12:00:00 | 00,039,424 | -HS- | M] () -- C:\WINDOWS\System32\zeginizo.dll
  [2099/01/01 12:00:00 | 00,039,424 | -HS- | M] () -- C:\WINDOWS\System32\surosubo.dll
  [2099/01/01 12:00:00 | 00,039,424 | -HS- | M] () -- C:\WINDOWS\System32\dakegopu.dll
  [2099/01/01 12:00:00 | 00,002,048 | -HS- | M] () -- C:\WINDOWS\System32\haniyuga.dll
  [2010/01/08 13:26:16 | 00,006,456 | -H-- | M] () -- C:\WINDOWS\System32\wijokipo
  [2010/01/08 13:00:00 | 00,000,296 | ---- | M] () -- C:\WINDOWS\tasks\bwcpkovy.job
  [2010/01/08 10:11:16 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\AVR10.exe
  [2010/01/08 10:11:16 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\41.exe
  [2010/01/08 10:11:12 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\winhelper86.dll
  [2010/01/07 16:02:08 | 00,001,834 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Start Menu\Programs\Startup\AntiVirus Plus.lnk
  [2010/01/07 16:02:08 | 00,001,834 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AntiVirus Plus.lnk
  [2010/01/05 16:35:31 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\14265.exe
  [2010/01/05 14:15:22 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\10563.exe
  [2010/01/05 13:55:22 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\7480.exe
  [2010/01/05 13:32:27 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\640.exe
  [2010/01/05 13:12:26 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\1086.exe
  [2010/01/05 05:30:57 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\12883.exe
  [2010/01/05 05:10:57 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\5155.exe
  [2010/01/05 04:50:57 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\22439.exe
  [2010/01/04 23:34:26 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\15084.exe
  [2010/01/04 22:54:31 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\18467.exe
  [2010/01/04 22:30:43 | 00,000,419 | ---- | M] () -- C:\WINDOWS\System32\uses32.dat
  [2010/01/04 22:30:43 | 00,000,100 | ---- | M] () -- C:\WINDOWS\System32\flags.ini
  [2010/01/04 22:24:29 | 00,000,046 | ---- | M] () -- C:\p2hhr.bat
  [2010/01/04 22:24:23 | 00,015,000 | ---- | M] () -- C:\WINDOWS\System32\nt9slkt.dll
  [2010/01/04 22:24:10 | 00,000,001 | ---- | M] () -- C:\s
  [2010/01/04 22:23:58 | 00,044,544 | ---- | M] (tzuk) -- C:\afburr.exe
  [2010/01/04 22:23:58 | 00,024,064 | ---- | M] (TJbFla) -- C:\WINDOWS\System32\winupdate86.exe
  [2010/01/04 22:23:58 | 00,024,064 | ---- | M] (TJbFla) -- C:\WINDOWS\System32\winlogon86.exe
  [2010/01/04 22:23:58 | 00,024,064 | ---- | M] (TJbFla) -- C:\khkil.exe
  [2010/01/04 22:23:55 | 00,052,736 | ---- | M] () -- C:\eujbmv.exe
  [2010/01/04 22:23:54 | 00,027,136 | ---- | M] () -- C:\jdmhvwpg.exe
  [2010/01/04 22:23:53 | 00,022,016 | ---- | M] () -- C:\vwylecru.exe
  [2009/12/12 19:45:10 | 00,002,854 | ---- | M] () -- C:\WINDOWS\System32\critical_warning.html
  
  
  
  
• Return to OTL, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.
  
  
• Click the red Run Fix button.
  
• A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTL.exe
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2B5AAB8-2183-4be7-81A6-F11493C45872}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C2B5AAB8-2183-4be7-81A6-F11493C45872}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{BA52B914-B692-46c4-B683-905236F6F655} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BA52B914-B692-46c4-B683-905236F6F655}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\AntiVirus Plus deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\winupdate86.exe deleted successfully.
C:\WINDOWS\SYSTEM32\winupdate86.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\zehuwafob deleted successfully.
C:\WINDOWS\SYSTEM32\dirupahu.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Internet Security 2010 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:dowikabu.dll deleted successfully.
C:\WINDOWS\SYSTEM32\dowikabu.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\windows\system32\dirupahu.dll deleted successfully.
File C:\WINDOWS\SYSTEM32\dirupahu.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:logon.exe deleted successfully.
C:\WINDOWS\SYSTEM32\logon.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\WINDOWS\system32\winlogon86.exe deleted successfully.
C:\WINDOWS\SYSTEM32\winlogon86.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\GinaDLL:RtlGina2.dll deleted successfully.
C:\WINDOWS\SYSTEM32\RtlGina2.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\lemalezat deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3bec323f-7023-47f6-9240-6f2c5e692601}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\vunodiguz deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f065e614-d020-4316-bd9b-c877b962bd41}\ deleted successfully.
File C:\WINDOWS\SYSTEM32\dirupahu.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{3bec323f-7023-47f6-9240-6f2c5e692601} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3bec323f-7023-47f6-9240-6f2c5e692601}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{f065e614-d020-4316-bd9b-c877b962bd41} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f065e614-d020-4316-bd9b-c877b962bd41}\ deleted successfully.
File C:\WINDOWS\SYSTEM32\dirupahu.dll not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{24c0009e-e2bb-11de-b514-000b7d199291}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24c0009e-e2bb-11de-b514-000b7d199291}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{24c0009e-e2bb-11de-b514-000b7d199291}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24c0009e-e2bb-11de-b514-000b7d199291}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{24c0009e-e2bb-11de-b514-000b7d199291}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24c0009e-e2bb-11de-b514-000b7d199291}\ not found.
File E:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c1c15677-b4a4-11dd-b363-0011436c0a69}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c1c15677-b4a4-11dd-b363-0011436c0a69}\ not found.
File setupSNK.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.
File E:\LaunchU3.exe not found.
C:\Program Files\InternetSecurity2010 folder moved successfully.
File C:\WINDOWS\System32\winlogon86.exe not found.
C:\afburr.exe moved successfully.
C:\khkil.exe moved successfully.
C:\WINDOWS\SYSTEM32\DfSdkBt.exe moved successfully.
C:\WINDOWS\SYSTEM32\nudegoya.exe moved successfully.
File C:\WINDOWS\System32\dirupahu.dll not found.
C:\WINDOWS\SYSTEM32\xnetini.kdd moved successfully.
C:\WINDOWS\SYSTEM32\kavunize.dll moved successfully.
C:\WINDOWS\SYSTEM32\wuleluzu.dll moved successfully.
C:\WINDOWS\SYSTEM32\nadojizu.dll moved successfully.
C:\WINDOWS\SYSTEM32\kejajumo.dll moved successfully.
File C:\WINDOWS\System32\dowikabu.dll not found.
C:\WINDOWS\SYSTEM32\rugozeko.dll moved successfully.
C:\WINDOWS\SYSTEM32\kamideva.dll moved successfully.
C:\WINDOWS\SYSTEM32\zeginizo.dll moved successfully.
C:\WINDOWS\SYSTEM32\surosubo.dll moved successfully.
C:\WINDOWS\SYSTEM32\dakegopu.dll moved successfully.
C:\WINDOWS\SYSTEM32\haniyuga.dll moved successfully.
C:\WINDOWS\SYSTEM32\wijokipo moved successfully.
C:\WINDOWS\tasks\bwcpkovy.job moved successfully.
C:\WINDOWS\SYSTEM32\AVR10.exe moved successfully.
C:\WINDOWS\SYSTEM32\41.exe moved successfully.
C:\WINDOWS\SYSTEM32\winhelper86.dll moved successfully.
C:\Documents and Settings\Steve Collins\Start Menu\Programs\Startup\AntiVirus Plus.lnk moved successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AntiVirus Plus.lnk moved successfully.
C:\WINDOWS\SYSTEM32\14265.exe moved successfully.
C:\WINDOWS\SYSTEM32\10563.exe moved successfully.
C:\WINDOWS\SYSTEM32\7480.exe moved successfully.
C:\WINDOWS\SYSTEM32\640.exe moved successfully.
C:\WINDOWS\SYSTEM32\1086.exe moved successfully.
C:\WINDOWS\SYSTEM32\12883.exe moved successfully.
C:\WINDOWS\SYSTEM32\5155.exe moved successfully.
C:\WINDOWS\SYSTEM32\22439.exe moved successfully.
C:\WINDOWS\SYSTEM32\15084.exe moved successfully.
C:\WINDOWS\SYSTEM32\18467.exe moved successfully.
C:\WINDOWS\SYSTEM32\uses32.dat moved successfully.
C:\WINDOWS\SYSTEM32\flags.ini moved successfully.
C:\p2hhr.bat moved successfully.
C:\WINDOWS\SYSTEM32\nt9slkt.dll moved successfully.
C:\s moved successfully.
File C:\afburr.exe not found.
File C:\WINDOWS\System32\winupdate86.exe not found.
File C:\WINDOWS\System32\winlogon86.exe not found.
File C:\khkil.exe not found.
C:\eujbmv.exe moved successfully.
C:\jdmhvwpg.exe moved successfully.
C:\vwylecru.exe moved successfully.
C:\WINDOWS\SYSTEM32\critical_warning.html moved successfully.

OTL by OldTimer - Version 3.1.21.2 log created on 01082010_143955

should i have spywaredoctor on it is should i close it it found 147 ifections this morning.

Let it remove what it found, then try running Combofix now we've dented it.

my internet will work on that one?

im on my uncles computer.

Are you asking if the internet will work on the infected machine? if so, logs don't show any proxy so there's no reason why it shouldn't, but anything is possible when it comes to malware infections.

on this computer download combofix.

Yes.

now what

Has Combofix completed it's run? if so, post the log.

no didnt know if that was what you wanted doing it right now

Okay.

ran combofix and it said open with witch program and i clicked notepad but its a bunch of text not like the others what do i do and should i have spyware doctor running

Close Spyware Doctor, Combofix opens with the "open with" window?

Please download exeHelper from one of the two links.
Link 1
Link 2

• Double-click on exeHelper.com or exeHelper.scr to run the fix.
  
• A black window should pop up, press any key to close once the fix is completed.
  
• Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)
  

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

Try run Combofix now.

my computer slowing down and loading your last message with exe. app.

got the exehelper from this computer be back with the log.

exehelper made a log saved it but i ran combofix and was going to reboot but it said these real time scanners close before you hit ok or something of that nature
spywaredoctor 7
2avgantivirus
what now?

You need to disable AVG and spyware doctor. Read my instructions in my post on page 1, it has info on disabling your AV.
http://www.geekpolice.net/virus-spyware-malware-removal-f11/internet-security-2010-yeah-t17848.htm#113505

sorry heres the log for exe just keep running up and down the stairs good workout though.

exeHelper by Raktor
Build 20091220
Run at 16:07:00 on 01/08/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

Thanks.
exeHelper just resets the file association for exe files, to fix the "run with..." box so you can run Combofix.
Standing by for the log file.

if to do it up stairs to get your disable av link might be a min.

both computers wont goto that link can you copy and paste or just tell me how to do it.

Both computers wont go to the bleepingcomputer link?

now it will load your site but it has the green 3 bars for wifi but i go's away when i try that site

Re-run OTL and post OTL.txt only.

ok be back.

OTL logfile created on: 1/8/2010 4:48:03 PM - Run 2
OTL by OldTimer - Version 3.1.21.2 Folder = C:\Documents and Settings\Steve Collins\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 221.00 Mb Available Physical Memory | 43.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 52.86 Gb Total Space | 39.31 Gb Free Space | 74.37% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: INSPIRON1150
Current User Name: Steve Collins
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/01/08 16:08:05 | 00,388,608 | ---- | M] (Microsoft Corporation) -- C:\32788R22FWJFW\cmd.cfxxe
PRC - [2010/01/08 13:07:36 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Steve Collins\Desktop\OTL.exe
PRC - [2008/11/09 15:48:14 | 00,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2007/06/13 05:23:07 | 01,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004/08/04 06:00:00 | 00,093,184 | -HS- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\IEXPLORE.EXE


========== Modules (SafeList) ==========

MOD - [2099/01/01 12:00:00 | 00,093,696 | -HS- | M] () -- C:\WINDOWS\SYSTEM32\yavayusa.dll
MOD - [2010/01/08 13:07:36 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Steve Collins\Desktop\OTL.exe
MOD - [2009/12/13 00:47:25 | 00,081,920 | ---- | M] (Adobe Systems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\swupdate.dll
MOD - [2009/10/30 11:18:16 | 00,147,024 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\PCTGMhk.dll
MOD - [2009/09/09 22:54:58 | 00,155,184 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\smum32.dll
MOD - [2006/08/25 10:45:55 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/12/12 23:49:52 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Stopped] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009/11/10 10:28:08 | 00,112,592 | ---- | M] (Threat Expert Ltd.) [Auto | Stopped] -- C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)
SRV - [2009/11/06 14:29:22 | 01,141,712 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files\Spyware Doctor\pctsSvc.exe -- (sdCoreService)
SRV - [2009/10/30 11:18:16 | 00,359,624 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)
SRV - [2009/08/24 21:16:36 | 00,406,016 | ---- | M] (mst software GmbH, Germany) [On_Demand | Stopped] -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\Dfsdks.exe -- (DfSdkS)
SRV - [2009/01/18 08:13:50 | 00,418,816 | ---- | M] (GRISOFT, s.r.o.) [Auto | Stopped] -- C:\Program Files\Grisoft\AVG Free\avgamsvr.exe -- (Avg7Alrt)
SRV - [2008/11/09 15:48:14 | 00,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2007/04/03 07:11:35 | 00,049,664 | ---- | M] (GRISOFT, s.r.o.) [Auto | Stopped] -- C:\Program Files\Grisoft\AVG Free\avgupsvc.exe -- (Avg7UpdSvc)
SRV - [2005/12/20 20:54:34 | 00,323,584 | ---- | M] (Apple Computer, Inc.) [On_Demand | Stopped] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPodService)
SRV - [2005/04/04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005/03/30 15:46:56 | 00,411,920 | ---- | M] (Eastman Kodak Company) [On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\KodakCCS.exe -- (KodakCCS)
SRV - [2004/02/20 17:14:04 | 00,045,056 | ---- | M] () [Disabled | Stopped] -- C:\WINDOWS\System32\WLTRYSVC.EXE -- (WLTRYSVC)
SRV - [2004/01/06 11:47:06 | 00,327,792 | ---- | M] (Executive Software International, Inc.) [Auto | Stopped] -- C:\Program Files\Executive Software\Diskeeper\DkService.exe -- (Diskeeper)


========== Driver Services (SafeList) ==========

DRV - [2009/11/20 14:56:02 | 00,021,035 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\AegisP.sys -- (AegisP) AEGIS Protocol (IEEE 802.1x)
DRV - [2009/11/09 11:20:12 | 00,207,792 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\PCTCore.sys -- (PCTCore)
DRV - [2009/01/18 08:14:02 | 00,010,760 | ---- | M] (GRISOFT, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgclean.sys -- (AvgClean)
DRV - [2009/01/18 08:13:44 | 00,821,856 | ---- | M] (GRISOFT, s.r.o.) [Kernel | System | Stopped] -- C:\WINDOWS\System32\Drivers\avg7core.sys -- (Avg7Core)
DRV - [2007/11/13 05:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\secdrv.sys -- (Secdrv)
DRV - [2007/04/03 07:12:22 | 00,027,776 | ---- | M] (GRISOFT, s.r.o.) [Kernel | System | Stopped] -- C:\WINDOWS\System32\Drivers\avg7rsxp.sys -- (Avg7RsXP)
DRV - [2007/04/03 07:12:22 | 00,004,224 | ---- | M] (GRISOFT, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avg7rsw.sys -- (Avg7RsW)
DRV - [2007/04/03 07:11:40 | 00,004,960 | ---- | M] (GRISOFT, s.r.o.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\avgtdi.sys -- (AvgTdi)
DRV - [2005/09/20 09:00:54 | 01,302,332 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ialmnt5.sys -- (ialm)
DRV - [2005/06/16 13:41:02 | 00,037,150 | ---- | M] (Eastman Kodak Company) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\DcCam.sys -- (DcCam)
DRV - [2005/04/01 11:43:02 | 00,066,048 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\EAPPkt.sys -- (EAPPkt)
DRV - [2005/03/31 07:00:08 | 00,152,081 | ---- | M] (Eastman Kodak Company) [Kernel | System | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\ExportIt.sys -- (Exportit)
DRV - [2005/03/31 06:47:56 | 00,070,262 | ---- | M] (Eastman Kodak Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\DcPtp.sys -- (DcPTP)
DRV - [2005/03/31 06:47:50 | 00,008,022 | ---- | M] (Eastman Kodak Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\DcLps.sys -- (DcLps)
DRV - [2005/03/31 06:47:48 | 00,038,673 | ---- | M] (Eastman Kodak Company) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\DCFS2k.sys -- (DCFS2K)
DRV - [2005/03/31 06:47:42 | 00,061,564 | ---- | M] (Eastman Kodak Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\DcFpoint.sys -- (DcFpoint)
DRV - [2005/02/18 01:28:33 | 00,008,552 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\asctrm.sys -- (ASCTRM)
DRV - [2005/02/18 01:16:15 | 00,015,781 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mdc8021x.sys -- (MDC8021X) AEGIS Protocol (IEEE 802.1x)
DRV - [2005/02/02 01:21:04 | 00,014,408 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2004/12/01 03:22:00 | 00,087,488 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\drvmcdb.sys -- (drvmcdb)
DRV - [2004/11/23 02:56:00 | 00,040,480 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\drvnddm.sys -- (drvnddm)
DRV - [2004/11/16 01:05:00 | 00,100,603 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnudfa.sys -- (tfsnudfa)
DRV - [2004/11/16 01:05:00 | 00,098,714 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnudf.sys -- (tfsnudf)
DRV - [2004/11/16 01:05:00 | 00,086,554 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnifs.sys -- (tfsnifs)
DRV - [2004/11/16 01:05:00 | 00,034,843 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsncofs.sys -- (tfsncofs)
DRV - [2004/11/16 01:05:00 | 00,025,883 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnboio.sys -- (tfsnboio)
DRV - [2004/11/16 01:05:00 | 00,015,227 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnopio.sys -- (tfsnopio)
DRV - [2004/11/16 01:05:00 | 00,006,363 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnpool.sys -- (tfsnpool)
DRV - [2004/11/16 01:05:00 | 00,004,123 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsndrct.sys -- (tfsndrct)
DRV - [2004/11/16 01:05:00 | 00,002,239 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsndres.sys -- (tfsndres)
DRV - [2004/11/15 16:37:52 | 00,264,440 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\stac97.sys -- (STAC97) Audio Driver (WDM)
DRV - [2004/09/23 01:03:00 | 00,020,576 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20)
DRV - [2004/08/04 06:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\PTILINK.SYS -- (Ptilink)
DRV - [2004/08/04 00:07:44 | 00,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2004/08/04 00:07:44 | 00,041,088 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2004/08/03 23:29:56 | 01,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\NV4_MINI.SYS -- (nv)
DRV - [2004/08/03 23:08:44 | 00,025,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\usbser.sys -- (usbser)
DRV - [2004/07/14 11:29:04 | 00,005,627 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\sscdbhk5.sys -- (sscdbhk5)
DRV - [2004/07/14 11:28:50 | 00,023,545 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ssrtln.sys -- (ssrtln)
DRV - [2004/06/30 11:39:36 | 00,016,128 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS -- (APPDRV)
DRV - [2004/05/13 20:19:22 | 00,182,688 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\SynTP.sys -- (SynTP)
DRV - [2004/03/19 11:54:24 | 00,038,912 | R--- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\P2k.sys -- (P2k)
DRV - [2004/02/20 17:13:50 | 00,312,960 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\BCMWL5.SYS -- (BCM43XX)
DRV - [2004/02/13 11:46:00 | 00,017,153 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci)
DRV - [2004/01/02 11:44:22 | 00,044,032 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2003/08/29 06:59:24 | 01,101,696 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys -- (BCMModem)
DRV - [2001/08/17 15:07:44 | 00,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 15:07:42 | 00,030,688 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 15:07:40 | 00,028,384 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 15:07:36 | 00,032,640 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 15:07:34 | 00,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 14:52:22 | 00,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 14:52:20 | 00,045,312 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 14:52:20 | 00,040,320 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 14:52:18 | 00,049,024 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 14:52:16 | 00,179,584 | ---- | M] (Mylex Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 14:52:12 | 00,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 14:52:00 | 00,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 14:51:58 | 00,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 14:51:56 | 00,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 14:51:54 | 00,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
DRV - [2001/08/17 13:56:16 | 00,007,552 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\SONYPVU1.SYS -- (SONYPVU1) Sony USB Filter Driver (SONYPVU1)
DRV - [2001/08/17 13:12:10 | 00,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\E100B325.SYS -- (E100B) Intel(R)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (America Online, Inc.)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



O1 HOSTS File: (734 bytes) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll (Microsoft Corporation)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (no name) - {32617793-570d-47d5-972a-cfabc51ca61a} - File not found
O2 - BHO: (UberButton Class) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo!)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\SYSTEM32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (YahooTaggedBM Class) - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll (Yahoo! Inc.)
O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (America Online, Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (America Online, Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (America Online, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS\SYSTEM32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxpers] C:\WINDOWS\SYSTEM32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxtray] C:\WINDOWS\SYSTEM32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [kimatobobo] File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [zehuwafob] C:\WINDOWS\System32\yavayusa.DLL ()
O4 - HKCU..\Run: [Google Update] C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)
O4 - HKCU..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O8 - Extra context menu item: &AOL Toolbar Search - c:\Program Files\AOL\AOL Toolbar 2.0\resources\en-us\local\search.html ()
O8 - Extra context menu item: &Yahoo! Search - C:\Program Files\Yahoo!\Common [2009/11/25 20:11:09 | 00,000,000 | ---D | M]
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Yahoo! &Dictionary - C:\Program Files\Yahoo!\Common [2009/11/25 20:11:09 | 00,000,000 | ---D | M]
O8 - Extra context menu item: Yahoo! &Maps - C:\Program Files\Yahoo!\Common [2009/11/25 20:11:09 | 00,000,000 | ---D | M]
O8 - Extra context menu item: Yahoo! &SMS - C:\Program Files\Yahoo!\Common [2009/11/25 20:11:09 | 00,000,000 | ---D | M]
O9 - Extra Button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (America Online, Inc.)
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo!)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra Button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: parker.com ([polprod] https in Trusted sites)
O15 - HKCU\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll (Installation Support)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} https://upload.facebook.com/controls/FacebookPhotoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1123808924330 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} http://www.pcpitstop.com/mhLbl.cab (mhLabel Class)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab (ZoneIntro Class)
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.4.0/jinstall-1_4_0-windows-i586.cab (Java Plug-in 1.4.0)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab (Java Plug-in 1.5.0_04)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab (PopCapLoader Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} http://by107fd.bay107.hotmail.msn.com/activex/HMAtchmt.ocx (Hotmail Attachments Control)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O21 - SSODL: gumosizit - {0c89b3f5-c97a-419f-a0b1-bd1a3e72c7f0} - C:\WINDOWS\SYSTEM32\yavayusa.dll ()
O21 - SSODL: SwUpdate - {009541A0-3B00-1F1C-00F3-040224001C01} - C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\swupdate.dllget\flashplayer\current\polarbear\ultrashim.cab File not found
O22 - SharedTaskScheduler: {0c89b3f5-c97a-419f-a0b1-bd1a3e72c7f0} - kupuhivus - C:\WINDOWS\SYSTEM32\yavayusa.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 14:04:08 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{24c0009e-e2bb-11de-b514-000b7d199291}\Shell - "" = AutoRun
O33 - MountPoints2\{24c0009e-e2bb-11de-b514-000b7d199291}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{24c0009e-e2bb-11de-b514-000b7d199291}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*
O36 - AppCertDlls: AppSecDll - (C:\WINDOWS\system32\mshlps.dll) - C:\WINDOWS\System32\mshlps.dll File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/01/08 16:48:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/01/08 16:48:04 | 00,000,000 | --SD | C] -- C:\ComboFix
[2010/01/08 16:08:52 | 00,000,000 | ---D | C] -- C:\Qoobox
[2010/01/08 14:39:55 | 00,000,000 | ---D | C] -- C:\_OTL
[2010/01/08 13:16:52 | 00,513,536 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Steve Collins\Desktop\OTL.exe
[2010/01/08 12:23:02 | 05,061,520 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Steve Collins\Desktop\iexplore.exe
[2010/01/08 10:26:00 | 00,135,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\Copy (3) of TASKMGR.EXE
[2010/01/08 10:25:13 | 00,135,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\iexplore.EXE
[2010/01/08 10:23:15 | 00,135,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\Copy of TASKMGR.EXE
[2010/01/05 18:06:54 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/05 18:06:45 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/01/05 18:06:43 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/05 18:05:48 | 00,000,000 | ---D | C] -- C:\Program Files\TrendMicro
[2010/01/05 16:16:52 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\RegCure
[2010/01/05 16:16:51 | 00,000,000 | ---D | C] -- C:\Program Files\RegCure
[2010/01/05 14:11:03 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/05 13:39:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Threat Expert
[2010/01/05 13:04:18 | 01,640,400 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDCore.dll
[2010/01/05 13:04:18 | 00,165,840 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDRes.dll
[2010/01/05 13:04:18 | 00,149,456 | ---- | C] (PC Tools) -- C:\WINDOWS\SGDetectionTool.dll
[2010/01/05 13:04:10 | 00,233,136 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctgntdi.sys
[2010/01/05 13:03:54 | 00,207,792 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTCore.sys
[2010/01/05 13:03:54 | 00,087,784 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTAppEvent.sys
[2010/01/05 13:03:46 | 00,070,408 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctplsg.sys
[2010/01/05 13:03:39 | 00,000,000 | ---D | C] -- C:\Program Files\Spyware Doctor
[2010/01/05 13:03:39 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2010/01/05 13:03:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Application Data\PC Tools
[2010/01/05 13:03:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PC Tools
[2010/01/05 13:03:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/12/30 01:22:08 | 00,000,000 | ---D | C] -- C:\Program Files\Ashampoo
[2009/12/29 20:30:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Temp
[2009/12/24 14:55:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Application Data\Absolute Poker
[2009/12/24 14:55:00 | 00,000,000 | ---D | C] -- C:\Program Files\Absolute Poker
[2009/12/24 14:54:51 | 00,000,000 | ---D | C] -- C:\Program Files\_uninstallation_info
[2009/12/23 14:19:53 | 10,832,920 | ---- | C] (ashampoo GmbH & Co. KG ) -- C:\Documents and Settings\Steve Collins\Desktop\ashampoo_winoptimizer_2010_advanced_6[1].50_6644.exe
[2009/12/17 02:08:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Desktop\SLOT
[2009/12/17 01:03:22 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2009/12/17 00:05:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Desktop\tonys stuff
[2009/12/13 06:27:18 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe
[2009/12/12 23:50:52 | 00,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[2009/12/12 23:50:52 | 00,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2009/12/12 23:50:52 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2009/12/12 23:50:52 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2009/12/12 23:50:52 | 00,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2009/12/11 03:01:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Conduit
[2009/12/11 03:01:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\BS_Player
[2009/12/11 03:01:20 | 00,000,000 | ---D | C] -- C:\Program Files\BS_Player
[2009/12/11 03:01:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Application Data\BSplayer Pro
[2009/12/11 03:00:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Application Data\BSplayer
[2009/12/11 03:00:57 | 00,000,000 | ---D | C] -- C:\Program Files\Webteh
[2009/12/10 16:39:10 | 00,000,000 | ---D | C] -- C:\Program Files\RegistryFix8
[2009/12/06 16:57:20 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/12/06 15:38:47 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/12/06 15:38:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/12/06 15:38:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/12/06 14:24:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\AVG7
[2005/02/23 16:08:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\McAfee.com Personal Firewall
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2099/01/01 12:00:00 | 00,093,696 | -HS- | M] () -- C:\WINDOWS\System32\yavayusa.dll
[2099/01/01 12:00:00 | 00,061,440 | -HS- | M] () -- C:\WINDOWS\System32\raripizu.dll
[2099/01/01 12:00:00 | 00,039,424 | -HS- | M] () -- C:\WINDOWS\System32\norefose.dll
[2010/01/08 16:53:51 | 00,006,456 | -H-- | M] () -- C:\WINDOWS\System32\wijokipo
[2010/01/08 16:35:00 | 00,001,010 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2431532243-2449587419-2770306861-1006UA.job
[2010/01/08 16:29:00 | 00,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/01/08 16:29:00 | 00,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/01/08 16:03:54 | 00,000,296 | ---- | M] () -- C:\WINDOWS\tasks\ugvmnwsy.job
[2010/01/08 15:51:46 | 00,290,816 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Desktop\exeHelper.com
[2010/01/08 15:15:15 | 03,819,182 | R--- | M] () -- C:\Documents and Settings\Steve Collins\Desktop\ComboFix.exe
[2010/01/08 14:58:08 | 00,000,419 | ---- | M] () -- C:\WINDOWS\System32\uses32.dat
[2010/01/08 14:58:08 | 00,000,100 | ---- | M] () -- C:\WINDOWS\System32\flags.ini
[2010/01/08 14:30:19 | 00,001,092 | ---- | M] () -- C:\WINDOWS\QUICKEN.INI
[2010/01/08 13:07:36 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Steve Collins\Desktop\OTL.exe
[2010/01/08 11:34:51 | 00,095,360 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\atapi.sys
[2010/01/08 10:11:01 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL
[2010/01/08 10:09:39 | 00,000,394 | ---- | M] () -- C:\WINDOWS\tasks\RegCure Startup.job
[2010/01/08 10:09:26 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/01/08 10:09:23 | 00,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2010/01/08 10:09:20 | 53,519,1552 | -HS- | M] () -- C:\hiberfil.sys
[2010/01/08 08:48:43 | 05,578,752 | ---- | M] () -- C:\Documents and Settings\Steve Collins\ntuser.dat
[2010/01/08 08:48:43 | 00,000,278 | -HS- | M] () -- C:\Documents and Settings\Steve Collins\NTUSER.INI
[2010/01/08 01:00:17 | 00,002,599 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Desktop\HiJackThis.lnk
[2010/01/07 20:35:00 | 00,000,958 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2431532243-2449587419-2770306861-1006Core.job
[2010/01/07 16:15:48 | 05,061,520 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Steve Collins\Desktop\iexplore.exe
[2010/01/05 16:17:01 | 00,000,406 | ---- | M] () -- C:\WINDOWS\tasks\RegCure Program Check.job
[2010/01/05 16:16:58 | 00,000,388 | ---- | M] () -- C:\WINDOWS\tasks\RegCure.job
[2010/01/05 13:03:49 | 00,001,643 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2010/01/03 21:18:16 | 00,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2010/01/03 21:18:16 | 00,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for
[2009/12/31 17:42:19 | 06,291,456 | -H-- | M] () -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\IconCache.db
[2009/12/30 14:55:24 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/12/30 14:54:58 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/12/30 01:22:15 | 00,001,799 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\One-Click-Optimizer.lnk
[2009/12/30 01:22:15 | 00,000,861 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Ashampoo WinOptimizer 2010 Advanced.lnk
[2009/12/29 23:57:38 | 00,002,004 | ---- | M] () -- C:\Documents and Settings\Steve Collins\My Documents\1229 new.bsl
[2009/12/29 21:06:28 | 00,017,920 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/29 20:34:47 | 00,002,344 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Desktop\Google Chrome.lnk
[2009/12/29 19:56:06 | 00,001,536 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Desktop\NO$GBA.INP
[2009/12/29 09:26:19 | 05,141,504 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2009/12/29 09:26:19 | 03,897,344 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\ESBK.mb
[2009/12/24 15:05:27 | 00,000,734 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Desktop\Absolute Poker.lnk
[2009/12/24 14:53:50 | 00,002,955 | ---- | M] () -- C:\Documents and Settings\Steve Collins\My Documents\new@1.bsl
[2009/12/24 14:47:17 | 00,228,840 | ---- | M] () -- C:\Documents and Settings\Steve Collins\My Documents\AbsolutePoker_Setup.exe
[2009/12/23 14:19:53 | 10,832,920 | ---- | M] (ashampoo GmbH & Co. KG ) -- C:\Documents and Settings\Steve Collins\Desktop\ashampoo_winoptimizer_2010_advanced_6[1].50_6644.exe
[2009/12/17 00:09:43 | 00,000,040 | ---- | M] () -- C:\WINDOWS\nero.INI
[2009/12/13 07:25:12 | 00,004,836 | ---- | M] () -- C:\Documents and Settings\Steve Collins\My Documents\links to It's Always Sunny In Philadelphia.rtf
[2009/12/12 23:49:51 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[2009/12/12 23:49:51 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2009/12/12 23:49:51 | 00,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2009/12/12 23:49:51 | 00,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2009/12/12 23:49:51 | 00,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2009/12/12 20:15:01 | 00,000,775 | ---- | M] () -- C:\Documents and Settings\Steve Collins\Desktop\BS.Player FREE.lnk
[2009/12/11 18:30:00 | 00,000,366 | ---- | M] () -- C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (D7WK0V61-Steve Collins).job
[2009/12/10 16:46:02 | 00,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2099/01/01 12:00:00 | 00,093,696 | -HS- | C] () -- C:\WINDOWS\System32\yavayusa.dll
[2099/01/01 12:00:00 | 00,061,440 | -HS- | C] () -- C:\WINDOWS\System32\raripizu.dll
[2099/01/01 12:00:00 | 00,039,424 | -HS- | C] () -- C:\WINDOWS\System32\norefose.dll
[2099/01/01 12:00:00 | 00,006,456 | -H-- | C] () -- C:\WINDOWS\System32\wijokipo
[2010/01/08 15:54:07 | 00,290,816 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Desktop\exeHelper.com
[2010/01/08 15:40:53 | 00,000,296 | ---- | C] () -- C:\WINDOWS\tasks\ugvmnwsy.job
[2010/01/08 15:15:10 | 03,819,182 | R--- | C] () -- C:\Documents and Settings\Steve Collins\Desktop\ComboFix.exe
[2010/01/08 14:58:08 | 00,000,419 | ---- | C] () -- C:\WINDOWS\System32\uses32.dat
[2010/01/08 14:58:08 | 00,000,100 | ---- | C] () -- C:\WINDOWS\System32\flags.ini
[2010/01/07 16:05:28 | 00,002,599 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Desktop\HiJackThis.lnk
[2010/01/05 16:16:59 | 00,000,406 | ---- | C] () -- C:\WINDOWS\tasks\RegCure Program Check.job
[2010/01/05 16:16:58 | 00,000,394 | ---- | C] () -- C:\WINDOWS\tasks\RegCure Startup.job
[2010/01/05 16:16:57 | 00,000,388 | ---- | C] () -- C:\WINDOWS\tasks\RegCure.job
[2010/01/05 13:04:19 | 00,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll
[2010/01/05 13:04:18 | 01,152,444 | ---- | C] () -- C:\WINDOWS\UDB.zip
[2010/01/05 13:04:18 | 00,000,882 | ---- | C] () -- C:\WINDOWS\RegSDImport.xml
[2010/01/05 13:04:18 | 00,000,880 | ---- | C] () -- C:\WINDOWS\RegISSImport.xml
[2010/01/05 13:04:18 | 00,000,131 | ---- | C] () -- C:\WINDOWS\IDB.zip
[2010/01/05 13:04:10 | 00,007,387 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctgntdi.cat
[2010/01/05 13:03:54 | 00,007,412 | ---- | C] () -- C:\WINDOWS\System32\drivers\PCTAppEvent.cat
[2010/01/05 13:03:54 | 00,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctcore.cat
[2010/01/05 13:03:49 | 00,001,643 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2010/01/05 13:03:46 | 00,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctplsg.cat
[2010/01/03 21:18:16 | 00,054,156 | -H-- | C] () -- C:\WINDOWS\QTFont.qfn
[2010/01/03 21:18:16 | 00,001,409 | ---- | C] () -- C:\WINDOWS\QTFont.for
[2009/12/30 01:22:15 | 00,001,799 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\One-Click-Optimizer.lnk
[2009/12/30 01:22:15 | 00,000,861 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Ashampoo WinOptimizer 2010 Advanced.lnk
[2009/12/29 23:57:38 | 00,002,004 | ---- | C] () -- C:\Documents and Settings\Steve Collins\My Documents\1229 new.bsl
[2009/12/29 20:34:47 | 00,002,344 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Desktop\Google Chrome.lnk
[2009/12/29 20:30:34 | 00,001,010 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2431532243-2449587419-2770306861-1006UA.job
[2009/12/29 20:30:33 | 00,000,958 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2431532243-2449587419-2770306861-1006Core.job
[2009/12/24 15:05:27 | 00,000,734 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Desktop\Absolute Poker.lnk
[2009/12/24 14:53:50 | 00,002,955 | ---- | C] () -- C:\Documents and Settings\Steve Collins\My Documents\new@1.bsl
[2009/12/24 14:47:11 | 00,228,840 | ---- | C] () -- C:\Documents and Settings\Steve Collins\My Documents\AbsolutePoker_Setup.exe
[2009/12/13 13:25:05 | 00,609,726 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Desktop\102_1633.JPG
[2009/12/12 21:56:47 | 00,004,836 | ---- | C] () -- C:\Documents and Settings\Steve Collins\My Documents\links to It's Always Sunny In Philadelphia.rtf
[2009/12/12 20:15:01 | 00,000,775 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Desktop\BS.Player FREE.lnk
[2009/12/10 16:46:02 | 00,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009/11/20 14:55:48 | 00,966,765 | ---- | C] () -- C:\WINDOWS\System32\acAuth.dll
[2009/11/20 14:55:47 | 00,356,352 | ---- | C] () -- C:\WINDOWS\System32\SCMLib.dll
[2009/11/18 06:55:16 | 00,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
[2009/08/21 14:42:28 | 00,000,034 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2008/11/20 16:18:03 | 00,044,544 | ---- | C] () -- C:\WINDOWS\System32\gif89.dll
[2008/11/20 16:17:20 | 00,000,474 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2007/11/27 15:23:18 | 00,000,000 | ---- | C] () -- C:\WINDOWS\browser.INI
[2007/06/29 20:04:25 | 00,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
[2007/06/29 10:48:20 | 00,000,047 | ---- | C] () -- C:\WINDOWS\SPIDERCM.INI
[2007/05/22 18:15:22 | 00,000,027 | ---- | C] () -- C:\WINDOWS\INTUIT.INI
[2007/05/10 20:45:21 | 00,000,185 | ---- | C] () -- C:\WINDOWS\intuprof.ini
[2007/05/10 20:45:13 | 00,001,092 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
[2006/02/12 17:56:03 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/12/28 13:07:52 | 00,045,056 | R--- | C] () -- C:\Program Files\SetAttrib.exe
[2005/06/23 02:41:00 | 00,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2005/06/23 02:41:00 | 00,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2005/06/23 02:41:00 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2005/06/23 02:41:00 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2005/06/23 02:41:00 | 00,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2005/06/23 02:41:00 | 00,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2005/06/23 02:40:26 | 00,122,880 | ---- | C] () -- C:\WINDOWS\System32\cddvdint.dll
[2005/06/20 03:30:10 | 00,000,141 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2005/02/26 16:29:19 | 00,196,608 | ---- | C] () -- C:\WINDOWS\System32\avisynth.dll
[2005/02/26 16:17:13 | 00,017,920 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/02/26 13:22:07 | 00,000,136 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\fusioncache.dat
[2005/02/24 19:19:15 | 00,003,654 | ---- | C] () -- C:\WINDOWS\System32\drivers\Sonyhcp.dll
[2005/02/24 18:31:15 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/02/23 21:06:10 | 00,000,040 | ---- | C] () -- C:\WINDOWS\nero.INI
[2005/02/23 18:20:08 | 00,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2005/02/23 16:07:51 | 00,000,004 | ---- | C] () -- C:\Documents and Settings\Steve Collins\Application Data\QSPMShare
[2005/02/18 01:31:26 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/02/18 01:21:40 | 00,000,264 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/02/18 01:13:50 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
[2005/02/18 00:23:14 | 00,000,517 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/09/15 22:49:44 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/08/10 14:13:12 | 00,000,780 | ---- | C] () -- C:\WINDOWS\ORUN32.INI
[2001/09/17 14:20:02 | 00,009,216 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2000/09/08 16:53:50 | 00,073,839 | ---- | C] () -- C:\WINDOWS\System32\KodakOneTouch.dll
[1998/08/16 06:00:00 | 00,004,096 | ---- | C] () -- C:\WINDOWS\System32\sysres.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 201 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
< End of report >

posted from infected computer.

Please run OTL.exe.

• Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :OTL
  MOD - [2099/01/01 12:00:00 | 00,093,696 | -HS- | M] () -- C:\WINDOWS\SYSTEM32\yavayusa.dll
  O2 - BHO: (no name) - {32617793-570d-47d5-972a-cfabc51ca61a} - File not found
  O4 - HKLM..\Run: [kimatobobo] File not found
  O4 - HKLM..\Run: [zehuwafob] C:\WINDOWS\System32\yavayusa.DLL ()
  O21 - SSODL: gumosizit - {0c89b3f5-c97a-419f-a0b1-bd1a3e72c7f0} - C:\WINDOWS\SYSTEM32\yavayusa.dll ()
  O22 - SharedTaskScheduler: {0c89b3f5-c97a-419f-a0b1-bd1a3e72c7f0} - kupuhivus - C:\WINDOWS\SYSTEM32\yavayusa.dll ()
  [2009/12/11 03:01:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Conduit
  [2099/01/01 12:00:00 | 00,093,696 | -HS- | M] () -- C:\WINDOWS\System32\yavayusa.dll
  [2099/01/01 12:00:00 | 00,061,440 | -HS- | M] () -- C:\WINDOWS\System32\raripizu.dll
  [2099/01/01 12:00:00 | 00,039,424 | -HS- | M] () -- C:\WINDOWS\System32\norefose.dll
  [2010/01/08 16:53:51 | 00,006,456 | -H-- | M] () -- C:\WINDOWS\System32\wijokipo
  [2010/01/08 16:03:54 | 00,000,296 | ---- | M] () -- C:\WINDOWS\tasks\ugvmnwsy.job
  [2010/01/08 14:58:08 | 00,000,419 | ---- | C] () -- C:\WINDOWS\System32\uses32.dat
  [2010/01/08 14:58:08 | 00,000,100 | ---- | C] () -- C:\WINDOWS\System32\flags.ini
  
  
  
• Return to OTL, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.
  
  
• Click the red Run Fix button.
  
• A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTL.exe
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{32617793-570d-47d5-972a-cfabc51ca61a}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32617793-570d-47d5-972a-cfabc51ca61a}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\kimatobobo deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\zehuwafob deleted successfully.
C:\WINDOWS\SYSTEM32\yavayusa.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\gumosizit deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c89b3f5-c97a-419f-a0b1-bd1a3e72c7f0}\ deleted successfully.
File C:\WINDOWS\SYSTEM32\yavayusa.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{0c89b3f5-c97a-419f-a0b1-bd1a3e72c7f0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c89b3f5-c97a-419f-a0b1-bd1a3e72c7f0}\ deleted successfully.
File C:\WINDOWS\SYSTEM32\yavayusa.dll not found.
C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Conduit\Community Alerts\LanguagePacks folder moved successfully.
C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Conduit\Community Alerts\Feeds folder moved successfully.
C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Conduit\Community Alerts folder moved successfully.
C:\Documents and Settings\Steve Collins\Local Settings\Application Data\Conduit folder moved successfully.
File C:\WINDOWS\System32\yavayusa.dll not found.
C:\WINDOWS\SYSTEM32\raripizu.dll moved successfully.
C:\WINDOWS\SYSTEM32\norefose.dll moved successfully.
C:\WINDOWS\SYSTEM32\wijokipo moved successfully.
C:\WINDOWS\tasks\ugvmnwsy.job moved successfully.
C:\WINDOWS\SYSTEM32\uses32.dat moved successfully.
C:\WINDOWS\SYSTEM32\flags.ini moved successfully.

OTL by OldTimer - Version 3.1.21.2 log created on 01082010_170545

Hello.
Delete this folder:
C:\32788R22FWJFW

Try re-running Combofix.

how

To delete the folder? right click on it, select "delete"

Now double click on Combofix and try running it.