System Security Malware Keeps Coming Back (Part 1)

I have been battling System Security and its variants for a couple of weeks now. Whenever it rears its ugly head, I have been running a registry fix file I got from another site and then Malwarebytes. Invariably, Malwarebytes finds infected files...usually between 11 and 14. After completing the process, the computer behaves normally except for website re-directs and additional browzer windows opening spontaneously. I have done this on all 5 user accounts repeatedly. The only other things I have done are to 1) add a bunch of URLs (known dangerous sites) to the HOST file based on recommendations from yet another site and, 2) install and run Spyware Doctor but, of course, they want $40 to supposedly fix the problems it finds. I tend to be skeptical so I did not buy the program

So, I have following the instructions and here are the contents of the OTL logfile. Thanks in advance for any help with this. I hope I have provided sufficient info. The log file is too big to post in one shot so I have split it up into multiple posts.

Rodger
________________


OTL logfile created on: 4/21/2010 12:45:13 AM - Run 1
OTL by OldTimer - Version 3.2.1.3 Folder = C:\Documents and Settings\Rodger\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 67.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): E:\pagefile.sys 4092 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.08 Gb Total Space | 38.28 Gb Free Space | 12.84% Space Free | Partition Type: NTFS
Drive D: | 299.13 Gb Total Space | 4.80 Gb Free Space | 1.60% Space Free | Partition Type: NTFS
Drive E: | 297.05 Gb Total Space | 0.01 Gb Free Space | 0.00% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: IBUYPOWER
Current User Name: Rodger
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/04/21 00:42:35 | 000,562,176 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Rodger\Desktop\OTL.exe
PRC - [2010/01/22 09:56:24 | 000,112,592 | ---- | M] (Threat Expert Ltd.) -- C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
PRC - [2010/01/15 08:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009/12/14 11:01:02 | 000,093,320 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe
PRC - [2009/11/13 07:31:14 | 000,092,008 | ---- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2009/11/04 17:53:34 | 000,144,704 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\Mcshield.exe
PRC - [2009/11/04 16:59:50 | 000,606,736 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe
PRC - [2009/10/29 07:54:44 | 001,218,008 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2009/10/29 07:54:44 | 000,865,832 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe
PRC - [2009/10/27 12:19:46 | 000,895,696 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MPF\MpfSrv.exe
PRC - [2009/09/04 13:16:54 | 000,158,448 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Zune\ZuneLauncher.exe
PRC - [2009/09/04 13:16:54 | 000,058,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ZuneBusEnum.exe
PRC - [2009/07/08 12:54:34 | 000,359,952 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
PRC - [2009/07/07 20:10:02 | 002,482,848 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
PRC - [2009/05/21 19:57:00 | 000,362,496 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgpc01.exe
PRC - [2008/12/08 16:50:04 | 000,054,576 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Software Update\hpwuschd2.exe
PRC - [2008/10/16 21:11:26 | 000,569,344 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqbam08.exe
PRC - [2008/10/16 21:11:26 | 000,184,320 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe
PRC - [2008/10/16 20:23:30 | 000,214,360 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/04/05 01:21:33 | 000,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2008/02/26 12:26:02 | 000,132,376 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
PRC - [2007/07/25 16:06:30 | 002,027,792 | ---- | M] () -- C:\Program Files\Logitech\QuickCam\Quickcam.exe
PRC - [2007/07/25 16:02:54 | 000,563,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
PRC - [2007/07/25 16:02:32 | 000,403,728 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2007/07/20 00:40:48 | 000,137,752 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2007/07/20 00:38:54 | 000,186,904 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
PRC - [2007/01/04 17:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2005/09/07 19:35:36 | 000,716,800 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMax4.exe
PRC - [2005/05/19 21:11:06 | 000,925,696 | R--- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe
PRC - [2004/12/02 18:23:34 | 000,102,400 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe


========== Modules (SafeList) ==========

MOD - [2010/04/21 00:42:35 | 000,562,176 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Rodger\Desktop\OTL.exe
MOD - [2007/07/20 00:40:36 | 000,113,176 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcInj.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/03/29 08:51:54 | 000,068,000 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2010/03/15 12:50:36 | 001,142,224 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files\Spyware Doctor\pctsSvc.exe -- (sdCoreService)
SRV - [2010/03/11 12:09:22 | 000,366,840 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)
SRV - [2010/01/22 09:56:24 | 000,112,592 | ---- | M] (Threat Expert Ltd.) [Auto | Running] -- C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)
SRV - [2010/01/15 08:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009/12/14 11:01:02 | 000,093,320 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)
SRV - [2009/11/13 07:31:14 | 000,092,008 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2009/11/04 17:53:34 | 000,144,704 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\McAfee\VirusScan\Mcshield.exe -- (McShield)
SRV - [2009/11/04 16:59:50 | 000,606,736 | ---- | M] (McAfee, Inc.) [On_Demand | Running] -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe -- (McSysmon)
SRV - [2009/10/29 07:54:44 | 000,865,832 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc)
SRV - [2009/10/28 12:50:32 | 000,365,072 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2009/10/27 12:19:46 | 000,895,696 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MPF\MPFSrv.exe -- (MpfService)
SRV - [2009/09/04 13:17:00 | 000,447,216 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc)
SRV - [2009/09/04 13:16:54 | 005,893,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc)
SRV - [2009/09/04 13:16:54 | 000,058,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\ZuneBusEnum.exe -- (ZuneBusEnum)
SRV - [2009/07/08 12:54:34 | 000,359,952 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy)
SRV - [2009/07/07 20:10:02 | 002,482,848 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc)
SRV - [2009/05/21 21:21:18 | 000,248,832 | ---- | M] (Hewlett-Packard Co.) [On_Demand | Running] -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08)
SRV - [2008/10/16 20:30:28 | 000,634,880 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HPSLPSVC32.DLL -- (HPSLPSVC)
SRV - [2008/10/16 20:24:24 | 000,135,168 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc)
SRV - [2007/07/20 00:42:30 | 000,141,848 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)
SRV - [2007/07/20 00:40:48 | 000,137,752 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2007/07/20 00:38:54 | 000,186,904 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer)
SRV - [2007/01/04 17:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) [Auto | Running] -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)


========== Driver Services (SafeList) ==========

DRV - [2010/03/10 11:36:36 | 000,217,032 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\PCTCore.sys -- (PCTCore)
DRV - [2009/11/04 17:54:12 | 000,214,664 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2009/11/04 17:54:12 | 000,079,816 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2009/11/04 17:54:12 | 000,040,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfesmfk.sys -- (mfesmfk)
DRV - [2009/11/04 17:54:12 | 000,035,272 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2009/11/04 17:53:40 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdk.sys -- (mferkdk)
DRV - [2009/09/02 00:28:46 | 000,040,832 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\zumbus.sys -- (zumbus)
DRV - [2009/07/16 13:32:26 | 000,120,136 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Mpfp.sys -- (MPFP)
DRV - [2008/08/21 18:49:56 | 000,008,320 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgpfl.sys -- (motccgpfl)
DRV - [2008/08/21 18:49:22 | 000,018,688 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgp.sys -- (motccgp)
DRV - [2008/05/02 22:46:00 | 006,554,496 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2008/04/13 14:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/13 12:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007/10/10 17:41:50 | 000,042,112 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motodrv.sys -- (MotDev)
DRV - [2007/07/20 00:39:50 | 002,142,488 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVMVdrv.sys -- (lvmvdrv)
DRV - [2007/07/20 00:37:56 | 002,109,592 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Lvckap.sys -- (Lvckap)
DRV - [2007/07/18 20:44:22 | 003,599,000 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvuvc.sys -- (LVUVC) Logitech QuickCam Pro 5000(UVC)
DRV - [2007/07/18 20:44:22 | 000,022,296 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvuvcflt.sys -- (FilterService)
DRV - [2007/07/18 20:44:00 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/07/18 20:42:28 | 001,920,920 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvpopflt.sys -- (lvpopflt)
DRV - [2007/07/18 17:42:42 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2007/06/18 16:18:26 | 000,023,680 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motport.sys -- (motport)
DRV - [2007/06/18 16:18:26 | 000,023,680 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem)
DRV - [2007/04/09 08:27:07 | 000,031,548 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2007/01/30 01:16:42 | 000,006,144 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\PeerGuardian2\pgfilter.sys -- (pgfilter)
DRV - [2006/11/02 08:00:08 | 000,039,368 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\winusb.sys -- (WinUSB)
DRV - [2006/04/24 05:52:28 | 000,100,736 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata)
DRV - [2006/01/19 03:01:00 | 000,017,280 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctpdusb.sys -- (Jukebox3)
DRV - [2005/10/27 03:06:30 | 000,356,096 | R--- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rt61.sys -- (RT61)
DRV - [2005/10/05 05:21:10 | 000,141,312 | R--- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService)
DRV - [2005/09/01 14:11:52 | 000,016,768 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVPrcMon.sys -- (LVPrcMon)
DRV - [2005/08/11 01:49:28 | 000,393,088 | R--- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (SenFiltService)
DRV - [2005/03/30 12:24:00 | 000,230,400 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2004/10/27 19:21:30 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004/08/12 22:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2004/02/06 16:04:16 | 000,007,168 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gmfiltr.sys -- (genmcmn)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr8/*http://www.yahoo.com/ext/search/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = More: http://news.bbc.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn6\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.cnn.com/"
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.0
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.07103010
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
FF - prefs.js..keyword.URL: "chrome://google-partner/locale/partner.properties"


FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009/11/29 15:51:25 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/02/18 16:41:53 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2000/04/03 03:19:53 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/20 23:43:51 | 000,000,000 | ---D | M]

[2009/10/02 23:36:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rodger\Application Data\Mozilla\Extensions
[2009/10/02 23:36:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rodger\Application Data\Mozilla\Extensions\mozswing@mozswing.org
[2010/04/20 01:13:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rodger\Application Data\Mozilla\Firefox\Profiles\zds2yhei.default\extensions
[2009/09/22 12:36:55 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Rodger\Application Data\Mozilla\Firefox\Profiles\zds2yhei.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/12/28 15:06:08 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Documents and Settings\Rodger\Application Data\Mozilla\Firefox\Profiles\zds2yhei.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/01/17 00:43:37 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Rodger\Application Data\Mozilla\Firefox\Profiles\zds2yhei.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2008/11/06 16:43:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rodger\Application Data\Mozilla\Firefox\Profiles\zds2yhei.default\extensions\moveplayer@movenetworks.com
[2010/04/20 23:05:24 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2006/12/26 18:19:20 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/04/20 23:05:24 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2008/02/28 14:49:38 | 000,027,976 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\Mozilla Firefox\plugins\atgpcdec.dll
[2008/02/28 14:49:43 | 000,125,848 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\Mozilla Firefox\plugins\atgpcext.dll
[2008/02/28 14:49:37 | 000,060,824 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\Mozilla Firefox\plugins\npatgpc.dll
[2010/04/20 23:05:09 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2002/09/27 08:59:00 | 000,090,112 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\NpPopup.dll
[2006/01/18 12:50:00 | 000,319,488 | ---- | M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\npsnapfish.dll
[2008/01/24 17:11:44 | 000,159,744 | ---- | M] (CNN) -- C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll
[2005/04/27 17:31:10 | 000,225,280 | ---- | M] (Asgard Software Inc.) -- C:\Program Files\Mozilla Firefox\plugins\NPUploader.dll
[2007/04/16 13:07:12 | 000,180,293 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2010/04/18 21:44:44 | 000,003,282 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 204.13.11.27
O1 - Hosts: 127.0.0.1 audio-surf.com
O1 - Hosts: 127.0.0.1 www.audio-surf.com
O1 - Hosts: 127.0.0.1 watchnetprotection.com
O1 - Hosts: 127.0.0.1 systemsecurityonline.com
O1 - Hosts: 127.0.0.1 thesafedownload.com
O1 - Hosts: 127.0.0.1 ewebscan.com
O1 - Hosts: 127.0.0.1 webreadon.com
O1 - Hosts: 127.0.0.1 stabilityinternetglobalonline.com
O1 - Hosts: 127.0.0.1 stabilityonline.com
O1 - Hosts: 127.0.0.1 bestfiresfull.com
O1 - Hosts: 127.0.0.1 mostpopularscan.com
O1 - Hosts: 127.0.0.1 onlinescanservice.com
O1 - Hosts: 127.0.0.1 getscanonline.com
O1 - Hosts: 127.0.0.1 yourstabilitysystem.com
O1 - Hosts: 127.0.0.1 best-click-scanner.info
O1 - Hosts: 127.0.0.1 safetyscansite.com
O1 - Hosts: 127.0.0.1 wwwprotectionread.com
O1 - Hosts: 127.0.0.1 webprotectionreads.com
O1 - Hosts: 127.0.0.1 scanvistanow.com
O1 - Hosts: 127.0.0.1 scanalertpage.com
O1 - Hosts: 127.0.0.1 vistastabilitynow.com
O1 - Hosts: 127.0.0.1 internetsafetyexamine.com
O1 - Hosts: 127.0.0.1 bestcleaner.us
O1 - Hosts: 59 more lines...
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn6\yt.dll (Yahoo! Inc.)
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Yahoo! IE Suggest) - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (del.icio.us Toolbar Helper) - {7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll (del.icio.us, a Yahoo! Company)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn6\YTSingleInstance.dll (Yahoo! Inc)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (del.icio.us) - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll (del.icio.us, a Yahoo! Company)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn6\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (del.icio.us) - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll (del.icio.us, a Yahoo! Company)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\hpwuschd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe File not found
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [mouseElf] C:\Program Files\Evoluent\Vertical Mouse\MouseElf.exe (Evoluent)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PC Pitstop Optimize Reminder] C:\Program Files\PCPitstop\Optimize2\Reminder.exe File not found
O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [StartupDelayer] C:\Program Files\r2 Studios\Startup Delayer\Startup Launcher.exe (r2 studios)
O4 - HKLM..\Run: [YMailAdvisor] C:\Program Files\Yahoo!\Common\YMailAdvisor.exe (Yahoo! Inc.)
O4 - HKLM..\Run: [Zune Launcher] C:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Aim6] File not found
O4 - HKCU..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [LogitechSoftwareUpdate] C:\Program Files\Logitech\Video\ManifestEngine.exe File not found
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe File not found
O4 - HKLM..\RunOnce: [Uninstall Adobe Download Manager] File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Forget Me Not.lnk = C:\Program Files\Broderbund\AG CreataCard\AGRemind.exe (TLC Productivity Properties LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe (Google)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - D:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} http://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} https://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/3/9/8/398422c0-8d3e-40e1-a617-af65a72a0465/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {22D4879A-92DB-470D-8A83-E158797D8176} file:///F:/components/Liquid.ocx (Liquid.LiquidHelper)
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} http://activex.camfrogweb.com/advanced/2.0.2.23/cfweb_activex.camfrogweb.com-advanced-2.0.2.23_instmodule.exe (CamfrogWEB Advanced Unicode Control)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} https://webmail.gsa.gov/scoggemssoca01/iNotes6W.cab (iNotes6 Class)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www1.snapfish.com/SnapfishActivia.cab (Snapfish Activia)
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab (SysData Class)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6087.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1167190708155 (WUWebControl Class)
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} http://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1178843805390 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} https://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} http://web1.shutterfly.com/downloads/Uploader.cab (Shutterfly Picture Upload Plugin)
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} http://ak.imgag.com/imgag/cp/install/AxCtp2.cab (Create & Print ActiveX Plug-in)
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} http://ak.imgag.com/imgag/cp/install/Crusher.cab (Creative Toolbox Plug-in)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} http://www.live365.com/players/play365.cab (Live365Player Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://www.creative.com/softwareupdate/su/ocx/15106/CTPID.cab (Creative Software AutoUpdate Support Package)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/Optimize2/pcpitstop2.dll (PCPitstop Exam)
O16 - DPF: PackageCab http://www.imgag.com/cp/install/AxCtp2.cab (Reg Error: Key error.)
O16 - DPF: Ustream Publisher http://static.ustream.tv/plugin/3.1.5.2/ustream_publisher.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Rodger\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Rodger\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/12/19 23:13:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{251f3965-29dd-11df-b6bd-0018f36b7263}\Shell\AutoRun\command - "" = I:\InstallTomTomHOME.exe -- File not found
O33 - MountPoints2\{a73f9b3c-d499-11dd-a981-0018f36b7263}\Shell - "" = AutoRun
O33 - MountPoints2\{a73f9b3c-d499-11dd-a981-0018f36b7263}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a73f9b3c-d499-11dd-a981-0018f36b7263}\Shell\AutoRun\command - "" = M:\DPFMate.exe -- File not found
O33 - MountPoints2\{c4ba98c6-7c20-11dd-a8e1-0018f36b7263}\Shell - "" = AutoRun
O33 - MountPoints2\{c4ba98c6-7c20-11dd-a8e1-0018f36b7263}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c4ba98c6-7c20-11dd-a8e1-0018f36b7263}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2006/12/19 15:02:57 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - Services: "usnjsvc"
MsConfig - Services: "iPod Service"
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 0

SafeBootMin: AVG Anti-Spyware Driver - Driver
SafeBootMin: AVG Anti-Spyware Guard - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: mcmscsvc - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SafeBootMin: MCODS - C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: AVG Anti-Spyware Driver - Driver
SafeBootNet: AVG Anti-Spyware Guard - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: mcmscsvc - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SafeBootNet: MCODS - C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SafeBootNet: MpfService - C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {0291E591-EA41-4c82-8106-3DC6CE7F7664} - Reg Error: Value error.
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.4
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - Reg Error: Value error.
ActiveX: {347B0667-C7ED-429B-BDE3-CC8D3BACAA31} - Reg Error: Value error.
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA851-CC51-11CF-AAFA-00AA00B6015C} - rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\wpie4x86.inf,PerUserStub
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - Reg Error: Value error.
ActiveX: {AA218328-0EA8-4D70-8972-E987A9190FF4} - Reg Error: Value error.
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

I have been battling System Security and its variants for a couple of weeks now. Whenever it rears its ugly head, I have been running a registry fix file I got from another site and then Malwarebytes. Invariably, Malwarebytes finds infected files...usually between 11 and 14. After completing the process, the computer behaves normally except for website re-directs and additional browzer windows opening spontaneously. I have done this on all 5 user accounts repeatedly. The only other things I have done are to 1) add a bunch of URLs (known dangerous sites) to the HOST file based on recommendations from yet another site and, 2) install and run Spyware Doctor but, of course, they want $40 to supposedly fix the problems it finds. I tend to be skeptical so I did not buy the program

Here is the rest of the OTL log file.

Rodger
________________

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (69819404975603712)

========== Files/Folders - Created Within 30 Days ==========

[2010/04/21 00:42:29 | 000,562,176 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Rodger\Desktop\OTL.exe
[2010/04/20 23:40:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\McAfee Security Scan
[2010/04/20 23:40:06 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee Security Scan
[2010/04/20 23:39:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2010/04/20 23:39:41 | 000,000,000 | ---D | C] -- C:\Program Files\NOS
[2010/04/20 23:05:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010/04/20 23:05:23 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010/04/20 23:05:23 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/04/20 23:05:23 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/04/20 23:05:23 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/04/20 22:47:50 | 016,295,712 | ---- | C] (Sun Microsystems, Inc.) -- C:\Documents and Settings\Rodger\Desktop\jre-6u20-windows-i586.exe
[2010/04/20 22:21:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rodger\.SunDownloadManager
[2010/04/19 00:50:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rodger\Local Settings\Application Data\Threat Expert
[2010/04/19 00:34:28 | 001,652,688 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDCore.dll
[2010/04/19 00:34:28 | 000,165,840 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDRes.dll
[2010/04/19 00:34:28 | 000,149,456 | ---- | C] (PC Tools) -- C:\WINDOWS\SGDetectionTool.dll
[2010/04/19 00:16:06 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Rodger\Recent
[2010/04/18 23:56:23 | 000,233,136 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctgntdi.sys
[2010/04/18 23:56:15 | 000,217,032 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTCore.sys
[2010/04/18 23:56:15 | 000,088,040 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTAppEvent.sys
[2010/04/18 23:56:07 | 000,070,408 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctplsg.sys
[2010/04/18 23:56:03 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Doctor
[2010/04/18 23:56:03 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2010/04/18 23:56:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rodger\Application Data\PC Tools
[2010/04/18 23:56:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PC Tools
[2010/04/18 23:26:04 | 036,592,720 | ---- | C] (PC Tools ) -- C:\Documents and Settings\Rodger\Desktop\sdasetup.exe
[2010/04/18 21:48:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rodger\Local Settings\Application Data\avG
[2010/04/18 16:22:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\avG
[2010/04/17 02:14:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rodger\Application Data\Trillian
[2010/04/15 06:35:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2010/04/13 22:25:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Real
[2010/04/13 00:28:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/04/13 00:28:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/04/12 21:22:11 | 005,918,776 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Rodger\Desktop\mbam-setup-1.45.exe
[2010/04/12 07:04:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Real
[2010/04/11 21:43:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/04/11 21:18:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/04/11 21:18:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/04/11 21:13:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rodger\Application Data\9746B5F4FFE46A0B806D1EEBD730D503
[2010/03/28 13:39:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rodger\Desktop\BlackBerry
[2009/10/25 19:51:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\McAfee
[2009/09/18 02:58:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Temp
[2009/09/14 20:09:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\McAfee
[2009/09/06 08:18:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/09/06 08:05:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009/09/01 17:41:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\SACore
[2009/08/01 03:00:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/01/11 01:33:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\SACore
[2009/01/09 23:44:01 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/01/09 23:44:01 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/01/09 23:44:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2008/03/27 06:38:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Talkback
[2008/03/27 04:41:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Mozilla
[2008/03/27 04:41:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Mozilla
[2008/03/21 04:41:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Google
[2007/10/28 13:39:57 | 000,389,120 | ---- | C] (Citrix Online) -- C:\Documents and Settings\Rodger\GoToAssist_phone__268_en.exe
[2007/08/01 08:59:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Yahoo!
[2007/08/01 08:59:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Viewpoint
[2007/04/03 21:08:09 | 000,439,296 | ---- | C] (Citrix Online) -- C:\Documents and Settings\Rodger\GoToAssist_phone__317_en.exe
[2006/12/27 17:11:37 | 000,007,168 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\gmfiltr.sys
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/04/21 00:44:00 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{DC9CEF1D-D2F9-4813-AB81-5F807018B7B2}.job
[2010/04/21 00:42:35 | 000,562,176 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Rodger\Desktop\OTL.exe
[2010/04/21 00:34:31 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/04/21 00:08:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/04/21 00:01:00 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/04/20 23:49:10 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\lvuvc.hs
[2010/04/20 23:45:01 | 008,650,752 | ---- | M] () -- C:\Documents and Settings\Rodger\ntuser.dat
[2010/04/20 23:43:52 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/04/20 23:40:09 | 000,001,619 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2010/04/20 23:40:09 | 000,001,611 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2010/04/20 23:25:35 | 000,023,029 | ---- | M] () -- C:\WINDOWS\System32\Config.MPF
[2010/04/20 23:24:56 | 000,002,278 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/04/20 23:24:06 | 000,174,630 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/04/20 23:24:00 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/04/20 23:23:50 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/04/20 23:23:49 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/04/20 23:22:39 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Rodger\ntuser.ini
[2010/04/20 23:17:12 | 000,071,798 | ---- | M] () -- C:\Documents and Settings\Rodger\Desktop\JavaRa.zip
[2010/04/20 23:05:08 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/04/20 23:05:08 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/04/20 23:05:08 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/04/20 23:05:08 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/04/20 23:05:07 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010/04/20 22:56:39 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/04/20 22:47:50 | 016,295,712 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\Rodger\Desktop\jre-6u20-windows-i586.exe
[2010/04/20 19:10:45 | 000,001,813 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2010/04/19 04:03:00 | 000,000,376 | ---- | M] () -- C:\WINDOWS\tasks\DriverCure.job
[2010/04/19 01:41:51 | 000,075,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ipsec.sys
[2010/04/19 00:34:11 | 000,001,637 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2010/04/19 00:19:53 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/04/19 00:19:51 | 000,053,248 | ---- | M] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/18 23:26:05 | 036,592,720 | ---- | M] (PC Tools ) -- C:\Documents and Settings\Rodger\Desktop\sdasetup.exe
[2010/04/18 21:50:11 | 000,016,198 | -HS- | M] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\1LKwMuQ
[2010/04/18 21:50:11 | 000,016,198 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\1LKwMuQ
[2010/04/18 21:44:44 | 000,003,282 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/04/18 20:40:18 | 000,010,832 | ---- | M] () -- C:\Documents and Settings\Rodger\Desktop\BPOL LTR.docx
[2010/04/18 16:24:49 | 000,016,230 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\t35517xJLuG
[2010/04/18 11:14:17 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/04/16 19:58:07 | 000,001,140 | -HS- | M] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\hpx1xUoQ03
[2010/04/16 19:58:07 | 000,001,140 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\hpx1xUoQ03
[2010/04/15 19:12:48 | 000,001,915 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/04/15 07:33:26 | 000,014,794 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\313856482
[2010/04/15 07:33:22 | 000,014,802 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\4008104418
[2010/04/15 07:23:09 | 000,014,794 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\P4s1N5
[2010/04/15 00:39:37 | 000,001,340 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\R1s4u54x0W8I
[2010/04/14 12:07:22 | 000,015,216 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\50vGiJ1FW7x2
[2010/04/13 21:48:02 | 000,014,530 | -HS- | M] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\Fm8hV5
[2010/04/13 21:48:02 | 000,014,530 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\Fm8hV5
[2010/04/13 20:14:41 | 000,000,708 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/04/13 20:14:41 | 000,000,243 | ---- | M] () -- C:\WINDOWS\SYSTEM.INI
[2010/04/13 20:14:41 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2010/04/12 21:32:49 | 000,015,026 | -HS- | M] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\aB6G3tn
[2010/04/12 21:32:49 | 000,015,026 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\aB6G3tn
[2010/04/12 21:23:37 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/12 21:22:11 | 005,918,776 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Rodger\Desktop\mbam-setup-1.45.exe
[2010/04/12 21:11:07 | 000,000,356 | ---- | M] () -- C:\Documents and Settings\Rodger\Desktop\fix.reg
[2010/04/12 20:41:32 | 000,186,368 | -HS- | M] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\3619577277.dll
[2010/04/12 20:40:06 | 000,014,302 | -HS- | M] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\6k4tgo0
[2010/04/12 20:40:06 | 000,014,302 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\6k4tgo0
[2010/04/12 20:35:11 | 000,014,282 | -HS- | M] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\1000336815
[2010/04/12 20:35:11 | 000,014,282 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\1000336815
[2010/04/11 21:18:37 | 000,000,950 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\A28k41
[2010/04/01 01:01:09 | 000,000,320 | ---- | M] () -- C:\WINDOWS\tasks\McQcTask.job
[2010/03/30 00:46:30 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/03/30 00:45:52 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/03/25 16:39:25 | 000,521,444 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/25 16:39:25 | 000,441,014 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/03/25 16:39:25 | 000,071,206 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/04/20 23:43:52 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/04/20 23:40:09 | 000,001,619 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2010/04/20 23:40:09 | 000,001,611 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2010/04/20 23:17:12 | 000,071,798 | ---- | C] () -- C:\Documents and Settings\Rodger\Desktop\JavaRa.zip
[2010/04/19 00:34:28 | 001,152,444 | ---- | C] () -- C:\WINDOWS\UDB.zip
[2010/04/19 00:34:28 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll
[2010/04/19 00:34:28 | 000,000,882 | ---- | C] () -- C:\WINDOWS\RegSDImport.xml
[2010/04/19 00:34:28 | 000,000,879 | ---- | C] () -- C:\WINDOWS\RegISSImport.xml
[2010/04/19 00:34:28 | 000,000,131 | ---- | C] () -- C:\WINDOWS\IDB.zip
[2010/04/19 00:34:11 | 000,001,637 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2010/04/18 23:56:23 | 000,007,387 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctgntdi.cat
[2010/04/18 23:56:15 | 000,007,412 | ---- | C] () -- C:\WINDOWS\System32\drivers\PCTAppEvent.cat
[2010/04/18 23:56:15 | 000,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctcore.cat
[2010/04/18 23:56:07 | 000,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctplsg.cat
[2010/04/18 21:48:22 | 000,016,198 | -HS- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\1LKwMuQ
[2010/04/18 21:48:22 | 000,016,198 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\1LKwMuQ
[2010/04/18 20:31:51 | 000,010,832 | ---- | C] () -- C:\Documents and Settings\Rodger\Desktop\BPOL LTR.docx
[2010/04/18 16:22:51 | 000,016,230 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\t35517xJLuG
[2010/04/16 19:58:06 | 000,001,140 | -HS- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\hpx1xUoQ03
[2010/04/16 19:58:06 | 000,001,140 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\hpx1xUoQ03
[2010/04/15 19:12:48 | 000,001,915 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/04/15 06:33:05 | 000,014,802 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\4008104418
[2010/04/15 06:33:05 | 000,014,794 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\313856482
[2010/04/15 06:22:37 | 000,014,794 | -HS- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\P4s1N5
[2010/04/15 06:22:37 | 000,014,794 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\P4s1N5
[2010/04/15 00:39:37 | 000,001,340 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\R1s4u54x0W8I
[2010/04/14 11:06:00 | 000,015,216 | -HS- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\50vGiJ1FW7x2
[2010/04/14 11:06:00 | 000,015,216 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\50vGiJ1FW7x2
[2010/04/13 21:15:40 | 000,014,530 | -HS- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\Fm8hV5
[2010/04/13 21:15:40 | 000,014,530 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\Fm8hV5
[2010/04/13 20:13:45 | 000,001,725 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2010/04/13 20:13:45 | 000,000,920 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
[2010/04/13 20:13:45 | 000,000,768 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Forget Me Not.lnk
[2010/04/12 22:19:00 | 000,001,757 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
[2010/04/12 21:30:44 | 000,015,026 | -HS- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\aB6G3tn
[2010/04/12 21:30:44 | 000,015,026 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\aB6G3tn
[2010/04/12 21:23:37 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/12 21:11:07 | 000,000,356 | ---- | C] () -- C:\Documents and Settings\Rodger\Desktop\fix.reg
[2010/04/12 20:40:40 | 000,186,368 | -HS- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\3619577277.dll
[2010/04/12 20:35:11 | 000,014,282 | -HS- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\1000336815
[2010/04/12 20:35:11 | 000,014,282 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\1000336815
[2010/04/11 23:30:39 | 000,014,302 | -HS- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\6k4tgo0
[2010/04/11 23:30:39 | 000,014,302 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\6k4tgo0
[2010/04/11 21:18:37 | 000,000,950 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\A28k41
[2010/03/28 20:18:45 | 000,244,664 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/03/08 21:05:05 | 000,061,224 | ---- | C] () -- C:\Documents and Settings\Rodger\GoToAssistDownloadHelper.exe
[2010/02/06 19:52:14 | 000,020,480 | ---- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/01 22:33:07 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2010/01/06 21:54:55 | 000,005,632 | -HS- | C] () -- C:\Documents and Settings\Rodger\Thumbs.db
[2010/01/03 20:55:34 | 000,001,588 | ---- | C] () -- C:\WINDOWS\tefview.ini
[2009/11/20 21:24:49 | 000,000,760 | ---- | C] () -- C:\Documents and Settings\Rodger\Application Data\setup_ldm.iss
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/07/01 16:00:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\hpqEmlSz.INI
[2009/04/22 00:19:06 | 000,172,173 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2009/04/17 18:34:44 | 000,223,232 | ---- | C] () -- C:\WINDOWS\System32\sqlite3.dll
[2009/04/17 18:34:41 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\SQLiteWrapper.dll
[2009/03/23 21:41:56 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\Rodger\ntuser.tmp.LOG
[2008/12/14 15:34:25 | 000,000,531 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2008/10/07 09:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 09:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2008/09/08 15:02:16 | 000,000,298 | ---- | C] () -- C:\WINDOWS\Chutes.ini
[2008/09/06 10:59:17 | 000,000,023 | ---- | C] () -- C:\WINDOWS\CANDYLND.INI
[2008/08/06 08:41:16 | 000,004,608 | ---- | C] () -- C:\WINDOWS\System32\BTCCoInstaller.dll
[2007/12/13 16:42:06 | 000,022,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2007/12/13 16:35:42 | 000,000,319 | ---- | C] () -- C:\WINDOWS\game.ini
[2007/10/14 23:01:45 | 000,000,008 | ---- | C] () -- C:\WINDOWS\System32\CtSACKey.sys
[2007/07/18 17:42:42 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2007/07/13 00:04:30 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2007/06/09 00:56:29 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini
[2007/05/08 18:06:58 | 000,001,353 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/04/01 10:37:41 | 000,000,173 | ---- | C] () -- C:\WINDOWS\ConnMgr.ini
[2007/03/03 19:07:45 | 000,000,457 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2007/02/07 10:37:13 | 000,000,099 | ---- | C] () -- C:\WINDOWS\eFaxView.ini
[2007/02/02 21:58:11 | 000,041,181 | ---- | C] () -- C:\Documents and Settings\Rodger\.dmp
[2007/01/08 23:56:00 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007/01/07 13:38:36 | 000,000,042 | ---- | C] () -- C:\Documents and Settings\Rodger\default.pls
[2007/01/01 17:17:08 | 000,000,604 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\T2
[2007/01/01 17:17:08 | 000,000,604 | -H-- | C] () -- C:\Program Files\STLL Notifier
[2007/01/01 15:58:01 | 000,053,248 | ---- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/12/30 01:00:21 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\PdeSrvps.dll
[2006/12/29 11:46:39 | 000,009,758 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2006/12/29 00:56:53 | 000,000,021 | ---- | C] () -- C:\WINDOWS\atid.ini
[2006/12/27 22:42:46 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2006/12/27 19:33:33 | 000,000,028 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/12/27 17:11:37 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\TaskKeyHook.dll
[2006/12/27 17:11:37 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\drivers\gmcoinst.dll
[2006/12/27 16:56:33 | 000,000,029 | ---- | C] () -- C:\Documents and Settings\Rodger\BCPath.txt
[2006/12/27 16:35:19 | 000,058,163 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2006/12/27 16:32:27 | 000,000,719 | R--- | C] () -- C:\WINDOWS\System32\InstExec.ini
[2006/12/27 13:57:12 | 000,000,165 | ---- | C] () -- C:\WINDOWS\Quicken.ini
[2006/12/27 12:56:37 | 000,000,122 | ---- | C] () -- C:\WINDOWS\mdm.ini
[2006/12/27 12:56:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NSREX.INI
[2006/12/27 12:51:24 | 000,000,488 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/12/27 01:33:43 | 008,650,752 | ---- | C] () -- C:\Documents and Settings\Rodger\ntuser.dat
[2006/12/27 01:33:43 | 006,815,744 | ---- | C] () -- C:\Documents and Settings\Rodger\ntuser.bak
[2006/12/27 01:33:43 | 000,001,024 | -H-- | C] () -- C:\Documents and Settings\Rodger\ntuser.dat.LOG
[2006/12/27 01:33:43 | 000,000,178 | -HS- | C] () -- C:\Documents and Settings\Rodger\ntuser.ini
[2006/12/27 00:01:12 | 000,262,144 | ---- | C] () -- C:\Documents and Settings\All Users\ntuser.dat
[2006/12/27 00:01:12 | 000,001,024 | -H-- | C] () -- C:\Documents and Settings\All Users\ntuser.dat.LOG
[2006/12/20 00:53:12 | 000,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys
[2006/12/19 23:19:59 | 000,000,709 | R--- | C] () -- C:\WINDOWS\System32\AsusSetup.ini
[2006/12/19 23:19:59 | 000,000,263 | R--- | C] () -- C:\WINDOWS\System32\raidmgmt.ini
[2006/12/19 23:17:58 | 000,019,039 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini
[2006/12/19 23:17:44 | 000,018,797 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2006/12/19 23:17:42 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2006/12/19 23:17:40 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2006/12/08 08:50:14 | 000,217,088 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006/12/08 08:47:54 | 001,159,168 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2006/08/12 00:45:20 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006/08/12 00:43:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/12 00:43:00 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/08/12 00:43:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/08/12 00:43:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/08/12 00:43:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2005/09/01 14:11:52 | 000,016,768 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPrcMon.sys
[2003/03/09 16:31:04 | 000,561,152 | ---- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[2002/10/15 18:54:04 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[1999/01/27 14:39:06 | 000,065,024 | ---- | C] () -- C:\WINDOWS\System32\indounin.dll
[1999/01/22 14:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/01/12 04:00:00 | 000,040,448 | ---- | C] () -- C:\WINDOWS\System32\REGOBJ.DLL
[1997/06/13 08:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll

========== Custom Scans ==========


< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\system32\*.exe /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/12/19 15:06:33 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2006/12/19 15:06:33 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2006/12/19 15:06:33 | 000,905,216 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.sys >
[2004/08/04 08:00:00 | 000,009,029 | ---- | M] () -- C:\WINDOWS\system32\ansi.sys
[2004/08/04 08:00:00 | 000,027,097 | ---- | M] () -- C:\WINDOWS\system32\country.sys
[2007/10/14 23:01:45 | 000,000,008 | ---- | M] () -- C:\WINDOWS\system32\CtSACKey.sys
[2004/08/04 08:00:00 | 000,004,768 | ---- | M] () -- C:\WINDOWS\system32\himem.sys
[2004/08/04 08:00:00 | 000,042,809 | ---- | M] () -- C:\WINDOWS\system32\key01.sys
[2004/08/04 08:00:00 | 000,042,537 | ---- | M] () -- C:\WINDOWS\system32\keyboard.sys
[2004/08/04 08:00:00 | 000,027,866 | ---- | M] () -- C:\WINDOWS\system32\ntdos.sys
[2004/08/04 08:00:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos404.sys
[2004/08/04 08:00:00 | 000,029,370 | ---- | M] () -- C:\WINDOWS\system32\ntdos411.sys
[2004/08/04 08:00:00 | 000,029,274 | ---- | M] () -- C:\WINDOWS\system32\ntdos412.sys
[2004/08/04 08:00:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos804.sys
[2004/08/04 08:00:00 | 000,033,840 | ---- | M] () -- C:\WINDOWS\system32\ntio.sys
[2004/08/04 08:00:00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio404.sys
[2004/08/04 08:00:00 | 000,035,648 | ---- | M] () -- C:\WINDOWS\system32\ntio411.sys
[2004/08/04 08:00:00 | 000,035,424 | ---- | M] () -- C:\WINDOWS\system32\ntio412.sys
[2004/08/04 08:00:00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio804.sys
[2008/04/13 14:44:59 | 000,017,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\watchdog.sys
[2009/08/14 09:21:25 | 001,850,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\win32k.sys

< %systemroot%\system32\drivers\*.dll >
[2008/04/13 20:11:48 | 000,004,255 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv01nt5.dll
[2008/04/13 20:11:48 | 000,003,967 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv02nt5.dll
[2008/04/13 20:11:48 | 000,003,615 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv05nt5.dll
[2008/04/13 20:11:48 | 000,003,647 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv07nt5.dll
[2008/04/13 20:11:48 | 000,003,135 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv08nt5.dll
[2008/04/13 20:11:48 | 000,003,711 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv09nt5.dll
[2008/04/13 20:11:48 | 000,003,775 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv11nt5.dll
[2008/04/13 20:11:50 | 000,021,183 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv01nt5.dll
[2008/04/13 20:11:50 | 000,011,359 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv02nt5.dll
[2008/04/13 20:11:50 | 000,025,471 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv04nt5.dll
[2008/04/13 20:11:50 | 000,014,143 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv06nt5.dll
[2008/04/13 20:11:50 | 000,017,279 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv10nt5.dll
[2008/04/13 20:11:50 | 000,015,423 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\ch7xxnt5.dll
[2001/09/14 10:29:16 | 000,004,096 | ---- | M] () -- C:\WINDOWS\system32\drivers\gmcoinst.dll
[2008/04/13 20:12:05 | 000,003,901 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\siint5.dll
[2008/04/13 20:12:08 | 000,011,325 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\vchnt5.dll

< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >

< %SYSTEMDRIVE%\*.* >
[2006/12/19 23:13:18 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/04/13 20:14:41 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2006/12/19 23:13:18 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2008/09/14 11:34:47 | 000,074,104 | ---- | M] () -- C:\CTSUFile.txt
[2007/02/11 01:33:49 | 000,000,000 | ---- | M] () -- C:\DBS.TXT
[2009/11/28 17:56:45 | 000,000,488 | ---- | M] () -- C:\hpfr5550.xml
[2008/12/31 10:00:03 | 000,001,194 | -H-- | M] () -- C:\hpothb07.dat
[2008/12/31 10:00:03 | 000,002,239 | -H-- | M] () -- C:\hpothb07.tif
[2007/09/11 16:55:48 | 000,000,434 | ---- | M] () -- C:\INSTALL.LOG
[2006/12/19 23:13:18 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/06/12 15:04:31 | 000,003,374 | -H-- | M] () -- C:\IPH.PH
[2010/04/20 23:27:16 | 000,009,503 | ---- | M] () -- C:\JavaRa.log
[2006/12/19 23:13:18 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/04 08:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/09/06 02:04:14 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2008/06/02 12:16:13 | 000,002,044 | ---- | M] () -- C:\Rescued document.txt
[2009/03/29 12:14:05 | 000,000,232 | -H-- | M] () -- C:\sqmdata00.sqm
[2009/03/29 12:19:35 | 000,000,232 | -H-- | M] () -- C:\sqmdata01.sqm
[2009/04/02 23:24:07 | 000,000,232 | -H-- | M] () -- C:\sqmdata02.sqm
[2009/04/02 23:52:00 | 000,000,232 | -H-- | M] () -- C:\sqmdata03.sqm
[2009/04/08 19:59:43 | 000,000,232 | -H-- | M] () -- C:\sqmdata04.sqm
[2009/04/08 22:40:14 | 000,000,232 | -H-- | M] () -- C:\sqmdata05.sqm
[2009/04/08 23:21:27 | 000,000,232 | -H-- | M] () -- C:\sqmdata06.sqm
[2009/04/16 00:08:27 | 000,000,232 | -H-- | M] () -- C:\sqmdata07.sqm
[2009/04/16 00:12:50 | 000,000,232 | -H-- | M] () -- C:\sqmdata08.sqm
[2009/04/19 10:36:15 | 000,000,232 | -H-- | M] () -- C:\sqmdata09.sqm
[2009/04/19 10:51:30 | 000,000,232 | -H-- | M] () -- C:\sqmdata10.sqm
[2009/04/19 10:52:30 | 000,000,232 | -H-- | M] () -- C:\sqmdata11.sqm
[2009/04/19 15:57:16 | 000,000,232 | -H-- | M] () -- C:\sqmdata12.sqm
[2009/04/27 23:34:03 | 000,000,232 | -H-- | M] () -- C:\sqmdata13.sqm
[2009/09/07 23:33:14 | 000,000,232 | -H-- | M] () -- C:\sqmdata14.sqm
[2009/10/21 17:16:09 | 000,000,232 | -H-- | M] () -- C:\sqmdata15.sqm
[2009/03/13 21:07:54 | 000,000,232 | -H-- | M] () -- C:\sqmdata16.sqm
[2009/03/13 21:30:30 | 000,000,232 | -H-- | M] () -- C:\sqmdata17.sqm
[2009/03/18 00:54:25 | 000,000,232 | -H-- | M] () -- C:\sqmdata18.sqm
[2009/03/18 00:56:29 | 000,000,232 | -H-- | M] () -- C:\sqmdata19.sqm
[2009/03/29 12:14:05 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2009/03/29 12:19:35 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2009/04/02 23:24:07 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
[2009/04/02 23:52:00 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
[2009/04/08 19:59:42 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
[2009/04/08 22:40:14 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
[2009/04/08 23:21:27 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt06.sqm
[2009/04/16 00:08:27 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
[2009/04/16 00:12:50 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm
[2009/04/19 10:36:15 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm
[2009/04/19 10:51:30 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt10.sqm
[2009/04/19 10:52:30 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt11.sqm
[2009/04/19 15:57:15 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt12.sqm
[2009/04/27 23:34:03 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt13.sqm
[2009/09/07 23:33:14 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt14.sqm
[2009/10/21 17:16:09 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt15.sqm
[2009/03/13 21:07:54 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt16.sqm
[2009/03/13 21:30:30 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt17.sqm
[2009/03/18 00:54:25 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt18.sqm
[2009/03/18 00:56:29 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt19.sqm
[2007/04/04 20:22:54 | 000,000,032 | ---- | M] () -- C:\wizard.txt
[2007/09/14 23:35:12 | 000,000,158 | ---- | M] () -- C:\YServer.txt

< %PROGRAMFILES%\*. >
[2008/09/22 18:07:12 | 000,000,000 | ---D | M] -- C:\Program Files\2K Games
[2007/12/24 16:43:54 | 000,000,000 | ---D | M] -- C:\Program Files\Ableton
[2007/03/20 23:06:55 | 000,000,000 | ---D | M] -- C:\Program Files\aconvert
[2009/10/29 11:55:17 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2009/06/29 12:15:13 | 000,000,000 | ---D | M] -- C:\Program Files\AGEIA Technologies
[2007/01/07 12:43:37 | 000,000,000 | ---D | M] -- C:\Program Files\Ahead
[2009/06/12 15:04:29 | 000,000,000 | ---D | M] -- C:\Program Files\AIM6
[2009/08/08 17:39:52 | 000,000,000 | ---D | M] -- C:\Program Files\AIMTunes
[2006/12/19 23:22:47 | 000,000,000 | ---D | M] -- C:\Program Files\Analog Devices
[2010/04/20 20:26:41 | 000,000,000 | -H-D | M] -- C:\Program Files\anywebcam
[2008/12/25 22:20:59 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2009/04/17 18:56:27 | 000,000,000 | ---D | M] -- C:\Program Files\Ascentive
[2008/08/30 22:30:51 | 000,000,000 | ---D | M] -- C:\Program Files\ASIO4ALL v2
[2010/01/01 21:46:44 | 000,000,000 | ---D | M] -- C:\Program Files\Ask.com
[2008/08/11 21:28:23 | 000,000,000 | ---D | M] -- C:\Program Files\Aspyr
[2007/06/21 21:37:09 | 000,000,000 | ---D | M] -- C:\Program Files\Audacity
[2007/06/21 21:38:13 | 000,000,000 | ---D | M] -- C:\Program Files\Audacity 1.3 Beta (Unicode)
[2008/12/05 18:48:04 | 000,000,000 | ---D | M] -- C:\Program Files\Audible
[2008/02/04 22:18:11 | 000,000,000 | ---D | M] -- C:\Program Files\Audiosurf
[2007/06/25 18:03:02 | 000,000,000 | ---D | M] -- C:\Program Files\AutoGK
[2008/05/25 14:05:51 | 000,000,000 | ---D | M] -- C:\Program Files\AVG
[2007/06/25 18:02:55 | 000,000,000 | ---D | M] -- C:\Program Files\AviSynth 2.5
[2007/06/08 23:52:44 | 000,000,000 | ---D | M] -- C:\Program Files\Bethesda Softworks
[2007/01/08 21:00:42 | 000,000,000 | ---D | M] -- C:\Program Files\BitComet
[2007/11/05 16:32:49 | 000,000,000 | ---D | M] -- C:\Program Files\BitPim
[2010/03/21 20:33:42 | 000,000,000 | ---D | M] -- C:\Program Files\Boardmaker with SD Pro
[2009/09/19 11:01:33 | 000,000,000 | ---D | M] -- C:\Program Files\Bonjour
[2007/04/01 10:33:00 | 000,000,000 | ---D | M] -- C:\Program Files\Broderbund
[2008/08/30 17:56:03 | 000,000,000 | ---D | M] -- C:\Program Files\Call of Duty 4
[2006/12/27 23:44:27 | 000,000,000 | ---D | M] -- C:\Program Files\Canon
[2009/02/01 12:13:34 | 000,000,000 | ---D | M] -- C:\Program Files\CCleaner
[2008/07/05 23:52:14 | 000,000,000 | ---D | M] -- C:\Program Files\CFWebAdvancedU
[2010/03/08 21:05:13 | 000,000,000 | ---D | M] -- C:\Program Files\Citrix
[2010/04/19 00:32:21 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2006/12/19 23:11:05 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2008/06/01 11:32:55 | 000,000,000 | ---D | M] -- C:\Program Files\Creative
[2008/06/01 11:31:22 | 000,000,000 | -H-D | M] -- C:\Program Files\Creative Installation Information
[2008/09/19 14:36:26 | 000,000,000 | ---D | M] -- C:\Program Files\De Blob
[2007/03/28 06:37:21 | 000,000,000 | ---D | M] -- C:\Program Files\del.icio.us
[2010/01/30 15:03:28 | 000,000,000 | ---D | M] -- C:\Program Files\DivX
[2007/06/25 17:25:20 | 000,000,000 | ---D | M] -- C:\Program Files\DVD Decrypter
[2007/04/15 11:20:53 | 000,000,000 | ---D | M] -- C:\Program Files\EASEUS
[2007/11/21 21:25:46 | 000,000,000 | ---D | M] -- C:\Program Files\EasyJob Resume Builder
[2010/04/19 00:27:24 | 000,000,000 | ---D | M] -- C:\Program Files\Electronic Arts
[2008/05/17 11:52:24 | 000,000,000 | ---D | M] -- C:\Program Files\Emergent Music LLC
[2009/03/22 19:49:04 | 000,000,000 | ---D | M] -- C:\Program Files\ERUNT
[2006/12/27 17:11:37 | 000,000,000 | ---D | M] -- C:\Program Files\Evoluent
[2009/05/01 17:46:02 | 000,000,000 | ---D | M] -- C:\Program Files\EZBackitup
[2009/07/27 12:13:22 | 000,000,000 | ---D | M] -- C:\Program Files\Fallout 3
[2009/01/15 15:30:27 | 000,000,000 | ---D | M] -- C:\Program Files\foobar2000
[2009/06/21 20:32:46 | 000,000,000 | ---D | M] -- C:\Program Files\FormatFactory
[2008/12/25 22:41:21 | 000,000,000 | ---D | M] -- C:\Program Files\Free M4a to MP3 Converter
[2006/12/20 00:50:50 | 000,000,000 | ---D | M] -- C:\Program Files\Futuremark
[2007/06/25 17:57:44 | 000,000,000 | ---D | M] -- C:\Program Files\Gabest
[2009/07/24 01:52:15 | 000,000,000 | ---D | M] -- C:\Program Files\gBurner
[2010/04/15 19:12:36 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2006/12/26 18:03:19 | 000,000,000 | ---D | M] -- C:\Program Files\Grisoft
[2009/09/30 04:53:29 | 000,000,000 | ---D | M] -- C:\Program Files\Guitar Pro 5
[2009/06/21 20:14:15 | 000,000,000 | ---D | M] -- C:\Program Files\HandBrake
[2008/09/08 15:02:11 | 000,000,000 | ---D | M] -- C:\Program Files\Hasbro Interactive
[2009/12/28 19:22:33 | 000,000,000 | ---D | M] -- C:\Program Files\Hewlett-Packard
[2009/12/28 19:22:29 | 000,000,000 | ---D | M] -- C:\Program Files\HP
[2009/04/16 02:54:37 | 000,000,000 | ---D | M] -- C:\Program Files\ImgBurn
[2010/04/19 00:40:33 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2010/03/31 03:02:54 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2009/09/19 11:49:31 | 000,000,000 | ---D | M] -- C:\Program Files\iPhone Configuration Utility
[2007/08/21 17:35:38 | 000,000,000 | ---D | M] -- C:\Program Files\iPod To Computer Transfer
[2010/04/20 23:26:28 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2008/02/12 10:23:50 | 000,000,000 | ---D | M] -- C:\Program Files\KeePass Password Safe
[2007/06/18 18:18:51 | 000,000,000 | ---D | M] -- C:\Program Files\Kings Quest
[2007/08/05 17:08:34 | 000,000,000 | ---D | M] -- C:\Program Files\Lavasoft
[2010/01/10 06:23:20 | 000,000,000 | ---D | M] -- C:\Program Files\LimeWire
[2009/09/14 19:59:58 | 000,000,000 | ---D | M] -- C:\Program Files\Logitech
[2010/04/12 21:23:38 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2006/12/19 23:25:20 | 000,000,000 | ---D | M] -- C:\Program Files\Marvell
[2010/02/06 16:47:25 | 000,000,000 | ---D | M] -- C:\Program Files\McAfee
[2010/04/20 23:40:06 | 000,000,000 | ---D | M] -- C:\Program Files\McAfee Security Scan
[2010/02/06 16:46:01 | 000,000,000 | ---D | M] -- C:\Program Files\McAfee.com
[2009/10/04 22:46:45 | 000,000,000 | ---D | M] -- C:\Program Files\MediaMonkey
[2008/09/06 02:09:48 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2009/11/01 22:33:57 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft
[2009/02/21 02:41:54 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2006/12/27 13:08:53 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2009/07/24 12:42:48 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Games for Windows - LIVE
[2007/10/25 19:47:05 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2010/01/22 04:17:52 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
[2006/12/27 13:02:23 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Visual Studio
[2009/11/02 04:02:13 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2009/02/18 21:44:06 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
[2007/01/07 13:26:39 | 000,000,000 | ---D | M] -- C:\Program Files\Monsters
[2007/11/04 14:30:55 | 000,000,000 | ---D | M] -- C:\Program Files\Motorola
[2010/03/10 04:12:33 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/04/20 18:55:58 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2009/03/22 22:29:42 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2009/10/24 00:08:27 | 000,000,000 | ---D | M] -- C:\Program Files\MSECache
[2006/12/19 23:10:21 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2006/12/19 23:10:48 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2009/11/01 22:37:26 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Messenger
[2006/12/28 01:17:27 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
[2007/08/19 00:38:06 | 000,000,000 | ---D | M] -- C:\Program Files\MTV Networks
[2007/12/30 13:05:24 | 000,000,000 | ---D | M] -- C:\Program Files\Nanny Mania
[2008/01/26 13:33:16 | 000,000,000 | ---D | M] -- C:\Program Files\Netflix
[2008/09/06 02:05:25 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2010/04/20 23:39:41 | 000,000,000 | ---D | M] -- C:\Program Files\NOS
[2007/07/13 00:10:16 | 000,000,000 | ---D | M] -- C:\Program Files\Oblivion
[2006/12/19 23:10:55 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
[2009/08/14 03:03:25 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2008/07/06 19:30:45 | 000,000,000 | ---D | M] -- C:\Program Files\Panasonic
[2009/10/05 13:11:48 | 000,000,000 | ---D | M] -- C:\Program Files\PBS KIDS PLAY
[2010/04/16 20:47:18 | 000,000,000 | ---D | M] -- C:\Program Files\PeerGuardian2
[2007/11/05 17:11:20 | 000,000,000 | ---D | M] -- C:\Program Files\Photo Story 3 for Windows
[2009/08/19 09:18:14 | 000,000,000 | ---D | M] -- C:\Program Files\Picasa2
[2007/07/28 02:26:43 | 000,000,000 | ---D | M] -- C:\Program Files\Power Tab Software
[2007/06/08 23:41:14 | 000,000,000 | ---D | M] -- C:\Program Files\PowerISO
[2009/10/30 10:56:48 | 000,000,000 | ---D | M] -- C:\Program Files\Quicken
[2009/09/19 11:05:46 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2009/02/06 10:21:16 | 000,000,000 | ---D | M] -- C:\Program Files\r2 Studios
[2008/05/24 17:28:12 | 000,000,000 | ---D | M] -- C:\Program Files\Real
[2007/04/03 19:57:50 | 000,000,000 | ---D | M] -- C:\Program Files\Red Kawa
[2009/03/22 20:32:41 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
[2009/10/10 15:22:49 | 000,000,000 | ---D | M] -- C:\Program Files\ReNamer
[2009/11/25 21:35:44 | 000,000,000 | ---D | M] -- C:\Program Files\Research In Motion
[2007/04/02 16:04:18 | 000,000,000 | ---D | M] -- C:\Program Files\Rockstar Games
[2009/04/29 22:05:30 | 000,000,000 | ---D | M] -- C:\Program Files\ROM CHECK FAIL
[2008/05/31 13:38:51 | 000,000,000 | ---D | M] -- C:\Program Files\Ruckus Player
[2009/09/19 11:49:04 | 000,000,000 | ---D | M] -- C:\Program Files\Safari
[2008/03/04 15:40:25 | 000,000,000 | ---D | M] -- C:\Program Files\Serious Sam 2
[2007/12/30 13:03:56 | 000,000,000 | ---D | M] -- C:\Program Files\Shockwave.com
[2007/10/07 10:37:02 | 000,000,000 | ---D | M] -- C:\Program Files\Shutterfly
[2007/01/01 16:46:22 | 000,000,000 | ---D | M] -- C:\Program Files\Sibelius Software
[2007/06/18 18:20:19 | 000,000,000 | ---D | M] -- C:\Program Files\Sierra
[2007/03/03 19:09:50 | 000,000,000 | ---D | M] -- C:\Program Files\Sierra On-Line
[2007/02/15 18:05:35 | 000,000,000 | ---D | M] -- C:\Program Files\SigmaTel
[2009/09/06 08:05:17 | 000,000,000 | R--D | M] -- C:\Program Files\Skype
[2007/04/28 08:34:42 | 000,000,000 | ---D | M] -- C:\Program Files\SmartDraw 2007
[2006/12/27 13:09:21 | 000,000,000 | ---D | M] -- C:\Program Files\Snapshot Viewer
[2008/06/10 19:34:19 | 000,000,000 | ---D | M] -- C:\Program Files\Songbird
[2010/04/19 00:53:58 | 000,000,000 | ---D | M] -- C:\Program Files\Spyware Doctor
[2010/03/02 22:50:57 | 000,000,000 | ---D | M] -- C:\Program Files\Steam
[2010/01/03 20:55:32 | 000,000,000 | ---D | M] -- C:\Program Files\TablEdit
[2007/08/06 13:04:03 | 000,000,000 | ---D | M] -- C:\Program Files\Telltale Games
[2008/02/05 00:17:58 | 000,000,000 | ---D | M] -- C:\Program Files\Thumbplug TGA
[2010/03/07 16:09:20 | 000,000,000 | ---D | M] -- C:\Program Files\TomTom DesktopSuite
[2010/03/07 16:19:03 | 000,000,000 | ---D | M] -- C:\Program Files\TomTom HOME 2
[2010/03/07 16:19:15 | 000,000,000 | ---D | M] -- C:\Program Files\TomTom International B.V
[2010/04/17 02:15:18 | 000,000,000 | ---D | M] -- C:\Program Files\Trillian
[2006/12/19 23:15:40 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2009/01/17 20:29:53 | 000,000,000 | ---D | M] -- C:\Program Files\Uplink
[2010/01/01 21:46:29 | 000,000,000 | ---D | M] -- C:\Program Files\uTorrent
[2007/04/28 19:34:48 | 000,000,000 | ---D | M] -- C:\Program Files\UVU
[2007/02/10 19:50:30 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2009/06/12 14:48:00 | 000,000,000 | ---D | M] -- C:\Program Files\Viewpoint
[2008/06/14 14:34:44 | 000,000,000 | ---D | M] -- C:\Program Files\VS Revo Group
[2010/03/28 15:21:19 | 000,000,000 | ---D | M] -- C:\Program Files\WBFS
[2007/08/26 13:47:43 | 000,000,000 | ---D | M] -- C:\Program Files\Web Publish
[2008/05/31 17:45:05 | 000,000,000 | ---D | M] -- C:\Program Files\Western Digital
[2009/05/23 17:22:57 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Installer Clean Up
[2009/11/01 22:33:52 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live
[2000/04/10 13:33:20 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live Safety Center
[2009/11/01 22:33:41 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live SkyDrive
[2007/08/18 17:20:03 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Connect 2
[2008/09/06 02:05:23 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2008/09/06 02:05:22 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2006/12/19 23:12:27 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
[2008/07/14 00:47:41 | 000,000,000 | ---D | M] -- C:\Program Files\WinRAR
[2008/01/13 21:21:20 | 000,000,000 | ---D | M] -- C:\Program Files\WinZip
[2008/05/26 10:39:34 | 000,000,000 | ---D | M] -- C:\Program Files\World of Warcraft Trial
[2006/12/19 23:13:28 | 000,000,000 | ---D | M] -- C:\Program Files\xerox
[2007/06/23 17:55:04 | 000,000,000 | ---D | M] -- C:\Program Files\Yahoo!
[2009/09/18 17:05:24 | 000,000,000 | ---D | M] -- C:\Program Files\Zune

< %appdata%\*.* >
[2006/12/19 15:07:41 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\Rodger\Application Data\desktop.ini
[2009/11/20 21:24:49 | 000,000,760 | ---- | M] () -- C:\Documents and Settings\Rodger\Application Data\setup_ldm.iss


< MD5 for: AGP440.SYS >
[2004/08/04 08:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/09/06 02:02:30 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/09/06 02:02:30 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 08:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/09/06 02:02:30 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/09/06 02:02:30 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 08:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 08:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys
[2004/08/04 08:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys

< MD5 for: DISK.SYS >
[2004/08/04 08:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
[2008/09/06 02:02:30 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys
[2008/09/06 02:02:30 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:disk.sys
[2004/08/04 08:00:00 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\$NtServicePackUninstall$\disk.sys
[2008/04/13 14:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\ServicePackFiles\i386\disk.sys
[2008/04/13 14:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2004/08/04 08:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/04 08:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: NVATA.SYS >
[2006/04/24 05:52:28 | 000,100,736 | R--- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 -- C:\WINDOWS\system32\drivers\nvata.sys

< MD5 for: SCECLI.DLL >
[2004/08/04 08:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: USBSTOR.SYS >
[2004/08/04 08:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:usbstor.sys
[2008/09/06 02:02:30 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:usbstor.sys
[2008/09/06 02:02:30 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:usbstor.sys
[2004/08/04 03:08:48 | 000,026,496 | ---- | M] (Microsoft Corporation) MD5=6CD7B22193718F1D17A47A1CD6D37E75 -- C:\WINDOWS\$NtServicePackUninstall$\usbstor.sys
[2008/04/13 14:45:38 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\ServicePackFiles\i386\usbstor.sys
[2008/04/13 14:45:38 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\system32\drivers\usbstor.sys

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-04-21 02:57:01

< >

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 163 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
< End of report >

Hello.

Please run OTL.exe.

• Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :OTL
  O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
  O4 - HKLM..\Run: [] File not found
  [2010/04/18 21:48:22 | 000,016,198 | -HS- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\1LKwMuQ
  [2010/04/18 21:48:22 | 000,016,198 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\1LKwMuQ
  [2010/04/18 16:22:51 | 000,016,230 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\t35517xJLuG
  [2010/04/16 19:58:06 | 000,001,140 | -HS- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\hpx1xUoQ03
  [2010/04/16 19:58:06 | 000,001,140 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\hpx1xUoQ03
  [2010/04/15 06:33:05 | 000,014,802 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\4008104418
  [2010/04/15 06:33:05 | 000,014,794 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\313856482
  [2010/04/15 06:22:37 | 000,014,794 | -HS- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\P4s1N5
  [2010/04/15 06:22:37 | 000,014,794 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\P4s1N5
  [2010/04/15 00:39:37 | 000,001,340 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\R1s4u54x0W8I
  [2010/04/14 11:06:00 | 000,015,216 | -HS- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\50vGiJ1FW7x2
  [2010/04/14 11:06:00 | 000,015,216 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\50vGiJ1FW7x2
  [2010/04/13 21:15:40 | 000,014,530 | -HS- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\Fm8hV5
  [2010/04/13 21:15:40 | 000,014,530 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\Fm8hV5
  [2010/04/12 21:30:44 | 000,015,026 | -HS- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\aB6G3tn
  [2010/04/12 21:11:07 | 000,000,356 | ---- | C] () -- C:\Documents and Settings\Rodger\Desktop\fix.reg
  [2010/04/12 20:40:40 | 000,186,368 | -HS- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\3619577277.dll
  [2010/04/12 20:35:11 | 000,014,282 | -HS- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\1000336815
  [2010/04/12 20:35:11 | 000,014,282 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\1000336815
  [2010/04/11 23:30:39 | 000,014,302 | -HS- | C] () -- C:\Documents and Settings\Rodger\Local Settings\Application Data\6k4tgo0
  [2010/04/11 23:30:39 | 000,014,302 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\6k4tgo0
  [2010/04/11 21:18:37 | 000,000,950 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\A28k41
  
  
  
• Return to OTL, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.
  
  
• Click the red Run Fix button.
  
• A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTL.exe
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
C:\Documents and Settings\Rodger\Local Settings\Application Data\1LKwMuQ moved successfully.
C:\Documents and Settings\All Users\Application Data\1LKwMuQ moved successfully.
C:\Documents and Settings\All Users\Application Data\t35517xJLuG moved successfully.
C:\Documents and Settings\Rodger\Local Settings\Application Data\hpx1xUoQ03 moved successfully.
C:\Documents and Settings\All Users\Application Data\hpx1xUoQ03 moved successfully.
C:\Documents and Settings\All Users\Application Data\4008104418 moved successfully.
C:\Documents and Settings\All Users\Application Data\313856482 moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\P4s1N5 moved successfully.
C:\Documents and Settings\All Users\Application Data\P4s1N5 moved successfully.
C:\Documents and Settings\All Users\Application Data\R1s4u54x0W8I moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\50vGiJ1FW7x2 moved successfully.
C:\Documents and Settings\All Users\Application Data\50vGiJ1FW7x2 moved successfully.
C:\Documents and Settings\Rodger\Local Settings\Application Data\Fm8hV5 moved successfully.
C:\Documents and Settings\All Users\Application Data\Fm8hV5 moved successfully.
C:\Documents and Settings\Rodger\Local Settings\Application Data\aB6G3tn moved successfully.
C:\Documents and Settings\Rodger\Desktop\fix.reg moved successfully.
C:\Documents and Settings\Rodger\Local Settings\Application Data\3619577277.dll moved successfully.
C:\Documents and Settings\Rodger\Local Settings\Application Data\1000336815 moved successfully.
C:\Documents and Settings\All Users\Application Data\1000336815 moved successfully.
C:\Documents and Settings\Rodger\Local Settings\Application Data\6k4tgo0 moved successfully.
C:\Documents and Settings\All Users\Application Data\6k4tgo0 moved successfully.
C:\Documents and Settings\All Users\Application Data\A28k41 moved successfully.

OTL by OldTimer - Version 3.2.1.3 log created on 04212010_234213

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

OK, contents of the MBAM log:

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 4024

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

4/23/2010 12:03:31 AM
mbam-log-2010-04-23 (00-03-31).txt

Scan type: Quick scan
Objects scanned: 169273
Time elapsed: 16 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Hello.

Run ESET Online Scan
Please do an online scan with ESET Online Scanner. Please use Internet Explorer as it uses ActiveX.

• Check (tick) this box: YES, I accept the Terms of Use.
  
• Click on the Start button next to it.
  
• When prompted to run ActiveX. click Yes.
  
• You will be asked to install an ActiveX. Click Install.
  
• Once installed, the scanner will be initialized.
  
• After the scanner is initialized, click Start.
  
• Check (tick) Remove found threats box.
  
• Check (tick) Scan unwanted applications.
  
• Click on Scan.
  
• It will start scanning. Please be patient.
  
• Once the scan is done, the log will be saved here: C:\Program Files\esetonlinescanner\log.txt.
  

Thanks. Here is the ESET log file:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=63f99cb3686c1741899aa77f5bfdcccd
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=false
# utc_time=2010-04-24 11:19:07
# local_time=2010-04-24 07:19:07 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=2560 16777191 100 0 0 0 0 0
# compatibility_mode=5121 16776533 100 96 4738979 317037605 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=582850
# found=13
# cleaned=13
# scan_time=14563
C:\Documents and Settings\All Users\Application Data\AOL Downloads\SUD4131\setup.exe probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) B78523EC7752BC9EA469085D223FCF63 C
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install\6.1.41.2\setup.exe probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) B78523EC7752BC9EA469085D223FCF63 C
C:\Documents and Settings\Ana\Local Settings\Temp\23631764.nls a variant of Win32/Riern.U trojan (cleaned by deleting - quarantined) 79817F8244D4D60DDD03832CC2ED230A C
C:\Documents and Settings\Rodger\Incomplete\T-3545425-budapest ian anderson.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) D9C569C50E2AAB663783B67D7A336FC3 C
D:\Data from Compaq\Files from Compaq G Drive\My Documents\Brian\Netscape\Communicator\Program\AIM\Sysfiles\WxBug.EXE Win32/Adware.WBug.A application (deleted - quarantined) E0D92AC5FDD264E4ED40D45C75934F1B C
D:\Data from Compaq\Files from Compaq G Drive\My Documents\Brian\Netscape\Communicator\Program\AIM\aim95.exe Win32/Adware.WBug.A application (deleted - quarantined) 954B1F29D2963F04FEF9E652967EBC17 C
D:\Data from Compaq\Files from Compaq G Drive\My Documents\Brian\Netscape\Communicator\Program\AIM\WxBug.EXE Win32/Adware.WBug.A application (deleted - quarantined) E0D92AC5FDD264E4ED40D45C75934F1B C
E:\All But Windows Folder\C\Documents and Settings\All Users\Application Data\AOL Downloads\SUD4131\setup.exe probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) B78523EC7752BC9EA469085D223FCF63 C
E:\All But Windows Folder\C\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install\6.1.41.2\setup.exe probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) B78523EC7752BC9EA469085D223FCF63 C
E:\All But Windows Folder\C\Documents and Settings\Brian\My Documents\Downloads\Nero 8 Ultra Edition 8.2.8.0+Keymaker\Nero-8.2.8.0_eng_trial.exe Win32/Toolbar.AskSBar application (deleted - quarantined) F07E4F200E8B0DBD1E5A91F6B3805B00 C
E:\All But Windows Folder\C\Documents and Settings\Brian!\Desktop\Nero-6.6.1.15a.exe Win32/Toolbar.AskSBar application (deleted - quarantined) BB90A8DA50E64A8B248CC3AD31810F7D C
E:\All But Windows Folder\C\Documents and Settings\Rodger\Incomplete\Preview-T-3545425-budapest ian anderson.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) E4003ED195FDC120E8F5378162553E30 C
E:\All But Windows Folder\C\Documents and Settings\Rodger\Incomplete\T-3545425-budapest ian anderson.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) D9C569C50E2AAB663783B67D7A336FC3 C

Hello.

Please download CKScanner by askey127 from here
Save it to your desktop.

• Doubleclick CKScanner.exe and click Search For Files.
  
• After a very short time, when the cursor hourglass disappears, click Save List To File.
  
• A message box will verify that the file is saved.
  
• Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.

Hello. I still have browser re-direct issue and browser windows opening spontaneously. No more "System Security" symptoms though. Thanks.

Here are contents of CKFiles.txt:

CKScanner - Additional Security Risks - These are not necessarily bad
c:\program files\audiosurf\engine\channels\crypt.dll
c:\program files\oblivion\crack\oblivion.exe
c:\program files\steam\steamapps\common\mount and blade demo\sounds\fire_small_crackle_slick_op.ogg
c:\program files\steam\steamapps\common\sam and max episode 3\pack\data\fol_knucklecrack_01.aud
c:\program files\steam\steamapps\common\sam and max episode 3\pack\data\fol_knucklecrack_02.aud
c:\program files\steam\steamapps\common\sam and max episode 4\pack\data\fol_knucklecrack_01.aud
c:\program files\steam\steamapps\common\sam and max episode 4\pack\data\fol_knucklecrack_02.aud
c:\program files\steam\steamapps\sourcemods\dystopia_v1\materials\twincannon\asphaltcrack.vmt
c:\program files\steam\steamapps\sourcemods\dystopia_v1\materials\twincannon\asphaltcrack.vtf
c:\program files\steam\steamapps\sourcemods\fortressforever\materials\ff\ff_wall_cement17_cracked_blue.vmt
c:\program files\steam\steamapps\sourcemods\fortressforever\materials\ff\ff_wall_cement17_cracked_blue.vtf
c:\program files\steam\steamapps\sourcemods\fortressforever\materials\ff\ff_wall_cement17_cracked_red.vmt
c:\program files\steam\steamapps\sourcemods\fortressforever\materials\ff\ff_wall_cement17_cracked_red.vtf
scanner sequence 3.EH.11
----- EOF -----

Hello.

• Download combofix from here
  Link 1
  Link 2
  
  1. If you are using Firefox, make sure that your download settings are as follows:
  
  * Tools->Options->Main tab
  * Set to "Always ask me where to Save the files".
  
  2. During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  3. It is important you rename Combofix during the download, but not after.
  4. Please do not rename Combofix to other names, but only to the one indicated.
  5. Close any open browsers.
  6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

Hi. I can't download ComboFix..even on a non-infected computer. I get the following: "Cannot copy ComboFix [x]: Access is Denied. Make sure the disk is not full or write-protected and that the file is not currently in use." Although the instruction do not say it, should I be disabling AV software before attempting to download ComboFix? Thanks.

Well, I was just able to download ComboFix...using the same non-infected laptop. The only difference was it was connected to my home wireless network yesterday. Right now I am at my workplace connected to the LAN and it worked. I will transfer the file to the infected computer tonight and run the program.

Thanks.

Okay, standing by.

OK, this is very strange. I tried to download Combo-Fix.exe from my email to the infected computer. I get the same "access is denied" error message I reported previously. Next, I tried to copy it from the laptop to a thumb drive and got the same result. I wanted to try it again but the file seems to have been deleted. I have tried again to d/l the file to the infected computer and to the thumb drive and it will not work. Should I disable the anti-virus program and THEN try to download the file again? By the way, there is plenty of space available on the hard drive and on the thumb drive.

Thanks.

Last edited by curunduraj on 27th April 2010, 4:35 am; edited 1 time in total (Reason for editing : needed to add information)

post deleted.

Last edited by curunduraj on 27th April 2010, 2:46 pm; edited 1 time in total (Reason for editing : posted in error)

I have managed to get Combo-Fix onto my thumb drive but it would appear that the malware running on the infected computer is not allowing me to copy the file to it. My question then is: can I run the program from my thumb drive? Of course, answers to my previous questions may make this a moot point.
Thanks.

Hello.

Yes, try running it from thumb drive.

OK, I was able to run Combo-Fix from my thumb drive. Here are the contents of ComboFix.txt:

ComboFix 10-04-26.05 - Rodger 04/27/2010 19:20:08.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1460 [GMT -4:00]
Running from: I:\Combo-Fix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Ana\System
C:\Documents and Settings\Ana\System\win_qs8.jqx
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\reboot.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_IAS


((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-28 )))))))))))))))))))))))))))))))
.

2010-04-24 07:09:04 . 2010-04-24 07:09:04 -------- d-----w- C:\Program Files\ESET
2010-04-22 03:42:13 . 2010-04-22 03:42:13 -------- d-----w- C:\_OTL
2010-04-21 03:44:06 . 2010-04-21 03:44:06 -------- d-----w- C:\Documents and Settings\Default User\Local Settings\Application Data\Adobe
2010-04-21 03:40:11 . 2010-04-21 03:40:11 -------- d-----w- C:\Documents and Settings\All Users\Application Data\McAfee Security Scan
2010-04-21 03:40:06 . 2010-04-21 03:40:06 -------- d-----w- C:\Program Files\McAfee Security Scan
2010-04-21 03:05:23 . 2010-04-21 03:05:07 411368 ----a-w- C:\WINDOWS\system32\deployJava1.dll
2010-04-21 02:21:38 . 2010-04-21 02:37:22 -------- d-----w- C:\Documents and Settings\Rodger\.SunDownloadManager
2010-04-19 04:50:08 . 2010-04-19 04:50:08 -------- d-----w- C:\Documents and Settings\Rodger\Local Settings\Application Data\Threat Expert
2010-04-19 01:48:21 . 2010-04-19 01:48:21 -------- d-----w- C:\Documents and Settings\Rodger\Local Settings\Application Data\avG
2010-04-18 20:22:50 . 2010-04-19 01:48:21 -------- d-----w- C:\Documents and Settings\All Users\Application Data\avG
2010-04-18 20:22:50 . 2010-04-18 20:22:50 -------- d-----w- C:\Documents and Settings\Ana\Local Settings\Application Data\avG
2010-04-17 06:14:56 . 2010-04-17 06:14:56 -------- d-----w- C:\Documents and Settings\Rodger\Application Data\Trillian
2010-04-17 00:48:36 . 2010-04-17 00:48:36 -------- d-----w- C:\Documents and Settings\Cassandra\Application Data\Malwarebytes
2010-04-17 00:18:18 . 2010-04-17 00:18:18 -------- d-----w- C:\Documents and Settings\Brian!\Application Data\Malwarebytes
2010-04-14 01:24:15 . 2010-04-14 01:29:15 -------- d-----w- C:\Documents and Settings\Isa\Application Data\HPAppData
2010-04-14 01:24:13 . 2010-04-14 01:24:18 -------- d-----w- C:\Documents and Settings\Isa\Local Settings\Application Data\AskToolbar
2010-04-13 04:28:51 . 2010-04-13 04:28:51 -------- d-sh--w- C:\Documents and Settings\LocalService\IETldCache
2010-04-12 01:18:32 . 2010-04-15 10:35:38 -------- d-----w- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-12 01:13:18 . 2010-04-12 01:14:07 -------- d-----w- C:\Documents and Settings\Rodger\Application Data\9746B5F4FFE46A0B806D1EEBD730D503
2010-04-11 12:12:26 . 2010-04-11 12:12:26 -------- d-----w- C:\Documents and Settings\Ana\Application Data\Office Genuine Advantage
2010-03-29 20:12:14 . 2010-03-29 20:12:14 -------- d-----w- C:\Documents and Settings\Brian!\Local Settings\Application Data\Identities

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-27 23:36:08 . 2006-12-27 20:35:25 0 ----a-w- C:\WINDOWS\system32\drivers\lvuvc.hs
2010-04-27 22:53:33 . 2009-11-29 20:14:45 -------- d-----w- C:\Documents and Settings\Rodger\Application Data\HPAppData
2010-04-27 22:29:25 . 2008-07-05 22:22:09 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Google Updater
2010-04-27 09:27:58 . 2007-12-14 22:27:47 664 ----a-w- C:\WINDOWS\system32\d3d9caps.dat
2010-04-27 02:36:40 . 2007-08-08 21:01:44 -------- d-----w- C:\Documents and Settings\Brian!\Application Data\uTorrent
2010-04-27 02:36:30 . 2007-06-22 04:22:17 -------- d-----w- C:\Program Files\PeerGuardian2
2010-04-26 05:14:48 . 2009-12-01 23:39:53 -------- d-----w- C:\Documents and Settings\Ana\Application Data\HPAppData
2010-04-25 05:12:18 . 2007-02-16 15:41:00 -------- d-----w- C:\Documents and Settings\Rodger\Application Data\Skype
2010-04-25 05:12:16 . 2007-01-28 21:06:49 -------- d---a-w- C:\Documents and Settings\All Users\Application Data\TEMP
2010-04-25 05:05:38 . 2007-03-31 19:57:18 -------- d-----w- C:\Program Files\Serious Sam 2
2010-04-25 04:55:29 . 2006-12-27 20:56:32 -------- d--h--w- C:\Program Files\anywebcam
2010-04-25 04:02:14 . 2009-11-14 01:35:52 -------- d-----w- C:\Documents and Settings\Rodger\Application Data\skypePM
2010-04-24 07:02:08 . 2009-02-19 01:42:09 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2010-04-24 03:43:21 . 2007-02-06 19:19:25 -------- d-----w- C:\Documents and Settings\Ana\Application Data\Skype
2010-04-24 01:29:54 . 2009-06-10 00:46:37 -------- d-----w- C:\Documents and Settings\Ana\Application Data\skypePM
2010-04-23 02:41:43 . 2009-03-22 23:53:14 -------- d-----w- C:\Program Files\Malwarebytes' Anti-Malware
2010-04-22 22:01:05 . 2010-04-22 22:01:05 503808 ----a-w- C:\Documents and Settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4a705c6e-n\msvcp71.dll
2010-04-22 22:01:05 . 2010-04-22 22:01:05 499712 ----a-w- C:\Documents and Settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4a705c6e-n\jmc.dll
2010-04-22 22:01:05 . 2010-04-22 22:01:05 348160 ----a-w- C:\Documents and Settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4a705c6e-n\msvcr71.dll
2010-04-22 22:01:03 . 2010-04-22 22:01:03 61440 ----a-w- C:\Documents and Settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-64cedb82-n\decora-sse.dll
2010-04-22 22:01:03 . 2010-04-22 22:01:03 12800 ----a-w- C:\Documents and Settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-64cedb82-n\decora-d3d.dll
2010-04-22 08:12:14 . 2004-08-04 12:00:00 75264 ----a-w- C:\WINDOWS\system32\drivers\ipsec.sys
2010-04-22 03:27:23 . 2009-08-19 12:35:08 -------- d-----w- C:\Documents and Settings\All Users\Application Data\NOS
2010-04-21 03:43:49 . 2007-02-06 17:21:21 -------- d-----w- C:\Program Files\Common Files\Adobe
2010-04-21 03:41:08 . 2009-08-19 12:36:01 -------- d-----w- C:\Program Files\Common Files\Adobe AIR
2010-04-21 03:39:58 . 2010-04-21 03:39:57 86016 ----a-w- C:\Documents and Settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-04-21 03:26:28 . 2006-12-26 22:30:43 -------- d-----w- C:\Program Files\Java
2010-04-21 03:05:54 . 2008-09-19 18:47:43 -------- d-----w- C:\Program Files\Common Files\Java
2010-04-21 03:05:31 . 2010-04-21 03:05:31 503808 ----a-w- C:\Documents and Settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1732fc25-n\msvcp71.dll
2010-04-21 03:05:31 . 2010-04-21 03:05:31 499712 ----a-w- C:\Documents and Settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1732fc25-n\jmc.dll
2010-04-21 03:05:31 . 2010-04-21 03:05:31 348160 ----a-w- C:\Documents and Settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1732fc25-n\msvcr71.dll
2010-04-21 03:05:29 . 2010-04-21 03:05:29 61440 ----a-w- C:\Documents and Settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5ef7812e-n\decora-sse.dll
2010-04-21 03:05:29 . 2010-04-21 03:05:29 12800 ----a-w- C:\Documents and Settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5ef7812e-n\decora-d3d.dll
2010-04-19 18:33:49 . 2008-01-06 08:10:42 -------- d-----w- C:\Documents and Settings\Brian!\Application Data\LimeWire
2010-04-19 04:40:33 . 2006-12-20 03:22:46 -------- d--h--w- C:\Program Files\InstallShield Installation Information
2010-04-19 04:32:20 . 2009-11-05 23:46:18 -------- d-----w- C:\Documents and Settings\All Users\Application Data\BioWare
2010-04-19 04:27:24 . 2008-01-26 06:18:28 -------- d-----w- C:\Program Files\Electronic Arts
2010-04-19 04:26:46 . 2007-08-05 21:09:32 -------- d-----w- C:\Program Files\Common Files\Wise Installation Wizard
2010-04-18 16:45:02 . 2008-09-06 14:43:22 -------- d-----w- C:\Documents and Settings\Ana\Application Data\U3
2010-04-17 06:15:18 . 2006-12-27 23:33:04 -------- d-----w- C:\Program Files\Trillian
2010-04-15 23:12:36 . 2006-12-26 22:16:35 -------- d-----w- C:\Program Files\Google
2010-04-14 10:26:53 . 2010-04-14 10:26:02 20846064 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\rp\RealPlayerSPGold.exe
2010-04-14 10:26:02 . 2010-04-14 10:25:59 8405312 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2010-04-14 10:25:40 . 2010-04-14 10:25:40 149000 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\chr_helper\LaunchHelper.exe
2010-04-14 10:25:39 . 2010-04-14 10:25:37 10309448 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\chr\ChromeInstaller.exe
2010-04-14 10:25:13 . 2010-04-14 10:25:13 79368 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\RUP\vista.exe
2010-04-14 10:25:12 . 2010-04-14 10:25:12 64000 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\gcapi_dll.dll
2010-04-14 10:25:12 . 2010-04-14 10:25:12 52288 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\gtapi.dll
2010-04-14 10:25:12 . 2010-04-14 10:25:12 50688 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\fftbapi.dll
2010-04-14 10:25:12 . 2010-04-14 10:25:12 49152 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\CarboniteCompatibility.dll
2010-04-14 10:25:12 . 2010-04-14 10:25:12 118784 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\compat.dll
2010-04-14 02:25:06 . 2010-04-14 02:25:06 439816 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\setup.exe
2010-04-12 10:09:12 . 2009-11-10 02:00:38 79488 ----a-w- C:\Documents and Settings\Ana\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-30 04:46:30 . 2009-03-22 23:53:15 38224 ----a-w- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-03-30 04:45:52 . 2009-03-22 23:53:18 20824 ----a-w- C:\WINDOWS\system32\drivers\mbam.sys
2010-03-29 19:33:56 . 2009-11-09 16:13:54 79488 ----a-w- C:\Documents and Settings\Brian!\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-28 19:21:19 . 2009-11-17 00:46:28 -------- d-----w- C:\Program Files\WBFS
2010-03-22 00:33:42 . 2010-02-02 02:31:57 -------- d-----w- C:\Program Files\Boardmaker with SD Pro
2010-03-15 04:33:03 . 2010-03-15 04:33:02 125952 ----a-w- C:\Documents and Settings\All Users\Application Data\ParetoLogic\UUS2\Temp\Update.exe
2010-03-14 11:52:02 . 2010-03-13 20:11:49 -------- d-----w- C:\Documents and Settings\Ana\Application Data\DriverCure
2010-03-13 20:11:45 . 2010-03-13 20:11:45 -------- d-----w- C:\Documents and Settings\All Users\Application Data\ParetoLogic
2010-03-13 11:45:36 . 2010-02-02 02:33:07 43520 ----a-w- C:\WINDOWS\system32\CmdLineExt03.dll
2010-03-10 06:15:52 . 2004-08-04 12:00:00 420352 ----a-w- C:\WINDOWS\system32\vbscript.dll
2010-03-09 01:05:13 . 2008-03-18 17:52:42 -------- d-----w- C:\Program Files\Citrix
2010-03-09 01:05:05 . 2010-03-09 01:05:05 61224 ----a-w- C:\Documents and Settings\Rodger\GoToAssistDownloadHelper.exe
2010-03-07 20:23:16 . 2010-03-07 20:23:16 -------- d-----w- C:\Documents and Settings\All Users\Application Data\TomTom
2010-03-07 20:20:57 . 2010-03-07 20:20:57 -------- d-----w- C:\Documents and Settings\Brian!\Application Data\TomTom
2010-03-07 20:19:15 . 2010-03-07 20:19:15 -------- d-----w- C:\Program Files\TomTom International B.V
2010-03-07 20:19:03 . 2010-03-07 20:18:58 -------- d-----w- C:\Program Files\TomTom HOME 2
2010-03-07 20:09:20 . 2010-03-07 20:09:20 -------- d-----w- C:\Program Files\TomTom DesktopSuite
2010-03-03 02:50:57 . 2007-08-03 05:54:12 -------- d-----w- C:\Program Files\Steam
2010-02-25 06:24:37 . 2004-08-04 12:00:00 916480 ----a-w- C:\WINDOWS\system32\wininet.dll
2010-02-24 13:11:07 . 2004-08-04 12:00:00 455680 ----a-w- C:\WINDOWS\system32\drivers\mrxsmb.sys
2010-02-19 23:47:50 . 2010-02-19 23:47:50 3604480 ----a-w- C:\WINDOWS\system32\GPhotos.scr
2010-02-16 14:08:49 . 2004-08-04 12:00:00 2146304 ----a-w- C:\WINDOWS\system32\ntoskrnl.exe
2010-02-16 13:25:04 . 2004-08-03 22:59:02 2024448 ----a-w- C:\WINDOWS\system32\ntkrnlpa.exe
2010-02-12 04:33:11 . 2004-08-04 12:00:00 100864 ----a-w- C:\WINDOWS\system32\6to4svc.dll
2010-02-11 12:02:15 . 2004-08-04 12:00:00 226880 ----a-w- C:\WINDOWS\system32\drivers\tcpip6.sys
2010-02-01 01:45:40 . 2010-04-21 03:41:13 38784 ----a-w- C:\Documents and Settings\Rodger\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-01 01:45:40 . 2010-04-21 03:41:10 38784 ----a-w- C:\Documents and Settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2007-01-01 21:17:08 . 2007-01-01 21:17:08 604 ---ha-w- C:\Program Files\STLL Notifier
2008-02-28 18:49:38 . 2008-02-28 18:49:38 27976 ----a-w- C:\Program Files\mozilla firefox\plugins\atgpcdec.dll
2008-02-28 18:49:43 . 2008-02-28 18:49:43 125848 ----a-w- C:\Program Files\mozilla firefox\plugins\atgpcext.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-09-02 19:56:30 1175944 ----a-w- C:\Program Files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "C:\Program Files\Ask.com\GenericAskToolbar.dll" [2009-09-02 19:56:30 1175944]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "C:\Program Files\Ask.com\GenericAskToolbar.dll" [2009-09-02 19:56:30 1175944]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-05 05:21:33 68856]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 22:23:34 102400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 23:21:30 61952]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 02:46:00 13529088]
"mouseElf"="C:\PROGRA~1\Evoluent\VERTIC~1\mouseElf.exe" [2004-06-04 22:38:50 184320]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 02:46:00 86016]
"StartupDelayer"="C:\Program Files\r2 Studios\Startup Delayer\Startup Launcher.exe" [2008-11-29 14:33:34 73728]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 20:02:54 563984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 20:06:30 2027792]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2009-09-04 17:16:54 158448]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2008-12-08 20:50:04 54576]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2009-10-29 11:54:44 1218008]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 01:11:06 925696]
"YMailAdvisor"="C:\Program Files\Yahoo!\Common\YMailAdvisor.exe" [2008-02-26 16:26:02 132376]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2009-09-05 05:54:42 417792]
"nwiz"="nwiz.exe" [2008-05-03 02:46:00 1630208]
"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 15:43:18 248040]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 05:57:28 35760]
"Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 18:17:47 952768]

C:\Documents and Settings\Brian!\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2009-9-30 503808]

OK, here is ComboFix.txt:

ComboFix 10-04-26.05 - Rodger 04/27/2010 19:20:08.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1460 [GMT -4:00]
Running from: I:\Combo-Fix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Ana\System
C:\Documents and Settings\Ana\System\win_qs8.jqx
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\reboot.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_IAS


((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-28 )))))))))))))))))))))))))))))))
.

2010-04-24 07:09:04 . 2010-04-24 07:09:04 -------- d-----w- C:\Program Files\ESET
2010-04-22 03:42:13 . 2010-04-22 03:42:13 -------- d-----w- C:\_OTL
2010-04-21 03:44:06 . 2010-04-21 03:44:06 -------- d-----w- C:\Documents and Settings\Default User\Local Settings\Application Data\Adobe
2010-04-21 03:40:11 . 2010-04-21 03:40:11 -------- d-----w- C:\Documents and Settings\All Users\Application Data\McAfee Security Scan
2010-04-21 03:40:06 . 2010-04-21 03:40:06 -------- d-----w- C:\Program Files\McAfee Security Scan
2010-04-21 03:05:23 . 2010-04-21 03:05:07 411368 ----a-w- C:\WINDOWS\system32\deployJava1.dll
2010-04-21 02:21:38 . 2010-04-21 02:37:22 -------- d-----w- C:\Documents and Settings\Rodger\.SunDownloadManager
2010-04-19 04:50:08 . 2010-04-19 04:50:08 -------- d-----w- C:\Documents and Settings\Rodger\Local Settings\Application Data\Threat Expert
2010-04-19 01:48:21 . 2010-04-19 01:48:21 -------- d-----w- C:\Documents and Settings\Rodger\Local Settings\Application Data\avG
2010-04-18 20:22:50 . 2010-04-19 01:48:21 -------- d-----w- C:\Documents and Settings\All Users\Application Data\avG
2010-04-18 20:22:50 . 2010-04-18 20:22:50 -------- d-----w- C:\Documents and Settings\Ana\Local Settings\Application Data\avG
2010-04-17 06:14:56 . 2010-04-17 06:14:56 -------- d-----w- C:\Documents and Settings\Rodger\Application Data\Trillian
2010-04-17 00:48:36 . 2010-04-17 00:48:36 -------- d-----w- C:\Documents and Settings\Cassandra\Application Data\Malwarebytes
2010-04-17 00:18:18 . 2010-04-17 00:18:18 -------- d-----w- C:\Documents and Settings\Brian!\Application Data\Malwarebytes
2010-04-14 01:24:15 . 2010-04-14 01:29:15 -------- d-----w- C:\Documents and Settings\Isa\Application Data\HPAppData
2010-04-14 01:24:13 . 2010-04-14 01:24:18 -------- d-----w- C:\Documents and Settings\Isa\Local Settings\Application Data\AskToolbar
2010-04-13 04:28:51 . 2010-04-13 04:28:51 -------- d-sh--w- C:\Documents and Settings\LocalService\IETldCache
2010-04-12 01:18:32 . 2010-04-15 10:35:38 -------- d-----w- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-12 01:13:18 . 2010-04-12 01:14:07 -------- d-----w- C:\Documents and Settings\Rodger\Application Data\9746B5F4FFE46A0B806D1EEBD730D503
2010-04-11 12:12:26 . 2010-04-11 12:12:26 -------- d-----w- C:\Documents and Settings\Ana\Application Data\Office Genuine Advantage
2010-03-29 20:12:14 . 2010-03-29 20:12:14 -------- d-----w- C:\Documents and Settings\Brian!\Local Settings\Application Data\Identities

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-27 23:36:08 . 2006-12-27 20:35:25 0 ----a-w- C:\WINDOWS\system32\drivers\lvuvc.hs
2010-04-27 22:53:33 . 2009-11-29 20:14:45 -------- d-----w- C:\Documents and Settings\Rodger\Application Data\HPAppData
2010-04-27 22:29:25 . 2008-07-05 22:22:09 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Google Updater
2010-04-27 09:27:58 . 2007-12-14 22:27:47 664 ----a-w- C:\WINDOWS\system32\d3d9caps.dat
2010-04-27 02:36:40 . 2007-08-08 21:01:44 -------- d-----w- C:\Documents and Settings\Brian!\Application Data\uTorrent
2010-04-27 02:36:30 . 2007-06-22 04:22:17 -------- d-----w- C:\Program Files\PeerGuardian2
2010-04-26 05:14:48 . 2009-12-01 23:39:53 -------- d-----w- C:\Documents and Settings\Ana\Application Data\HPAppData
2010-04-25 05:12:18 . 2007-02-16 15:41:00 -------- d-----w- C:\Documents and Settings\Rodger\Application Data\Skype
2010-04-25 05:12:16 . 2007-01-28 21:06:49 -------- d---a-w- C:\Documents and Settings\All Users\Application Data\TEMP
2010-04-25 05:05:38 . 2007-03-31 19:57:18 -------- d-----w- C:\Program Files\Serious Sam 2
2010-04-25 04:55:29 . 2006-12-27 20:56:32 -------- d--h--w- C:\Program Files\anywebcam
2010-04-25 04:02:14 . 2009-11-14 01:35:52 -------- d-----w- C:\Documents and Settings\Rodger\Application Data\skypePM
2010-04-24 07:02:08 . 2009-02-19 01:42:09 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2010-04-24 03:43:21 . 2007-02-06 19:19:25 -------- d-----w- C:\Documents and Settings\Ana\Application Data\Skype
2010-04-24 01:29:54 . 2009-06-10 00:46:37 -------- d-----w- C:\Documents and Settings\Ana\Application Data\skypePM
2010-04-23 02:41:43 . 2009-03-22 23:53:14 -------- d-----w- C:\Program Files\Malwarebytes' Anti-Malware
2010-04-22 22:01:05 . 2010-04-22 22:01:05 503808 ----a-w- C:\Documents and Settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4a705c6e-n\msvcp71.dll
2010-04-22 22:01:05 . 2010-04-22 22:01:05 499712 ----a-w- C:\Documents and Settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4a705c6e-n\jmc.dll
2010-04-22 22:01:05 . 2010-04-22 22:01:05 348160 ----a-w- C:\Documents and Settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4a705c6e-n\msvcr71.dll
2010-04-22 22:01:03 . 2010-04-22 22:01:03 61440 ----a-w- C:\Documents and Settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-64cedb82-n\decora-sse.dll
2010-04-22 22:01:03 . 2010-04-22 22:01:03 12800 ----a-w- C:\Documents and Settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-64cedb82-n\decora-d3d.dll
2010-04-22 08:12:14 . 2004-08-04 12:00:00 75264 ----a-w- C:\WINDOWS\system32\drivers\ipsec.sys
2010-04-22 03:27:23 . 2009-08-19 12:35:08 -------- d-----w- C:\Documents and Settings\All Users\Application Data\NOS
2010-04-21 03:43:49 . 2007-02-06 17:21:21 -------- d-----w- C:\Program Files\Common Files\Adobe
2010-04-21 03:41:08 . 2009-08-19 12:36:01 -------- d-----w- C:\Program Files\Common Files\Adobe AIR
2010-04-21 03:39:58 . 2010-04-21 03:39:57 86016 ----a-w- C:\Documents and Settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-04-21 03:26:28 . 2006-12-26 22:30:43 -------- d-----w- C:\Program Files\Java
2010-04-21 03:05:54 . 2008-09-19 18:47:43 -------- d-----w- C:\Program Files\Common Files\Java
2010-04-21 03:05:31 . 2010-04-21 03:05:31 503808 ----a-w- C:\Documents and Settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1732fc25-n\msvcp71.dll
2010-04-21 03:05:31 . 2010-04-21 03:05:31 499712 ----a-w- C:\Documents and Settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1732fc25-n\jmc.dll
2010-04-21 03:05:31 . 2010-04-21 03:05:31 348160 ----a-w- C:\Documents and Settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1732fc25-n\msvcr71.dll
2010-04-21 03:05:29 . 2010-04-21 03:05:29 61440 ----a-w- C:\Documents and Settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5ef7812e-n\decora-sse.dll
2010-04-21 03:05:29 . 2010-04-21 03:05:29 12800 ----a-w- C:\Documents and Settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5ef7812e-n\decora-d3d.dll
2010-04-19 18:33:49 . 2008-01-06 08:10:42 -------- d-----w- C:\Documents and Settings\Brian!\Application Data\LimeWire
2010-04-19 04:40:33 . 2006-12-20 03:22:46 -------- d--h--w- C:\Program Files\InstallShield Installation Information
2010-04-19 04:32:20 . 2009-11-05 23:46:18 -------- d-----w- C:\Documents and Settings\All Users\Application Data\BioWare
2010-04-19 04:27:24 . 2008-01-26 06:18:28 -------- d-----w- C:\Program Files\Electronic Arts
2010-04-19 04:26:46 . 2007-08-05 21:09:32 -------- d-----w- C:\Program Files\Common Files\Wise Installation Wizard
2010-04-18 16:45:02 . 2008-09-06 14:43:22 -------- d-----w- C:\Documents and Settings\Ana\Application Data\U3
2010-04-17 06:15:18 . 2006-12-27 23:33:04 -------- d-----w- C:\Program Files\Trillian
2010-04-15 23:12:36 . 2006-12-26 22:16:35 -------- d-----w- C:\Program Files\Google
2010-04-14 10:26:53 . 2010-04-14 10:26:02 20846064 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\rp\RealPlayerSPGold.exe
2010-04-14 10:26:02 . 2010-04-14 10:25:59 8405312 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2010-04-14 10:25:40 . 2010-04-14 10:25:40 149000 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\chr_helper\LaunchHelper.exe
2010-04-14 10:25:39 . 2010-04-14 10:25:37 10309448 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\chr\ChromeInstaller.exe
2010-04-14 10:25:13 . 2010-04-14 10:25:13 79368 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\RUP\vista.exe
2010-04-14 10:25:12 . 2010-04-14 10:25:12 64000 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\gcapi_dll.dll
2010-04-14 10:25:12 . 2010-04-14 10:25:12 52288 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\gtapi.dll
2010-04-14 10:25:12 . 2010-04-14 10:25:12 50688 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\fftbapi.dll
2010-04-14 10:25:12 . 2010-04-14 10:25:12 49152 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\CarboniteCompatibility.dll
2010-04-14 10:25:12 . 2010-04-14 10:25:12 118784 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\compat.dll
2010-04-14 02:25:06 . 2010-04-14 02:25:06 439816 ----a-w- C:\Documents and Settings\Ana\Application Data\Real\Update\setup3.10\setup.exe
2010-04-12 10:09:12 . 2009-11-10 02:00:38 79488 ----a-w- C:\Documents and Settings\Ana\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-30 04:46:30 . 2009-03-22 23:53:15 38224 ----a-w- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-03-30 04:45:52 . 2009-03-22 23:53:18 20824 ----a-w- C:\WINDOWS\system32\drivers\mbam.sys
2010-03-29 19:33:56 . 2009-11-09 16:13:54 79488 ----a-w- C:\Documents and Settings\Brian!\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-28 19:21:19 . 2009-11-17 00:46:28 -------- d-----w- C:\Program Files\WBFS
2010-03-22 00:33:42 . 2010-02-02 02:31:57 -------- d-----w- C:\Program Files\Boardmaker with SD Pro
2010-03-15 04:33:03 . 2010-03-15 04:33:02 125952 ----a-w- C:\Documents and Settings\All Users\Application Data\ParetoLogic\UUS2\Temp\Update.exe
2010-03-14 11:52:02 . 2010-03-13 20:11:49 -------- d-----w- C:\Documents and Settings\Ana\Application Data\DriverCure
2010-03-13 20:11:45 . 2010-03-13 20:11:45 -------- d-----w- C:\Documents and Settings\All Users\Application Data\ParetoLogic
2010-03-13 11:45:36 . 2010-02-02 02:33:07 43520 ----a-w- C:\WINDOWS\system32\CmdLineExt03.dll
2010-03-10 06:15:52 . 2004-08-04 12:00:00 420352 ----a-w- C:\WINDOWS\system32\vbscript.dll
2010-03-09 01:05:13 . 2008-03-18 17:52:42 -------- d-----w- C:\Program Files\Citrix
2010-03-09 01:05:05 . 2010-03-09 01:05:05 61224 ----a-w- C:\Documents and Settings\Rodger\GoToAssistDownloadHelper.exe
2010-03-07 20:23:16 . 2010-03-07 20:23:16 -------- d-----w- C:\Documents and Settings\All Users\Application Data\TomTom
2010-03-07 20:20:57 . 2010-03-07 20:20:57 -------- d-----w- C:\Documents and Settings\Brian!\Application Data\TomTom
2010-03-07 20:19:15 . 2010-03-07 20:19:15 -------- d-----w- C:\Program Files\TomTom International B.V
2010-03-07 20:19:03 . 2010-03-07 20:18:58 -------- d-----w- C:\Program Files\TomTom HOME 2
2010-03-07 20:09:20 . 2010-03-07 20:09:20 -------- d-----w- C:\Program Files\TomTom DesktopSuite
2010-03-03 02:50:57 . 2007-08-03 05:54:12 -------- d-----w- C:\Program Files\Steam
2010-02-25 06:24:37 . 2004-08-04 12:00:00 916480 ----a-w- C:\WINDOWS\system32\wininet.dll
2010-02-24 13:11:07 . 2004-08-04 12:00:00 455680 ----a-w- C:\WINDOWS\system32\drivers\mrxsmb.sys
2010-02-19 23:47:50 . 2010-02-19 23:47:50 3604480 ----a-w- C:\WINDOWS\system32\GPhotos.scr
2010-02-16 14:08:49 . 2004-08-04 12:00:00 2146304 ----a-w- C:\WINDOWS\system32\ntoskrnl.exe
2010-02-16 13:25:04 . 2004-08-03 22:59:02 2024448 ----a-w- C:\WINDOWS\system32\ntkrnlpa.exe
2010-02-12 04:33:11 . 2004-08-04 12:00:00 100864 ----a-w- C:\WINDOWS\system32\6to4svc.dll
2010-02-11 12:02:15 . 2004-08-04 12:00:00 226880 ----a-w- C:\WINDOWS\system32\drivers\tcpip6.sys
2010-02-01 01:45:40 . 2010-04-21 03:41:13 38784 ----a-w- C:\Documents and Settings\Rodger\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-01 01:45:40 . 2010-04-21 03:41:10 38784 ----a-w- C:\Documents and Settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2007-01-01 21:17:08 . 2007-01-01 21:17:08 604 ---ha-w- C:\Program Files\STLL Notifier
2008-02-28 18:49:38 . 2008-02-28 18:49:38 27976 ----a-w- C:\Program Files\mozilla firefox\plugins\atgpcdec.dll
2008-02-28 18:49:43 . 2008-02-28 18:49:43 125848 ----a-w- C:\Program Files\mozilla firefox\plugins\atgpcext.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-09-02 19:56:30 1175944 ----a-w- C:\Program Files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "C:\Program Files\Ask.com\GenericAskToolbar.dll" [2009-09-02 19:56:30 1175944]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "C:\Program Files\Ask.com\GenericAskToolbar.dll" [2009-09-02 19:56:30 1175944]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-05 05:21:33 68856]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 22:23:34 102400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 23:21:30 61952]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 02:46:00 13529088]
"mouseElf"="C:\PROGRA~1\Evoluent\VERTIC~1\mouseElf.exe" [2004-06-04 22:38:50 184320]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 02:46:00 86016]
"StartupDelayer"="C:\Program Files\r2 Studios\Startup Delayer\Startup Launcher.exe" [2008-11-29 14:33:34 73728]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 20:02:54 563984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 20:06:30 2027792]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2009-09-04 17:16:54 158448]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2008-12-08 20:50:04 54576]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2009-10-29 11:54:44 1218008]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 01:11:06 925696]
"YMailAdvisor"="C:\Program Files\Yahoo!\Common\YMailAdvisor.exe" [2008-02-26 16:26:02 132376]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2009-09-05 05:54:42 417792]
"nwiz"="nwiz.exe" [2008-05-03 02:46:00 1630208]
"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 15:43:18 248040]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 05:57:28 35760]
"Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 18:17:47 952768]

C:\Documents and Settings\Brian!\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2009-9-30 503808]

Hello.
The last bit of the log was cut off, please post the rest.

I just checked and I posted everything from the log file. I will try to run it again.

OK, ran Combo-Fix again and I believe I have a complete log file:

ComboFix 10-04-28.03 - Rodger 04/28/2010 19:10:41.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1076 [GMT -4:00]
Running from: N:\Combo-Fix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\Ana\System\win_qs8.jqx
c:\windows\system32\AutoRun.inf
c:\windows\system32\reboot.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_IAS


((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-28 )))))))))))))))))))))))))))))))
.

2010-04-28 17:23 . 2010-04-28 17:23 61440 ----a-w- c:\documents and settings\Brian!\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-58a069ea-n\decora-sse.dll
2010-04-28 17:23 . 2010-04-28 17:23 503808 ----a-w- c:\documents and settings\Brian!\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-52c5c12b-n\msvcp71.dll
2010-04-28 17:23 . 2010-04-28 17:23 499712 ----a-w- c:\documents and settings\Brian!\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-52c5c12b-n\jmc.dll
2010-04-28 17:23 . 2010-04-28 17:23 348160 ----a-w- c:\documents and settings\Brian!\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-52c5c12b-n\msvcr71.dll
2010-04-28 17:23 . 2010-04-28 17:23 12800 ----a-w- c:\documents and settings\Brian!\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-58a069ea-n\decora-d3d.dll
2010-04-28 07:15 . 2010-04-28 07:15 -------- d-----w- C:\cabs
2010-04-24 07:09 . 2010-04-24 07:09 -------- d-----w- c:\program files\ESET
2010-04-22 22:01 . 2010-04-22 22:01 503808 ----a-w- c:\documents and settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4a705c6e-n\msvcp71.dll
2010-04-22 22:01 . 2010-04-22 22:01 499712 ----a-w- c:\documents and settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4a705c6e-n\jmc.dll
2010-04-22 22:01 . 2010-04-22 22:01 348160 ----a-w- c:\documents and settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4a705c6e-n\msvcr71.dll
2010-04-22 22:01 . 2010-04-22 22:01 61440 ----a-w- c:\documents and settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-64cedb82-n\decora-sse.dll
2010-04-22 22:01 . 2010-04-22 22:01 12800 ----a-w- c:\documents and settings\Ana\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-64cedb82-n\decora-d3d.dll
2010-04-22 03:42 . 2010-04-22 03:42 -------- d-----w- C:\_OTL
2010-04-21 03:44 . 2010-04-21 03:44 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-04-21 03:41 . 2010-02-01 01:45 38784 ----a-w- c:\documents and settings\Rodger\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-04-21 03:41 . 2010-02-01 01:45 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-04-21 03:40 . 2010-04-21 03:40 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-04-21 03:40 . 2010-04-21 03:40 -------- d-----w- c:\program files\McAfee Security Scan
2010-04-21 03:39 . 2010-04-21 03:39 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-04-21 03:05 . 2010-04-21 03:05 503808 ----a-w- c:\documents and settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1732fc25-n\msvcp71.dll
2010-04-21 03:05 . 2010-04-21 03:05 499712 ----a-w- c:\documents and settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1732fc25-n\jmc.dll
2010-04-21 03:05 . 2010-04-21 03:05 348160 ----a-w- c:\documents and settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1732fc25-n\msvcr71.dll
2010-04-21 03:05 . 2010-04-21 03:05 61440 ----a-w- c:\documents and settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5ef7812e-n\decora-sse.dll
2010-04-21 03:05 . 2010-04-21 03:05 12800 ----a-w- c:\documents and settings\Rodger\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5ef7812e-n\decora-d3d.dll
2010-04-21 03:05 . 2010-04-21 03:05 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-21 02:21 . 2010-04-21 02:37 -------- d-----w- c:\documents and settings\Rodger\.SunDownloadManager
2010-04-19 04:50 . 2010-04-19 04:50 -------- d-----w- c:\documents and settings\Rodger\Local Settings\Application Data\Threat Expert
2010-04-19 01:48 . 2010-04-19 01:48 -------- d-----w- c:\documents and settings\Rodger\Local Settings\Application Data\avG
2010-04-18 20:22 . 2010-04-19 01:48 -------- d-----w- c:\documents and settings\All Users\Application Data\avG
2010-04-18 20:22 . 2010-04-18 20:22 -------- d-----w- c:\documents and settings\Ana\Local Settings\Application Data\avG
2010-04-17 06:14 . 2010-04-17 06:14 -------- d-----w- c:\documents and settings\Rodger\Application Data\Trillian
2010-04-17 00:48 . 2010-04-17 00:48 -------- d-----w- c:\documents and settings\Cassandra\Application Data\Malwarebytes
2010-04-17 00:18 . 2010-04-17 00:18 -------- d-----w- c:\documents and settings\Brian!\Application Data\Malwarebytes
2010-04-14 10:26 . 2010-04-14 10:26 20846064 ----a-w- c:\documents and settings\Ana\Application Data\Real\Update\setup3.10\rp\RealPlayerSPGold.exe
2010-04-14 10:25 . 2010-04-14 10:26 8405312 ----a-w- c:\documents and settings\Ana\Application Data\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2010-04-14 10:25 . 2010-04-14 10:25 149000 ----a-w- c:\documents and settings\Ana\Application Data\Real\Update\setup3.10\chr_helper\LaunchHelper.exe
2010-04-14 10:25 . 2010-04-14 10:25 10309448 ----a-w- c:\documents and settings\Ana\Application Data\Real\Update\setup3.10\chr\ChromeInstaller.exe
2010-04-14 10:25 . 2010-04-14 10:25 79368 ----a-w- c:\documents and settings\Ana\Application Data\Real\Update\setup3.10\RUP\vista.exe
2010-04-14 10:25 . 2010-04-14 10:25 64000 ----a-w- c:\documents and settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\gcapi_dll.dll
2010-04-14 10:25 . 2010-04-14 10:25 52288 ----a-w- c:\documents and settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\gtapi.dll
2010-04-14 10:25 . 2010-04-14 10:25 50688 ----a-w- c:\documents and settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\fftbapi.dll
2010-04-14 10:25 . 2010-04-14 10:25 49152 ----a-w- c:\documents and settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\CarboniteCompatibility.dll
2010-04-14 10:25 . 2010-04-14 10:25 118784 ----a-w- c:\documents and settings\Ana\Application Data\Real\Update\setup3.10\RUP\inst_config\compat.dll
2010-04-14 02:25 . 2010-04-14 02:25 439816 ----a-w- c:\documents and settings\Ana\Application Data\Real\Update\setup3.10\setup.exe
2010-04-14 01:24 . 2010-04-14 01:29 -------- d-----w- c:\documents and settings\Isa\Application Data\HPAppData
2010-04-14 01:24 . 2010-04-14 01:24 -------- d-----w- c:\documents and settings\Isa\Local Settings\Application Data\AskToolbar
2010-04-13 04:28 . 2010-04-13 04:28 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-04-12 01:18 . 2010-04-15 10:35 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-12 01:13 . 2010-04-12 01:14 -------- d-----w- c:\documents and settings\Rodger\Application Data\9746B5F4FFE46A0B806D1EEBD730D503
2010-04-11 12:12 . 2010-04-11 12:12 -------- d-----w- c:\documents and settings\Ana\Application Data\Office Genuine Advantage

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-28 23:24 . 2007-06-22 04:22 -------- d-----w- c:\program files\PeerGuardian2
2010-04-28 23:16 . 2007-08-08 21:01 -------- d-----w- c:\documents and settings\Brian!\Application Data\uTorrent
2010-04-28 22:47 . 2009-11-29 20:14 -------- d-----w- c:\documents and settings\Rodger\Application Data\HPAppData
2010-04-28 21:10 . 2008-01-06 08:10 -------- d-----w- c:\documents and settings\Brian!\Application Data\LimeWire
2010-04-28 21:05 . 2006-12-27 20:35 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2010-04-28 19:55 . 2006-12-27 23:33 -------- d-----w- c:\program files\Trillian
2010-04-28 18:30 . 2010-04-28 18:30 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2010-04-28 04:02 . 2009-12-27 02:32 -------- d-----w- c:\documents and settings\Brian!\Application Data\HPAppData
2010-04-27 22:29 . 2008-07-05 22:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-04-27 09:27 . 2007-12-14 22:27 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-26 05:14 . 2009-12-01 23:39 -------- d-----w- c:\documents and settings\Ana\Application Data\HPAppData
2010-04-25 05:12 . 2007-02-16 15:41 -------- d-----w- c:\documents and settings\Rodger\Application Data\Skype
2010-04-25 05:12 . 2007-01-28 21:06 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-25 05:05 . 2007-03-31 19:57 -------- d-----w- c:\program files\Serious Sam 2
2010-04-25 04:55 . 2006-12-27 20:56 -------- d--h--w- c:\program files\anywebcam
2010-04-25 04:02 . 2009-11-14 01:35 -------- d-----w- c:\documents and settings\Rodger\Application Data\skypePM
2010-04-24 07:02 . 2009-02-19 01:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-24 03:43 . 2007-02-06 19:19 -------- d-----w- c:\documents and settings\Ana\Application Data\Skype
2010-04-24 01:29 . 2009-06-10 00:46 -------- d-----w- c:\documents and settings\Ana\Application Data\skypePM
2010-04-23 02:41 . 2009-03-22 23:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-22 08:12 . 2004-08-04 12:00 75264 ----a-w- c:\windows\system32\drivers\ipsec.sys
2010-04-22 03:27 . 2009-08-19 12:35 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-04-21 03:43 . 2007-02-06 17:21 -------- d-----w- c:\program files\Common Files\Adobe
2010-04-21 03:41 . 2009-08-19 12:36 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-04-21 03:26 . 2006-12-26 22:30 -------- d-----w- c:\program files\Java
2010-04-21 03:05 . 2008-09-19 18:47 -------- d-----w- c:\program files\Common Files\Java
2010-04-19 04:40 . 2006-12-20 03:22 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-19 04:32 . 2009-11-05 23:46 -------- d-----w- c:\documents and settings\All Users\Application Data\BioWare
2010-04-19 04:27 . 2008-01-26 06:18 -------- d-----w- c:\program files\Electronic Arts
2010-04-19 04:26 . 2007-08-05 21:09 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-18 16:45 . 2008-09-06 14:43 -------- d-----w- c:\documents and settings\Ana\Application Data\U3
2010-04-15 23:12 . 2006-12-26 22:16 -------- d-----w- c:\program files\Google
2010-04-12 10:09 . 2009-11-10 02:00 79488 ----a-w- c:\documents and settings\Ana\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-30 04:46 . 2009-03-22 23:53 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-30 04:45 . 2009-03-22 23:53 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-29 19:33 . 2009-11-09 16:13 79488 ----a-w- c:\documents and settings\Brian!\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-28 19:21 . 2009-11-17 00:46 -------- d-----w- c:\program files\WBFS
2010-03-22 00:33 . 2010-02-02 02:31 -------- d-----w- c:\program files\Boardmaker with SD Pro
2010-03-15 04:33 . 2010-03-15 04:33 125952 ----a-w- c:\documents and settings\All Users\Application Data\ParetoLogic\UUS2\Temp\Update.exe
2010-03-14 11:52 . 2010-03-13 20:11 -------- d-----w- c:\documents and settings\Ana\Application Data\DriverCure
2010-03-13 20:11 . 2010-03-13 20:11 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2010-03-13 11:45 . 2010-02-02 02:33 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-03-10 06:15 . 2004-08-04 12:00 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-09 01:05 . 2008-03-18 17:52 -------- d-----w- c:\program files\Citrix
2010-03-09 01:05 . 2010-03-09 01:05 61224 ----a-w- c:\documents and settings\Rodger\GoToAssistDownloadHelper.exe
2010-03-07 20:23 . 2010-03-07 20:23 -------- d-----w- c:\documents and settings\All Users\Application Data\TomTom
2010-03-07 20:20 . 2010-03-07 20:20 -------- d-----w- c:\documents and settings\Brian!\Application Data\TomTom
2010-03-07 20:19 . 2010-03-07 20:19 -------- d-----w- c:\program files\TomTom International B.V
2010-03-07 20:19 . 2010-03-07 20:18 -------- d-----w- c:\program files\TomTom HOME 2
2010-03-07 20:09 . 2010-03-07 20:09 -------- d-----w- c:\program files\TomTom DesktopSuite
2010-03-03 02:50 . 2007-08-03 05:54 -------- d-----w- c:\program files\Steam
2010-02-25 06:24 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2004-08-04 12:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-19 23:47 . 2010-02-19 23:47 3604480 ----a-w- c:\windows\system32\GPhotos.scr
2010-02-16 14:08 . 2004-08-04 12:00 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25 . 2004-08-03 22:59 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 04:33 . 2004-08-04 12:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2004-08-04 12:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2007-01-01 21:17 . 2007-01-01 21:17 604 ---ha-w- c:\program files\STLL Notifier
2008-02-28 18:49 . 2008-02-28 18:49 27976 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2008-02-28 18:49 . 2008-02-28 18:49 125848 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-04-28_00.48.15 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-04-28 21:05 . 2010-04-28 21:05 16384 c:\windows\Temp\Perflib_Perfdata_20c.dat
+ 2007-02-06 17:21 . 2010-04-28 20:50 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2007-02-06 17:21 . 2010-04-27 22:35 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-02-06 17:21 . 2010-04-28 20:50 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-02-06 17:21 . 2010-04-27 22:35 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-02-06 17:21 . 2010-04-28 20:50 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2007-02-06 17:21 . 2010-04-27 22:35 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-09-02 19:56 1175944 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-09-02 1175944]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-09-02 1175944]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" [BU]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-05 68856]
"Uniblue RegistryBooster 2"="c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [BU]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [BU]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"mouseElf"="c:\progra~1\Evoluent\VERTIC~1\mouseElf.exe" [2004-06-04 184320]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"StartupDelayer"="c:\program files\r2 Studios\Startup Delayer\Startup Launcher.exe" [2008-11-29 73728]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 563984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 2027792]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2009-09-04 158448]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-02-26 132376]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"PC Pitstop Optimize Reminder"="c:\program files\PCPitstop\Optimize2\Reminder.exe" [BU]
"nwiz"="nwiz.exe" [2008-05-03 1630208]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [BU]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [BU]

c:\documents and settings\Brian!\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2009-9-30 503808]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"iPod Service"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Sierra\\FEARCombat\\fpupdate.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Sierra On-Line\\SIGSPat.exe"=
"c:\\Program Files\\UVU\\UVU Media Player\\UVUMediaPlayer.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Steam\\steamapps\\brianwhover\\source sdk base\\hl2.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Ruckus Player\\Ruckus.exe"=
"c:\\Program Files\\Motorola\\Software Update\\msu.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead demo\\left4dead.exe"=
"c:\\Program Files\\Steam\\steamapps\\brianwhover\\sin episodes emergence\\SinEpisodes.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\mount and blade demo\\runme.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\the wonderful end of the world demo\\main.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\peggle extreme\\PeggleExtreme.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\trine demo\\trine_launcher.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\fear2spdemo\\FEAR2SPDemo.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sam and max episode 2\\sammax102.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sam and max episode 3\\SamMax103.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sam and max episode 5\\SamMax105.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sam and max episode 4\\SamMax104.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sam and max episode 6\\SamMax106.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [2/6/2010 4:47 PM 93320]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [11/13/2009 7:31 AM 92008]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/12/2009 2:48 PM 24652]
S2 gupdate1ca2eea5fea6fe8;Google Update Service (gupdate1ca2eea5fea6fe8);c:\program files\Google\Update\GoogleUpdate.exe [9/6/2009 8:05 AM 133104]
S3 diskchk;diskchk;\??\c:\windows\system32\diskchk.sys --> c:\windows\system32\diskchk.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 8:49 AM 227232]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [4/28/2009 3:56 PM 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [4/28/2009 3:56 PM 8320]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [11/4/2007 2:31 PM 42112]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [10/30/2007 10:47 PM 23680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-04-28 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2006-12-26 19:14]

2010-04-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-06 12:05]

2010-04-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-06 12:05]

2010-03-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2010-02-06 17:22]

2010-04-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2010-02-06 17:22]

2010-04-28 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-09-02 19:56]

2010-04-28 c:\windows\Tasks\User_Feed_Synchronization-{DC9CEF1D-D2F9-4813-AB81-5F807018B7B2}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://sports.yahoo.com/nhl/blog/puck_daddy
uDefault_Search_URL = hxxp://www.google.com/ie
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.prey.com/readme
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
DPF: PackageCab - hxxp://www.imgag.com/cp/install/AxCtp2.cab
DPF: Ustream Publisher - hxxp://static.ustream.tv/plugin/3.1.5.2/ustream_publisher.cab
DPF: {22D4879A-92DB-470D-8A83-E158797D8176} - file:///F:/components/Liquid.ocx
DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - hxxp://activex.camfrogweb.com/advanced/2.0.2.23/cfweb_activex.camfrogweb.com-advanced-2.0.2.23_instmodule.exe
FF - ProfilePath - c:\documents and settings\Rodger\Application Data\Mozilla\Firefox\Profiles\zds2yhei.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.cnn.com/
FF - prefs.js: keyword.URL - chrome://google-partner/locale/partner.properties
FF - component: c:\documents and settings\Rodger\Application Data\Mozilla\Firefox\Profiles\zds2yhei.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\documents and settings\Ana\Application Data\Move Networks\plugins\npqmp071500000347.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NpPopup.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPUploader.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v1.02.08c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-AVG Anti-Spyware Driver
SafeBoot-WudfPf
SafeBoot-WudfRd
SafeBoot-AVG Anti-Spyware Guard



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-28 19:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-507921405-1580436667-682003330-1008\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:dd,9c,85,40,5b,91,39,b9,e4,42,71,aa,5e,aa,f0,0e,6e,2a,44,09,24,90,35,
a8,21,c8,c6,cc,07,c8,a6,ee,18,9d,6d,d3,8a,3a,ac,b8,50,87,11,39,90,9a,52,be,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22

[HKEY_USERS\S-1-5-21-507921405-1580436667-682003330-1008\Software\SecuROM\License information*]
"datasecu"=hex:ec,a2,5a,a3,72,49,cd,cd,b9,51,02,65,09,66,c1,49,ef,1b,a2,c6,14,
44,a6,ca,9d,df,db,9e,81,d3,fe,e4,8c,28,e2,31,0d,56,30,b9,ff,a2,6e,2b,32,b1,\
"rkeysecu"=hex:ee,b5,bf,71,17,64,74,51,c2,c5,66,77,96,b6,8f,4c
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(804)
c:\windows\system32\WININET.dll

- - - - - - - > 'winlogon.exe'(4828)
c:\windows\system32\WININET.dll

- - - - - - - > 'lsass.exe'(864)
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(2660)
c:\windows\system32\WININET.dll
c:\progra~1\mcafee\sitead~1\saHook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll

- - - - - - - > 'explorer.exe'(3884)
c:\windows\system32\WININET.dll
c:\progra~1\mcafee\sitead~1\saHook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-04-28 19:28:19
ComboFix-quarantined-files.txt 2010-04-28 23:28

Pre-Run: 50,023,813,120 bytes free
Post-Run: 50,034,544,640 bytes free

- - End Of File - - CD9C4450D72EC4272E2824A05C0CCF99

Hello.
Do you have the Extras.txt log from OTL?

I don't know if I have the Extras.txt log. I have a new problem, however. After running ComboFix again last night, I can no longer sign onto Windows XP. I have tried all the accounts and each time I click on the user account button, it begins to load but then almost immediately says something like logging out and then goes back to the screen showing the different accounts. I rebooted the computer but the problem persists. I have not had a chance to try Safe Mode yet.

Okay, try Safe Mode first.

I've tried Safe Mode (all variations) and Last Known Good Configuration, but cannot load Windows XP. Was this caused by Combo-Fix? Can you suggest how to fix this?
Thanks.

Hello. I have tried copying userinit.exe to wsaupdater.exe in the c:\windows\system32 folder. I have also copied and expanded userinit.exe from my Recovery CD to c:\windows\system32. So far nothing works. XP boots to the "welcome" screen but takes me right back there when I try to access any of the accounts.

No, Combofix wouldn't do this, the malware has locked us out.

Avira AntiVir Rescue System is a Linux-based application that allows accessing computers that cannot be booted anymore.

• Download The Avira AntiVir Rescue System from Antivir.de.
  
• Just double-click on the rescue system package to burn it to a CD/DVD.
  
• Then please use that CD/DVD with Avira Rescue System to boot your computer.
  

You'll get a boot option to either boot from hard drive or AntiVir Rescue System.


Press the number 2 on your keyboard to boot into AntiVir Rescue System.

Please wait until drivers are loaded and Main menu shows. Then please select the second option “Scan your system with AntiVir” and hit Enter.


Under Configuration, please select Scan all files, Try to repair infected files and Rename files if they cannot be removed?.


Then please start the scan.

The Avira AntiVir Rescue System wil now

• repair a damaged system,
  
• rescue data,
  
• scan the system for virus infections.
  

OK, I was able to scan the computer but it does not appear to have made any difference. I still cannot log in. After the scan completed, there were no further instructions or any indication that a log file was being created. I will run it again. By the way, the Main Menu does not appear. Do you know where on the hard drive I should look for the log file using the Commandline? Thanks.

I ran Avira again...no change, but I do see the log file information but not sure if I can copy the file onto my thumbdrive in DOS mode so I can post it. I'm also not sure which files are being scanned. I know there are many more files on the hard drives than were reported as having been scanned. The scan results are:

scanned files: 178001
scanned directories: 13499
records: 7
suspect files: 0
warnings: 2219

Hmmm.
We can keep trying, but if we can't fix this because of the damage done by the malware, the end result maybe formatting.

If there is nothing important on the machine, then a quicker way would be formatting right now.

Let me know.

Yes, I am thinking along the same lines, although I am thinking a new C drive and a fresh install of XP may be in order. There are a lot of important files on the current drive but I am assuming they are OK and I will be able to access them after the new drive is up and running XP again. The other thing I may try to do before installing a new HD is to connect my 1.5 TB external drive and copy data files in DOS mode. I assume there is feasible. What do you think? Thanks for all your help...it is truly appreciated.

Also, if this is the wsaupdater.exe malware, should I consider trying to manually edit the registry from the command prompt?

Hello.
No, if there is a file infecter infection, regardless of what we do, it wont help.

If you hook the current C:\ drive to another machine as a slave, you should be able to access your files that way.