winbluesoft please help

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:11:13 PM, on 5/17/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Windows\helppane.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Justin and Mary\Desktop\hijackgpthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "C:\Windows\system32\RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] "C:\Windows\system32\RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe"
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [setup2.exe] C:\Windows\system32\setup2.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4FDDE46D-85AA-421A-A126-7CEC18C4357A}: NameServer = 85.255.112.144,85.255.112.5
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.144,85.255.112.5
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.144,85.255.112.5
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.144,85.255.112.5
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 7418 bytes

this fake antivirus is killing my computer. I cannot access the internet unless in safe mode with networking and when i am in normal mode the compter is lagged out by fake antivirus popups. as well as a computer is low on memory warning, crashes with a blue screen when i attempted a system restore, freezes when i try to install things. redirects me when attempting to view windowsupdate.com and many other virus removal sites and such. any help would be greatly appreciated. before i joined this forum i bought a new antivirus from best buy Webroot AntiVirus with Antispyware but cannot update the definitions because of the redirector.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
  O1 - Hosts: ::1 localhost
  O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O4 - HKCU\..\Run: [setup2.exe] C:\Windows\system32\setup2.exe
  O17 - HKLM\System\CCS\Services\Tcpip\..\{4FDDE46D-85AA-421A-A126-7CEC18C4357A}: NameServer = 85.255.112.144,85.255.112.5
  O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.144,85.255.112.5
  O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.144,85.255.112.5
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.144,85.255.112.5
  
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE.

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

Note: This tool was posted specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Now, start The Avenger program by clicking on its icon on your desktop.

• Leave the script box empty.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

3. Please copy/paste the content of c:\avenger.txt into your reply.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "gxvxcserv.sys" found!
ImagePath: \systemroot\system32\drivers\gxvxcwvqmturtnppxufhraieqtfrvtxknpsqp.sys
Driver disabled successfully.

Rootkit scan completed.


Completed script processing.

*******************

Finished! Terminate.

1. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to delete:
gxvxcserv.sys

Files to delete:
C:\WINDOWS\system32\drivers\gxvxcwvqmturtnppxufhraieqtfrvtxknpsqp.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

3. Please copy/paste the content of c:\avenger.txt into your reply.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "gxvxcserv.sys" deleted successfully.
File "C:\WINDOWS\system32\drivers\gxvxcwvqmturtnppxufhraieqtfrvtxknpsqp.sys" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes' Anti-Malware 1.36
Database version: 2146
Windows 6.0.6001 Service Pack 1

5/17/2009 10:56:47 PM
mbam-log-2009-05-17 (22-56-47).txt

Scan type: Quick Scan
Objects scanned: 84287
Time elapsed: 3 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 21
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{2bc9a3bd-9ff9-4c52-b8b8-8051adaa7ff6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7a8c49cb-a790-4024-b1fb-0c01094f379d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{53322b35-2c26-4fac-a713-c31bbaa1c636} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Bind (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\RECYCLER\S-4-6-56-100031062-100024350-100002594-8518.com (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Users\Justin and Mary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IE Antivirus.lnk (Rogue.IEAntiVirus) -> Quarantined and deleted successfully.
C:\Windows\3934doznl5ader1080.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\2911tzr9at208155.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\4807z5arse20819.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\gxvxccounter (Trojan.DNSchanger) -> Quarantined and deleted successfully.
C:\Windows\System32\gxvxcscrtxifptscmeyjmprtpoxoecmwnvnlq.dll (Trojan.Agent) -> Quarantined and deleted successfully.

is that the last step? everything appears to be working good.

To save Origin some time, I'll give you the next instructions.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  
• Double click DDS.scr to run.
  
• When complete, two logs will open. Save both of the report to your Desktop.
  
• Copy and paste DDS.txt back here, I don't need to see attach.txt.
  

DDS (Ver_09-05-14.01) - NTFSx86
Run by Justin and Mary at 11:54:07.90 on Mon 05/18/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows Vista Home Premium 6.0.6001.1.1252.1.1033.18.2045.1119 [GMT -4:00]


============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Webroot\WebrootSecurity\SSU.EXE
C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Justin and Mary\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
uSearch Bar = Preserve
mStart Page = hxxp://www.yahoo.com/
mDefault_Page_URL = hxxp://www.yahoo.com/
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
mURLSearchHooks: H - No File
BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll
TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
uRun: [ehTray.exe] "c:\windows\ehome\ehTray.exe"
uRun: [WMPNSCFG] "c:\program files\windows media player\WMPNSCFG.exe"
uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRunOnce: [FlashPlayerUpdate] "c:\windows\system32\macromed\flash\FlashUtil9f.exe"
mRun: []
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [NvCplDaemon] "c:\windows\system32\rundll32.exe" c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] "c:\windows\system32\rundll32.exe" c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SpySweeper] c:\program files\webroot\webrootsecurity\SpySweeperUI.exe /startintray
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0\bin\ssv.dll
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\justin~1\appdata\roaming\mozilla\firefox\profiles\q916imq6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npoji610.dll
FF - plugin: c:\program files\ksolo\npAVX.dll
FF - plugin: c:\users\justin and mary\appdata\roaming\mozilla\firefox\profiles\q916imq6.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071303000004.dll

============= SERVICES / DRIVERS ===============

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2008-11-12 29808]
R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\webrootsecurity\WRConsumerService.exe [2009-5-16 1181040]
R3 UsbFltr;Razer Copperhead Driver;c:\windows\system32\drivers\copperhd.sys [2007-3-19 11596]
S3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\drivers\gan_adapter.sys [2006-8-28 10664]
S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\drivers\Razerlow.sys [2005-4-24 13225]

=============== Created Last 30 ================

2009-05-17 22:35 --d----- c:\users\justin~1\appdata\roaming\Malwarebytes
2009-05-17 22:35 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-05-17 22:35 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-17 22:35 --d----- c:\programdata\Malwarebytes
2009-05-17 22:35 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-05-17 22:35 --d----- c:\progra~2\Malwarebytes
2009-05-17 20:58 244 a---h--- C:\sqmnoopt16.sqm
2009-05-17 20:58 232 a---h--- C:\sqmdata16.sqm
2009-05-17 20:57 232 a---h--- C:\sqmdata15.sqm
2009-05-17 20:57 244 a---h--- C:\sqmnoopt15.sqm
2009-05-17 20:45 244 a---h--- C:\sqmnoopt14.sqm
2009-05-17 20:45 232 a---h--- C:\sqmdata14.sqm
2009-05-17 20:07 244 a---h--- C:\sqmnoopt13.sqm
2009-05-17 20:07 232 a---h--- C:\sqmdata13.sqm
2009-05-17 19:49 164 a------- c:\windows\install.dat
2009-05-16 14:21 --d----- c:\program files\common files\MSSoap
2009-05-16 14:21 --d----- C:\Binaries
2009-05-16 14:20 1,563,008 a------- c:\windows\WRSetup.dll
2009-05-16 14:20 --d----- c:\users\justin~1\appdata\roaming\Webroot
2009-05-16 14:20 --d----- c:\programdata\Webroot
2009-05-16 14:20 --d----- c:\program files\Webroot
2009-05-16 14:20 --d----- c:\progra~2\Webroot
2009-05-15 22:38 506,368 a------- c:\windows\system32\msxml.dll
2009-05-15 20:12 192,171,419 a------- c:\windows\MEMORY.DMP
2009-05-15 06:59 14,081 a------- c:\windows\system32\299145rzj1c1.cpl
2009-05-14 20:15 10,237 a------- c:\windows\56c4a5d9are1z15.ocx
2009-05-13 23:49 10,971 a------- c:\windows\98zstea910215.bin
2009-05-13 19:53 2,539 a------- c:\windows\7z4th9eat9775.dll
2009-05-10 23:46 14,704 a------- c:\windows\system32\8c8zddware22935.bin
2009-05-09 18:29 7,283 a------- c:\windows\system32\zdd5s95rse21.ocx
2009-05-05 21:12 4,669 a------- c:\windows\75f5thief1z79.ocx
2009-05-04 19:22 --d----- c:\users\justin~1\appdata\roaming\SPORE
2009-05-04 02:21 10,006 a------- c:\windows\system32\5630wzrm95d.exe
2009-05-03 10:29 5,683 a------- c:\windows\system32\1zevi91105.bin
2009-05-02 09:00 11,381 a------- c:\windows\system32\5f9avir5z9.ocx
2009-05-02 06:20 5,933 a------- c:\windows\system32\7596spambot10z.cpl
2009-05-01 02:22 10,557 a------- c:\windows\system32\5ez5stea9521.ocx
2009-05-01 01:35 6,369 a------- c:\windows\system32\1250zworm289.cpl
2009-04-28 13:35 6,894 a------- c:\windows\system32\9f6bvzr24725.dll
2009-04-28 10:15 9,599 a------- c:\windows\system32\6391wozm50c5.dll
2009-04-28 05:57 3,697 a------- c:\windows\z6f9vir1159.ocx
2009-04-28 05:45 13,107 a------- c:\windows\6798n9tza-v5rus11.dll
2009-04-25 19:41 17,773 a------- c:\windows\system32\4f14dzw9l5ader417.ocx
2009-04-24 18:47 7,576 a------- c:\windows\system32\zc925ackdoor3210.ocx
2009-04-23 22:47 8,409 a------- c:\windows\17z38spamb5t496.bin
2009-04-22 20:45 13,475 a------- c:\windows\system32\6179ha9k5ool7fz.bin
2009-04-22 17:48 14,032 a------- c:\windows\23474noz-a-virus59c.ocx
2009-04-18 16:00 13,400 a------- c:\windows\9f5asteal2z96.dll

==================== Find3M ====================

2009-05-17 20:03 176,752 a------- c:\windows\system32\drivers\ssidrv.sys
2009-05-17 20:03 29,808 a------- c:\windows\system32\drivers\ssfs0bbc.sys
2009-05-17 20:03 23,152 a------- c:\windows\system32\drivers\sshrmd.sys
2009-05-15 20:37 17,072 a------- c:\windows\1z0c9ir658.bin
2009-04-20 11:21 3,116 a------- c:\windows\system32\ealregsnapshot1.reg
2009-04-18 07:03 15,139 a------- c:\windows\system32\75d8backzoor2889.dll
2009-04-18 01:33 6,819 a------- c:\windows\system32\5z31hackto9l2235.exe
2009-04-14 20:43 18,302 a------- c:\windows\system32\16556zo9mc9.bin
2009-04-13 19:42 10,245 a------- c:\windows\dd79pyza5e202.dll
2009-04-13 12:19 143,360 a------- c:\windows\inf\infstrng.dat
2009-04-13 12:19 51,200 a------- c:\windows\inf\infpub.dat
2009-04-13 12:19 86,016 a------- c:\windows\inf\infstor.dat
2009-04-12 21:40 4,185 a------- c:\windows\system32\zedas5ywar9941.exe
2009-04-12 12:05 5,435 a------- c:\windows\system32\19e3steal5677z.dll
2009-04-11 20:19 14,855 a------- c:\windows\z9759ir3260.exe
2009-04-11 11:23 18,105 a------- c:\windows\23235v5r9s7z.bin
2009-04-09 13:54 2,706 a------- c:\windows\system32\22955hackt9ol5z.bin
2009-04-08 18:49 17,400 a------- c:\windows\2726addwarez295.dll
2009-04-07 23:35 13,709 a------- c:\windows\984sp5zse905.dll
2009-04-06 08:51 3,089 a------- c:\windows\12419ddwarz1945.dll
2009-04-05 02:36 17,124 a------- c:\windows\system32\28054no5-azvirus902.exe
2009-04-04 03:04 4,364 a------- c:\windows\system32\72f9do5nloaderz790.exe
2009-03-27 15:17 14,896 a------- c:\windows\7z97spyw9r52932.bin
2009-03-27 08:14 453,152 a------- c:\windows\system32\nvuninst.exe
2009-03-25 01:11 2,976 a------- c:\windows\system32\754e9hzeat30571.dll
2009-03-19 04:39 8,281 a------- c:\windows\3c8czp5wa9e3090.bin
2009-03-19 00:02 5,762 a------- c:\windows\system32\7979vi51z43.exe
2009-03-17 13:33 14,436 a------- c:\windows\system32\556bbazkdoor2595.bin
2009-03-16 23:38 40,960 a------- c:\windows\apppatch\apihex86.dll
2009-03-16 23:38 13,824 a------- c:\windows\system32\apilogen.dll
2009-03-16 23:38 24,064 a------- c:\windows\system32\amxread.dll
2009-03-13 19:33 4,592 a------- c:\windows\system32\5z495ir323.exe
2009-03-11 09:14 16,322 a------- c:\windows\system32\7455zacktool53e9.exe
2009-03-08 07:34 914,944 a------- c:\windows\system32\wininet.dll
2009-03-08 07:34 43,008 a------- c:\windows\system32\licmgr10.dll
2009-03-08 07:33 18,944 a------- c:\windows\system32\corpol.dll
2009-03-08 07:33 109,056 a------- c:\windows\system32\iesysprep.dll
2009-03-08 07:33 109,568 a------- c:\windows\system32\PDMSetup.exe
2009-03-08 07:33 132,608 a------- c:\windows\system32\ieUnatt.exe
2009-03-08 07:33 107,520 a------- c:\windows\system32\RegisterIEPKEYs.exe
2009-03-08 07:33 107,008 a------- c:\windows\system32\SetIEInstalledDate.exe
2009-03-08 07:33 103,936 a------- c:\windows\system32\SetDepNx.exe
2009-03-08 07:33 420,352 a------- c:\windows\system32\vbscript.dll
2009-03-08 07:32 72,704 a------- c:\windows\system32\admparse.dll
2009-03-08 07:32 71,680 a------- c:\windows\system32\iesetup.dll
2009-03-08 07:32 66,560 a------- c:\windows\system32\wextract.exe
2009-03-08 07:32 169,472 a------- c:\windows\system32\iexpress.exe
2009-03-08 07:31 34,816 a------- c:\windows\system32\imgutil.dll
2009-03-08 07:31 48,128 a------- c:\windows\system32\mshtmler.dll
2009-03-08 07:31 45,568 a------- c:\windows\system32\mshta.exe
2009-03-08 07:22 156,160 a------- c:\windows\system32\msls31.dll
2009-03-07 05:27 4,580 a------- c:\windows\3b9addwzr59361.dll
2009-03-06 10:00 15,737 a------- c:\windows\1z926worm4725.bin
2009-03-04 12:41 14,385 a------- c:\windows\5zf2dow95oader1263.exe
2009-03-03 00:46 3,599,328 a------- c:\windows\system32\ntkrnlpa.exe
2009-03-03 00:46 3,547,632 a------- c:\windows\system32\ntoskrnl.exe
2009-03-03 00:39 183,296 a------- c:\windows\system32\sdohlp.dll
2009-03-03 00:39 551,424 a------- c:\windows\system32\rpcss.dll
2009-03-03 00:39 26,112 a------- c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 00:37 98,304 a------- c:\windows\system32\iasrecst.dll
2009-03-03 00:37 54,784 a------- c:\windows\system32\iasads.dll
2009-03-03 00:37 44,032 a------- c:\windows\system32\iasdatastore.dll
2009-03-02 23:04 666,624 a------- c:\windows\system32\printfilterpipelinesvc.exe
2009-03-02 22:38 17,408 a------- c:\windows\system32\iashost.exe
2009-03-01 22:04 11,858 a------- c:\windows\356bvzr9955.dll
2009-02-22 00:50 3,372 a------- c:\windows\793bsp5rsez990.bin
2009-02-21 05:24 10,557 a------- c:\windows\3855downz5ader891.exe
2009-02-18 06:43 9,758 a------- c:\windows\system32\19955s9y5dz.exe
2008-09-24 01:56 174 a--sh--- c:\program files\desktop.ini
2008-09-24 01:44 665,600 a------- c:\windows\inf\drvindex.dat
2008-06-03 17:13 87,608 a------- c:\users\justin~1\appdata\roaming\inst.exe
2008-06-03 17:13 47,360 a------- c:\users\justin~1\appdata\roaming\pcouffin.sys
2007-12-23 03:47 246 a------- c:\users\justin~1\appdata\roaming\wklnhst.dat
2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat
2008-03-30 11:00 168 a--shr-- c:\windows\system32\094DA40C77.sys
2008-03-30 11:08 3,350 a--sh--- c:\windows\system32\KGyGaAvL.sys

============= FINISH: 11:54:33.72 ===============

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  C:\sqmnoopt*.sqm
  C:\sqmdata*.sqm
  c:\windows\system32\299145rzj1c1.cpl
  c:\windows\56c4a5d9are1z15.ocx
  c:\windows\98zstea910215.bin
  c:\windows\7z4th9eat9775.dll
  c:\windows\system32\8c8zddware22935.bin
  c:\windows\system32\zdd5s95rse21.ocx
  c:\windows\75f5thief1z79.ocx
  c:\windows\system32\5630wzrm95d.exe
  c:\windows\system32\1zevi91105.bin
  c:\windows\system32\5f9avir5z9.ocx
  c:\windows\system32\7596spambot10z.cpl
  c:\windows\system32\5ez5stea9521.ocx
  c:\windows\system32\1250zworm289.cpl
  c:\windows\system32\9f6bvzr24725.dll
  c:\windows\system32\6391wozm50c5.dll
  c:\windows\z6f9vir1159.ocx
  c:\windows\6798n9tza-v5rus11.dll
  c:\windows\system32\4f14dzw9l5ader417.ocx
  c:\windows\system32\zc925ackdoor3210.ocx
  c:\windows\17z38spamb5t496.bin
  c:\windows\system32\6179ha9k5ool7fz.bin
  c:\windows\23474noz-a-virus59c.ocx
  c:\windows\9f5asteal2z96.dll
  c:\windows\1z0c9ir658.bin
  c:\windows\system32\ealregsnapshot1.reg
  c:\windows\system32\75d8backzoor2889.dll
  c:\windows\system32\5z31hackto9l2235.exe
  c:\windows\system32\16556zo9mc9.bin
  c:\windows\dd79pyza5e202.dll
  c:\windows\system32\zedas5ywar9941.exe
  c:\windows\system32\19e3steal5677z.dll
  c:\windows\z9759ir3260.exe
  c:\windows\23235v5r9s7z.bin
  c:\windows\system32\22955hackt9ol5z.bin
  c:\windows\2726addwarez295.dll
  c:\windows\984sp5zse905.dll
  c:\windows\12419ddwarz1945.dll
  c:\windows\system32\28054no5-azvirus902.exe
  c:\windows\system32\72f9do5nloaderz790.exe
  c:\windows\7z97spyw9r52932.bin
  c:\windows\system32\nvuninst.exe
  c:\windows\system32\754e9hzeat30571.dll
  c:\windows\3c8czp5wa9e3090.bin
  c:\windows\system32\7979vi51z43.exe
  c:\windows\system32\556bbazkdoor2595.bin
  c:\windows\system32\5z495ir323.exe
  c:\windows\system32\7455zacktool53e9.exe
  c:\windows\3b9addwzr59361.dll
  c:\windows\1z926worm4725.bin
  c:\windows\5zf2dow95oader1263.exe
  c:\windows\356bvzr9955.dll
  c:\windows\793bsp5rsez990.bin
  c:\windows\3855downz5ader891.exe
  c:\windows\system32\19955s9y5dz.exe
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

my machine rebooted after a few error messages then the program was closed before i could copy the green bar info. when the system rebooted i got this notepad doc:
========== FILES ==========
File move failed. C:\sqmnoopt00.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt01.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt02.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt03.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt04.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt05.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt06.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt07.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt08.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt09.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt10.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt11.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt12.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt13.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt14.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt15.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt16.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata00.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata01.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata02.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata03.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata04.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata05.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata06.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata07.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata08.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata09.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata10.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata11.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata12.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata13.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata14.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata15.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata16.sqm scheduled to be moved on reboot.
c:\windows\system32\299145rzj1c1.cpl moved successfully.
LoadLibrary failed for c:\windows\56c4a5d9are1z15.ocx
c:\windows\56c4a5d9are1z15.ocx NOT unregistered.
c:\windows\56c4a5d9are1z15.ocx moved successfully.
c:\windows\98zstea910215.bin moved successfully.
LoadLibrary failed for c:\windows\7z4th9eat9775.dll
c:\windows\7z4th9eat9775.dll NOT unregistered.
c:\windows\7z4th9eat9775.dll moved successfully.
c:\windows\system32\8c8zddware22935.bin moved successfully.
LoadLibrary failed for c:\windows\system32\zdd5s95rse21.ocx
c:\windows\system32\zdd5s95rse21.ocx NOT unregistered.
c:\windows\system32\zdd5s95rse21.ocx moved successfully.
LoadLibrary failed for c:\windows\75f5thief1z79.ocx
c:\windows\75f5thief1z79.ocx NOT unregistered.
c:\windows\75f5thief1z79.ocx moved successfully.
c:\windows\system32\5630wzrm95d.exe moved successfully.
c:\windows\system32\1zevi91105.bin moved successfully.
LoadLibrary failed for c:\windows\system32\5f9avir5z9.ocx
c:\windows\system32\5f9avir5z9.ocx NOT unregistered.
c:\windows\system32\5f9avir5z9.ocx moved successfully.
c:\windows\system32\7596spambot10z.cpl moved successfully.
LoadLibrary failed for c:\windows\system32\5ez5stea9521.ocx
c:\windows\system32\5ez5stea9521.ocx NOT unregistered.
c:\windows\system32\5ez5stea9521.ocx moved successfully.
c:\windows\system32\1250zworm289.cpl moved successfully.
LoadLibrary failed for c:\windows\system32\9f6bvzr24725.dll
c:\windows\system32\9f6bvzr24725.dll NOT unregistered.
c:\windows\system32\9f6bvzr24725.dll moved successfully.
LoadLibrary failed for c:\windows\system32\6391wozm50c5.dll
c:\windows\system32\6391wozm50c5.dll NOT unregistered.
c:\windows\system32\6391wozm50c5.dll moved successfully.
LoadLibrary failed for c:\windows\z6f9vir1159.ocx
c:\windows\z6f9vir1159.ocx NOT unregistered.
c:\windows\z6f9vir1159.ocx moved successfully.
LoadLibrary failed for c:\windows\6798n9tza-v5rus11.dll
c:\windows\6798n9tza-v5rus11.dll NOT unregistered.
c:\windows\6798n9tza-v5rus11.dll moved successfully.
LoadLibrary failed for c:\windows\system32\4f14dzw9l5ader417.ocx
c:\windows\system32\4f14dzw9l5ader417.ocx NOT unregistered.
c:\windows\system32\4f14dzw9l5ader417.ocx moved successfully.
LoadLibrary failed for c:\windows\system32\zc925ackdoor3210.ocx
c:\windows\system32\zc925ackdoor3210.ocx NOT unregistered.
c:\windows\system32\zc925ackdoor3210.ocx moved successfully.
c:\windows\17z38spamb5t496.bin moved successfully.
c:\windows\system32\6179ha9k5ool7fz.bin moved successfully.
LoadLibrary failed for c:\windows\23474noz-a-virus59c.ocx
c:\windows\23474noz-a-virus59c.ocx NOT unregistered.
c:\windows\23474noz-a-virus59c.ocx moved successfully.
LoadLibrary failed for c:\windows\9f5asteal2z96.dll
c:\windows\9f5asteal2z96.dll NOT unregistered.
c:\windows\9f5asteal2z96.dll moved successfully.
c:\windows\1z0c9ir658.bin moved successfully.
File move failed. c:\windows\system32\ealregsnapshot1.reg scheduled to be moved on reboot.
LoadLibrary failed for c:\windows\system32\75d8backzoor2889.dll
c:\windows\system32\75d8backzoor2889.dll NOT unregistered.
c:\windows\system32\75d8backzoor2889.dll moved successfully.
c:\windows\system32\5z31hackto9l2235.exe moved successfully.
c:\windows\system32\16556zo9mc9.bin moved successfully.
LoadLibrary failed for c:\windows\dd79pyza5e202.dll
c:\windows\dd79pyza5e202.dll NOT unregistered.
c:\windows\dd79pyza5e202.dll moved successfully.
c:\windows\system32\zedas5ywar9941.exe moved successfully.
LoadLibrary failed for c:\windows\system32\19e3steal5677z.dll
c:\windows\system32\19e3steal5677z.dll NOT unregistered.
c:\windows\system32\19e3steal5677z.dll moved successfully.
c:\windows\z9759ir3260.exe moved successfully.
c:\windows\23235v5r9s7z.bin moved successfully.
c:\windows\system32\22955hackt9ol5z.bin moved successfully.
LoadLibrary failed for c:\windows\2726addwarez295.dll
c:\windows\2726addwarez295.dll NOT unregistered.
c:\windows\2726addwarez295.dll moved successfully.
LoadLibrary failed for c:\windows\984sp5zse905.dll
c:\windows\984sp5zse905.dll NOT unregistered.
c:\windows\984sp5zse905.dll moved successfully.
LoadLibrary failed for c:\windows\12419ddwarz1945.dll
c:\windows\12419ddwarz1945.dll NOT unregistered.
c:\windows\12419ddwarz1945.dll moved successfully.
c:\windows\system32\28054no5-azvirus902.exe moved successfully.
c:\windows\system32\72f9do5nloaderz790.exe moved successfully.
c:\windows\7z97spyw9r52932.bin moved successfully.
File move failed. c:\windows\system32\nvuninst.exe scheduled to be moved on reboot.
LoadLibrary failed for c:\windows\system32\754e9hzeat30571.dll
c:\windows\system32\754e9hzeat30571.dll NOT unregistered.
c:\windows\system32\754e9hzeat30571.dll moved successfully.
c:\windows\3c8czp5wa9e3090.bin moved successfully.
c:\windows\system32\7979vi51z43.exe moved successfully.
c:\windows\system32\556bbazkdoor2595.bin moved successfully.
c:\windows\system32\5z495ir323.exe moved successfully.
c:\windows\system32\7455zacktool53e9.exe moved successfully.
LoadLibrary failed for c:\windows\3b9addwzr59361.dll
c:\windows\3b9addwzr59361.dll NOT unregistered.
c:\windows\3b9addwzr59361.dll moved successfully.
c:\windows\1z926worm4725.bin moved successfully.
c:\windows\5zf2dow95oader1263.exe moved successfully.
LoadLibrary failed for c:\windows\356bvzr9955.dll
c:\windows\356bvzr9955.dll NOT unregistered.
c:\windows\356bvzr9955.dll moved successfully.
c:\windows\793bsp5rsez990.bin moved successfully.
c:\windows\3855downz5ader891.exe moved successfully.
c:\windows\system32\19955s9y5dz.exe moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05182009_122211

Files moved on Reboot...
File move failed. C:\sqmnoopt00.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt01.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt02.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt03.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt04.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt05.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt06.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt07.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt08.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt09.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt10.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt11.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt12.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt13.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt14.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt15.sqm scheduled to be moved on reboot.
File move failed. C:\sqmnoopt16.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata00.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata01.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata02.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata03.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata04.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata05.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata06.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata07.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata08.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata09.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata10.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata11.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata12.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata13.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata14.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata15.sqm scheduled to be moved on reboot.
File move failed. C:\sqmdata16.sqm scheduled to be moved on reboot.
File move failed. c:\windows\system32\ealregsnapshot1.reg scheduled to be moved on reboot.
File move failed. c:\windows\system32\nvuninst.exe scheduled to be moved on reboot.

We can remove OTMoveIt now.

• Please double-click OTMoveIt3.exe to run it again.
  
• Press the green CleanUp! button.
  
• Press Yes cleanup process prompt, do the same for the reboot prompt.
  

How is the machine running now?

evrything seems to be running great. can i go back to using my antivirus without having any conflicts?

I would recommend Avira.

Please install Avira antivirus otherwise you won't be protected.

1) Antivir PersonalEditionClassic
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.

thank you for you help everything appears to be working great.