Hi Gringo,
Enclosed is the OTL file you requested in order to go deeper and see if anything shows up.
Thanks, Hollis
OTL logfile created on: 6/12/2012 10:57:38 PM - Run 1
OTL by OldTimer - Version 3.2.48.0 Folder = C:\Documents and Settings\Hollis\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.99 Gb Total Physical Memory | 1.17 Gb Available Physical Memory | 59.03% Memory free
3.84 Gb Paging File | 3.22 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 274.55 Gb Total Space | 224.61 Gb Free Space | 81.81% Space Free | Partition Type: NTFS
Drive D: | 23.52 Gb Total Space | 13.19 Gb Free Space | 56.08% Space Free | Partition Type: FAT32
Computer Name: WANDA-154 | User Name: Hollis | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ========== PRC - C:\Documents and Settings\Hollis\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe (Acronis)
PRC - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
PRC - C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
PRC - C:\Program Files\Wireless-G Portable USB Adapter\WUSB54GP.exe (Cisco Linksys Corporation)
PRC - C:\Program Files\Wireless-G Portable USB Adapter\WLService.exe (GEMTEKS)
========== Modules (No Company Name) ========== MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\WINDOWS\system32\sbe.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\WINDOWS\system32\devenum.dll ()
MOD - C:\WINDOWS\system32\GTW32N50.dll ()
MOD - C:\Program Files\Wireless-G Portable USB Adapter\GEMWEP.DLL ()
========== Win32 Services (SafeList) ========== SRV - (WUSB54GPSVC) -- C:\Program Files\Wireless-G Portable USB Adapter\WLService.exe WUSB54GP.exe File not found
SRV - (WinDefend) -- %ProgramFiles%\Windows Defender\mpsvc.dll File not found
SRV - (usbatapi2000) -- %systemroot%\system32\SE27mdfl.dll File not found
SRV - (rpcsvr4x) -- %systemroot%\system32\wceusbsh.dll File not found
SRV - (NecUsb3) -- C:\WINDOWS\system32\NCUSBw32.dll File not found
SRV - (iphlpsvc) -- %SystemRoot%\System32\iphlpsvc.dll File not found
SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found
SRV - (JavaQuickStarterService) -- C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (Secunia PSI Agent) -- C:\Program Files\Secunia\PSI\psia.exe (Secunia)
SRV - (LiveUpdate) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE (Symantec Corporation)
SRV - (AddFiltr) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe (Hewlett-Packard Development Company, L.P.)
SRV - (AcrSch2Svc) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (WMConnectCDS) -- C:\Program Files\Windows Media Connect 2\wmccds.exe (Microsoft Corporation)
========== Driver Services (SafeList) ========== DRV - (WDICA) -- File not found
DRV - (UIUSys) -- system32\DRIVERS\UIUSYS.SYS File not found
DRV - (tdx) -- system32\DRIVERS\tdx.sys File not found
DRV - (SABProcEnum) -- C:\Program Files\Internet Explorer\SABProcEnum.sys File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (MFE_RR) -- C:\DOCUME~1\Hollis\LOCALS~1\Temp\mfe_rr.sys File not found
DRV - (mbr) -- C:\DOCUME~1\Hollis\LOCALS~1\Temp\mbr.sys File not found
DRV - (lbrtfdc) -- File not found
DRV - (Lbd) -- system32\DRIVERS\Lbd.sys File not found
DRV - (cpuz132) -- C:\DOCUME~1\Hollis\LOCALS~1\Temp\cpuz132\cpuz132_x32.sys File not found
DRV - (Changer) -- File not found
DRV - (catchme) -- C:\ComboFix\catchme.sys File not found
DRV - (mbamchameleon) -- C:\WINDOWS\system32\drivers\mbamchameleon.sys ()
DRV - (SmartDefragDriver) -- C:\WINDOWS\system32\drivers\SmartDefragDriver.sys ()
DRV - (PSI) -- C:\WINDOWS\system32\drivers\psi_mf.sys (Secunia)
DRV - (AE1000) -- C:\WINDOWS\system32\drivers\AE1000XP.sys (Ralink Technology, Corp.)
DRV - (NWADI) -- C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (NWUSBPort) -- C:\WINDOWS\system32\drivers\nwusbser.sys (Novatel Wireless Inc.)
DRV - (NWUSBModem) -- C:\WINDOWS\system32\drivers\nwusbmdm.sys (Novatel Wireless Inc.)
DRV - (SMSIVZAM5) -- C:\Program Files\Verizon Wireless\VZAccess Manager\SMSIVZAM5.sys (Smith Micro Inc.)
DRV - (timounter) -- C:\WINDOWS\system32\drivers\timntr.sys (Acronis)
DRV - (tifsfilter) -- C:\WINDOWS\system32\drivers\tifsfilt.sys (Acronis)
DRV - (snapman) -- C:\WINDOWS\system32\drivers\snapman.sys (Acronis)
DRV - (RMCAST) -- C:\WINDOWS\system32\drivers\rmcast.sys (Microsoft Corporation)
DRV - (NwlnkIpx) -- C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (MQAC) -- C:\WINDOWS\system32\drivers\mqac.sys (Microsoft Corporation)
DRV - (BANTExt) -- C:\WINDOWS\system32\drivers\BANTExt.sys ()
DRV - (SerEmulVsp) -- C:\WINDOWS\System32\drivers\SerEmulVsp.sys ()
DRV - (5U870CAP_VID_1262&PID_25FD) -- C:\WINDOWS\system32\drivers\5U870CAP.sys (Ricoh)
DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\CHDAud.sys (Conexant Systems Inc.)
DRV - (w39n51) Intel® -- C:\WINDOWS\system32\drivers\w39n51.sys (Intel® Corporation)
DRV - (HSF_DPV) -- C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (NwlnkNb) -- C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) -- C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (rimsptsk) -- C:\WINDOWS\system32\drivers\rimsptsk.sys (REDC)
DRV - (rimmptsk) -- C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (rismxdp) -- C:\WINDOWS\system32\drivers\rixdptsk.sys (REDC)
DRV - (eabusb) -- C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Development Company, L.P.)
DRV - (HBtnKey) -- C:\WINDOWS\system32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabfiltr) -- C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (rtl8139) Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (NSNDIS5) -- C:\WINDOWS\system32\nsndis5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (PRISM_A02) -- C:\WINDOWS\system32\drivers\WUSB20XP.sys (Cisco-Linksys, LLC.)
DRV - (GTNDIS5) -- C:\WINDOWS\system32\GTNDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (Ser2pl) -- C:\WINDOWS\system32\drivers\ser2pl.sys (Prolific Technology Inc.)
DRV - (Ca533av) Icatch(IV) -- C:\WINDOWS\system32\drivers\Ca533av.sys (Digital Camera)
DRV - (USBCamera) Icatch(IV) -- C:\WINDOWS\system32\drivers\Bulk533.sys (USB BULK)
DRV - (OlCamudp) -- C:\WINDOWS\system32\drivers\olcamudp.sys (OLYMPUS Optical Co.,Ltd.)
========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" =
http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1369428427-519700811-52094108-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.msnbc.msn.com/IE - HKU\S-1-5-21-1369428427-519700811-52094108-1006\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKU\S-1-5-21-1369428427-519700811-52094108-1006\..\SearchScopes,DefaultScope = {73E4D393-DA16-43A6-9CEE-213C8DC1BEF3}
IE - HKU\S-1-5-21-1369428427-519700811-52094108-1006\..\SearchScopes\{1359F30F-1B40-4209-BBB7-823C74A8FDCA}: "URL" =
http://www.bing.com/search?q={searchTerms}&form=IE8SRC&src=IE-SearchBoxIE - HKU\S-1-5-21-1369428427-519700811-52094108-1006\..\SearchScopes\{73E4D393-DA16-43A6-9CEE-213C8DC1BEF3}: "URL" =
http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}IE - HKU\S-1-5-21-1369428427-519700811-52094108-1006\..\SearchScopes\{B68B6922-362C-40BC-80BA-4F70E69AB3EB}: "URL" =
http://www.followtopia.com/index.phpIE - HKU\S-1-5-21-1369428427-519700811-52094108-1006\..\SearchScopes\{FB3B2BD5-2BFB-4EA2-B9BD-87B1795488CB}: "URL" =
http://search.yahoo.com/search?p={searchterms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20120101,6901,0,8,0IE - HKU\S-1-5-21-1369428427-519700811-52094108-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{D71DD730-2359-4C64-B32D-08F54B061984}: C:\Documents and Settings\Hollis\Local Settings\Application Data\{D71DD730-2359-4C64-B32D-08F54B061984}\ [2011/07/08 17:06:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{747E69DB-80DF-4DB0-8597-43E2709BD53B}: C:\Documents and Settings\Hollis\Local Settings\Application Data\{747E69DB-80DF-4DB0-8597-43E2709BD53B}\ [2011/07/09 07:22:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{D920E063-F502-4EEA-8CAC-3E32B770F692}: C:\Documents and Settings\Hollis\Local Settings\Application Data\{D920E063-F502-4EEA-8CAC-3E32B770F692}\ [2011/07/09 15:18:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{319ADB0B-05B2-4FA5-B0A8-65BDDF8D9BCC}: C:\Documents and Settings\Hollis\Local Settings\Application Data\{319ADB0B-05B2-4FA5-B0A8-65BDDF8D9BCC}\ [2011/07/09 15:26:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{AD9896DF-07BC-4E8A-A005-A6B5E8225FF9}: C:\Documents and Settings\Hollis\Local Settings\Application Data\{AD9896DF-07BC-4E8A-A005-A6B5E8225FF9}\ [2011/07/09 21:36:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{B249BAD8-56C5-40F9-9246-1B43061FF47F}: C:\Documents and Settings\Hollis\Local Settings\Application Data\{B249BAD8-56C5-40F9-9246-1B43061FF47F}\ [2011/07/09 21:40:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{48296676-0098-4CA4-958A-15CD68A40358}: C:\Documents and Settings\Hollis\Local Settings\Application Data\{48296676-0098-4CA4-958A-15CD68A40358}\ [2011/07/10 06:33:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{A8D003FD-2360-41A8-B57C-45A0DDCC0171}: C:\Documents and Settings\Hollis\Local Settings\Application Data\{A8D003FD-2360-41A8-B57C-45A0DDCC0171}\ [2011/07/11 08:40:41 | 000,000,000 | ---D | M]
O1 HOSTS File: ([2012/06/12 15:07:46 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (CatcherBHO Class) - {9B4DF450-DCC7-4B07-935D-0CD757A64583} - C:\Program Files\Moyea\YouTube FLV Downloader\MoyeaCatcher.dll (Moyea Software Co., Ltd.)
O3 - HKU\S-1-5-21-1369428427-519700811-52094108-1006\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\CHDAudPropShortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [MsmqIntCert] C:\WINDOWS\System32\mqrt.dll (Microsoft Corporation)
O4 - HKLM..\Run: [RecGuard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe (Acronis)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\StartUp\Secunia PSI Tray.lnk = C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\StartUp\Vongo Tray.lnk = File not found
O4 - Startup: C:\Documents and Settings\Wanda Clark\Start Menu\Programs\StartUp\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1369428427-519700811-52094108-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1369428427-519700811-52094108-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1369428427-519700811-52094108-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKU\S-1-5-21-1369428427-519700811-52094108-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1369428427-519700811-52094108-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 File not found
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}
http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533}
https://support.microsoft.com/Dcode/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166}
http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6770.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1241989445343 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5}
http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab (Java Plug-in 1.7.0_04)
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD}
http://www.superadblocker.com/activex/sabspx.cab (SABScanProcesses Class)
O16 - DPF: {CAFEEFAC-0017-0000-0004-ABCDEFFEDCBA}
http://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab (Java Plug-in 1.7.0_04)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab (Java Plug-in 1.7.0_04)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044}
http://cam.thesylvaherald.com/activex/AMC.cab (AxisMediaControlEmb Class)
O16 - DPF: Garmin Communicator Plug-In
https://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{264765A9-B784-4177-98EF-7659D0F0D8B3}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Hollis\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Hollis\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)
O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/28 03:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKU\S-1-5-21-1369428427-519700811-52094108-1006..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ========== [2012/06/12 22:53:55 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Hollis\Desktop\OTL.exe
[2012/06/12 22:52:45 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/06/12 22:31:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2012/06/12 11:46:07 | 002,127,960 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Hollis\Desktop\tdsskiller.exe
[2012/06/12 09:27:21 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2012/06/12 09:24:51 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012/06/12 09:24:51 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012/06/12 09:24:51 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012/06/12 09:24:51 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012/06/12 09:24:40 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/06/12 08:47:14 | 004,556,029 | R--- | C] (Swearware) -- C:\Documents and Settings\Hollis\Desktop\ComboFix.exe
[2012/06/11 15:27:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\New Malware Removal Posts Folder (1)
[2012/06/11 14:34:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Local Settings\Application Data\Secunia PSI
[2012/06/11 14:16:49 | 000,000,000 | ---D | C] -- C:\Program Files\Secunia
[2012/06/10 17:44:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Start Menu\Programs\HiJackThis
[2012/06/10 17:44:55 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2012/06/10 17:37:27 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2012/06/10 17:37:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Start Menu\Programs\Revo Uninstaller
[2012/06/10 16:42:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Local Settings\Application Data\Sun
[2012/06/10 16:07:04 | 000,000,000 | ---D | C] -- C:\Program Files\Oracle
[2012/06/10 16:06:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Application Data\Oracle
[2012/06/10 16:06:47 | 000,772,504 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\npDeployJava1.dll
[2012/06/10 16:06:47 | 000,227,784 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2012/06/10 16:06:39 | 000,174,024 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2012/06/10 16:06:39 | 000,174,024 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2012/06/08 15:27:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\GooredFix Backups
[2012/06/08 15:25:29 | 000,071,398 | ---- | C] (jpshortstuff) -- C:\Documents and Settings\Hollis\Desktop\GooredFix.exe
[2012/06/08 14:11:17 | 000,000,000 | ---D | C] -- C:\_OTM
[2012/06/08 14:07:38 | 000,523,264 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Hollis\Desktop\OTM.exe
[2012/06/08 14:03:24 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2012/06/08 14:01:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
[2012/06/08 14:01:36 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2012/06/08 12:42:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\What The Tech
[2012/06/08 12:10:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\Malware Removal
[2012/06/07 20:13:45 | 000,014,664 | ---- | C] (McAfee, Inc.) -- C:\WINDOWS\stinger.sys
[2012/06/07 20:11:04 | 000,000,000 | ---D | C] -- C:\Program Files\stinger
[2012/06/07 18:47:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\Macafee Spyware Removal
[2012/06/07 14:14:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\New Folder
[2012/06/06 15:07:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\Geeks To Go Malware Removal
[2012/06/06 15:06:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\Daniweb Malware Cleanup
[2012/06/06 15:03:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\DSL Malware Cleanup
[2012/06/06 15:00:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\Microsoft Spyware Removal
[2012/06/06 14:59:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\Virtual Doctor Malware Removal
[2012/06/06 14:47:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\Spyware Hammer Info
[2012/06/06 07:23:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\NC Cabin Solo Sprayer
[2012/06/05 15:47:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\Bleep Preparation Guide Programs
[2012/06/05 15:37:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\Computer How To Burn Iso File CD
[2012/06/05 11:47:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\Windows Firewall Repair Info
[2012/06/04 20:14:20 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Hollis\Desktop\aswMBR.exe
[2012/06/04 15:05:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\Kaspersky Info
[2012/06/04 09:31:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\PCHealth
[2012/06/04 09:31:05 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2012/06/03 07:00:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\F4D55EFF00043AFD00245298D151FC4E
[2012/05/31 13:15:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\Alaska pdf info
[2012/05/29 10:34:56 | 000,419,488 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/05/27 06:08:44 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Hollis\Recent
[2012/05/19 11:44:49 | 000,000,000 | ---D | C] -- C:\bd_logs
[2012/05/19 09:25:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\Desktop\Computer Discovered Malware
[2012/05/19 07:43:57 | 000,000,000 | ---D | C] -- C:\Program Files\Cobian Backup 11
[2012/05/18 12:56:39 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012/05/17 22:40:39 | 019,585,536 | ---- | C] (Luis Cobian, CobianSoft) -- C:\Documents and Settings\Hollis\Desktop\cbSetup.exe
[2012/05/17 22:36:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hollis\My Documents\GPS NC Cabin Master Trails
========== Files - Modified Within 30 Days ========== [2012/06/12 22:54:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/12 22:54:00 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/12 22:53:53 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hollis\Desktop\OTL.exe
[2012/06/12 22:34:25 | 000,559,444 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\How do I remove ZeroAccess (Sirefef) rootkit - ESET Knowledgebase.mht
[2012/06/12 15:12:32 | 000,516,732 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/06/12 15:12:32 | 000,093,254 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/06/12 15:07:46 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012/06/12 15:07:32 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/06/12 15:07:30 | 2137,051,136 | -HS- | M] () -- C:\hiberfil.sys
[2012/06/12 13:50:36 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\MBR.dat
[2012/06/12 11:46:07 | 002,127,960 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Hollis\Desktop\tdsskiller.exe
[2012/06/12 09:27:29 | 000,000,325 | RHS- | M] () -- C:\boot.ini
[2012/06/12 08:47:14 | 004,556,029 | R--- | M] (Swearware) -- C:\Documents and Settings\Hollis\Desktop\ComboFix.exe
[2012/06/11 15:05:11 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Hollis\defogger_reenable
[2012/06/11 14:34:02 | 000,000,753 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2012/06/11 09:02:02 | 000,984,985 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\ESET Get a FREE Online Virus Scan.mht
[2012/06/10 17:47:00 | 000,002,449 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\HiJackThis Trend Micro.lnk
[2012/06/10 17:37:27 | 000,000,917 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\Revo Uninstaller.lnk
[2012/06/10 16:34:13 | 000,675,918 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller.mht
[2012/06/10 16:29:54 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2012/06/10 16:06:10 | 000,227,784 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2012/06/10 16:06:10 | 000,174,024 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2012/06/10 16:06:10 | 000,143,872 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl
[2012/06/10 16:06:09 | 000,174,024 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2012/06/08 19:23:24 | 000,853,862 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\SecurityCheck.exe
[2012/06/08 18:44:07 | 000,649,414 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\Bleep Virus, Trojan, Spyware, and Malware Removal Logs - BleepingComputer_com.mht
[2012/06/08 18:30:50 | 000,088,007 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\KeePass Password Safe.mht
[2012/06/08 15:25:30 | 000,071,398 | ---- | M] (jpshortstuff) -- C:\Documents and Settings\Hollis\Desktop\GooredFix.exe
[2012/06/08 14:11:20 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20120608-152313.backup
[2012/06/08 14:07:51 | 000,523,264 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hollis\Desktop\OTM.exe
[2012/06/08 14:01:38 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\ERUNT.lnk
[2012/06/08 13:53:21 | 000,001,519 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\Notepad.lnk
[2012/06/07 20:34:54 | 000,000,057 | RH-- | M] () -- C:\Documents and Settings\Hollis\Desktop\stinger.opt
[2012/06/07 20:13:45 | 000,014,664 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\stinger.sys
[2012/06/07 16:25:49 | 000,032,072 | ---- | M] () -- C:\WINDOWS\System32\drivers\48230029.sys
[2012/06/05 23:19:59 | 001,027,072 | ---- | M] (Acronis) -- C:\WINDOWS\System32\AutoPartNt.exe
[2012/06/05 11:40:09 | 000,196,044 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\GFI Backup 2009 Home Edition - a worthy alternative to the Backup and Restore Center Windows 7, Windows 8, Windows Vista and XP Tutorials.mht
[2012/06/04 20:14:20 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Hollis\Desktop\aswMBR.exe
[2012/06/04 16:12:30 | 000,302,391 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\Kaspersky Lab Forum - Virus-related issues.mht
[2012/06/04 12:26:44 | 000,072,748 | ---- | M] (Jordan Russell) -- C:\WINDOWS\unins000.exe
[2012/06/04 12:26:44 | 000,000,659 | ---- | M] () -- C:\WINDOWS\unins000.dat
[2012/06/04 12:25:26 | 000,288,093 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\icon_restore.exe
[2012/06/04 11:12:36 | 000,000,041 | ---- | M] () -- C:\WINDOWS\loc2.INI
[2012/06/04 11:12:25 | 000,000,041 | ---- | M] () -- C:\WINDOWS\FindServ.INI
[2012/06/04 10:34:31 | 000,001,698 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\Microsoft Security Essentials.lnk
[2012/06/04 10:33:52 | 000,001,917 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2012/06/04 09:30:45 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/06/02 15:19:44 | 000,022,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wucltui.dll.mui
[2012/06/02 15:19:38 | 000,329,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wucltui.dll
[2012/06/02 15:19:38 | 000,329,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wucltui.dll
[2012/06/02 15:19:38 | 000,219,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuaucpl.cpl
[2012/06/02 15:19:38 | 000,210,968 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuweb.dll
[2012/06/02 15:19:34 | 000,097,304 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cdm.dll
[2012/06/02 15:19:34 | 000,097,304 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\cdm.dll
[2012/06/02 15:19:34 | 000,053,784 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuauclt.exe
[2012/06/02 15:19:34 | 000,045,080 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wups2.dll
[2012/06/02 15:19:34 | 000,035,864 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wups.dll
[2012/06/02 15:19:34 | 000,035,864 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wups.dll
[2012/06/02 15:19:34 | 000,015,384 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wuapi.dll.mui
[2012/06/02 15:19:24 | 000,577,048 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wuapi.dll
[2012/06/02 15:19:24 | 000,577,048 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuapi.dll
[2012/06/02 15:19:18 | 001,933,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuaueng.dll
[2012/06/02 15:18:58 | 000,275,696 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll
[2012/06/02 15:18:58 | 000,017,136 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui
[2012/05/31 09:22:09 | 000,599,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\crypt32.dll
[2012/05/29 14:34:17 | 002,017,658 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\Wrangler Power Products.pdf
[2012/05/29 10:34:56 | 000,419,488 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/05/29 10:34:56 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/05/17 23:11:31 | 000,297,629 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\how to save address book in outlook express - Google Search.mht
[2012/05/17 23:11:14 | 001,218,134 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\How to back up and to restore Outlook Express data.mht
[2012/05/17 22:28:19 | 163,238,912 | ---- | M] () -- C:\Documents and Settings\Hollis\Desktop\Backup.bkf
[2012/05/17 17:35:22 | 019,585,536 | ---- | M] (Luis Cobian, CobianSoft) -- C:\Documents and Settings\Hollis\Desktop\cbSetup.exe
========== Files Created - No Company Name ========== [2012/06/12 22:34:21 | 000,559,444 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\How do I remove ZeroAccess (Sirefef) rootkit - ESET Knowledgebase.mht
[2012/06/12 13:50:36 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\MBR.dat
[2012/06/12 09:27:29 | 000,000,209 | ---- | C] () -- C:\Boot.bak
[2012/06/12 09:27:22 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2012/06/12 09:24:51 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/06/12 09:24:51 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/06/12 09:24:51 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/06/12 09:24:51 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/06/12 09:24:51 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/06/11 15:05:11 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Hollis\defogger_reenable
[2012/06/11 14:34:02 | 000,000,753 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2012/06/11 14:34:02 | 000,000,716 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Secunia PSI.lnk
[2012/06/11 09:01:54 | 000,984,985 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\ESET Get a FREE Online Virus Scan.mht
[2012/06/10 17:37:27 | 000,000,917 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\Revo Uninstaller.lnk
[2012/06/10 16:34:13 | 000,675,918 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller.mht
[2012/06/10 16:29:54 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2012/06/10 16:29:54 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2012/06/08 19:23:24 | 000,853,862 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\SecurityCheck.exe
[2012/06/08 18:44:01 | 000,649,414 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\Bleep Virus, Trojan, Spyware, and Malware Removal Logs - BleepingComputer_com.mht
[2012/06/08 18:30:44 | 000,088,007 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\KeePass Password Safe.mht
[2012/06/08 14:01:38 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\ERUNT.lnk
[2012/06/08 13:53:21 | 000,001,519 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\Notepad.lnk
[2012/06/07 20:34:54 | 000,000,057 | RH-- | C] () -- C:\Documents and Settings\Hollis\Desktop\stinger.opt
[2012/06/07 13:34:20 | 000,032,072 | ---- | C] () -- C:\WINDOWS\System32\drivers\48230029.sys
[2012/06/05 11:40:06 | 000,196,044 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\GFI Backup 2009 Home Edition - a worthy alternative to the Backup and Restore Center Windows 7, Windows 8, Windows Vista and XP Tutorials.mht
[2012/06/04 16:17:42 | 2137,051,136 | -HS- | C] () -- C:\hiberfil.sys
[2012/06/04 16:12:28 | 000,302,391 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\Kaspersky Lab Forum - Virus-related issues.mht
[2012/06/04 12:26:44 | 000,000,659 | ---- | C] () -- C:\WINDOWS\unins000.dat
[2012/06/04 12:25:23 | 000,288,093 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\icon_restore.exe
[2012/06/04 10:34:31 | 000,001,698 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\Microsoft Security Essentials.lnk
[2012/06/04 09:31:22 | 000,001,698 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk
[2012/05/29 14:34:01 | 002,017,658 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\Wrangler Power Products.pdf
[2012/05/17 23:11:27 | 000,297,629 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\how to save address book in outlook express - Google Search.mht
[2012/05/17 23:11:06 | 001,218,134 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\How to back up and to restore Outlook Express data.mht
[2012/05/17 22:26:36 | 163,238,912 | ---- | C] () -- C:\Documents and Settings\Hollis\Desktop\Backup.bkf
[2012/05/10 17:25:22 | 000,032,072 | ---- | C] () -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2012/05/07 19:59:41 | 000,000,129 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2012/05/07 17:53:31 | 000,219,481 | ---- | C] () -- C:\Documents and Settings\Hollis\Local Settings\Application Data\census.cache
[2012/05/07 17:53:13 | 000,211,123 | ---- | C] () -- C:\Documents and Settings\Hollis\Local Settings\Application Data\ars.cache
[2012/05/07 17:11:01 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/02/08 05:13:44 | 000,103,733 | ---- | C] () -- C:\WINDOWS\System32\itusbcore.dat
[2012/02/08 05:13:44 | 000,000,197 | ---- | C] () -- C:\WINDOWS\System32\itlsvc.dat
[2012/02/07 16:54:46 | 000,000,192 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~J9JMTydFW7L72lr
[2012/02/07 16:54:45 | 000,000,280 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~J9JMTydFW7L72l
[2012/02/07 16:47:40 | 000,000,336 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\J9JMTydFW7L72l
[2012/01/05 12:18:45 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2011/12/10 09:48:03 | 000,025,944 | ---- | C] () -- C:\WINDOWS\System32\SmartDefragBootTime.exe
[2011/12/10 09:48:03 | 000,014,776 | ---- | C] () -- C:\WINDOWS\System32\drivers\SmartDefragDriver.sys
[2011/07/13 13:34:16 | 000,013,931 | R--- | C] () -- C:\WINDOWS\System32\RaCoInst.dat
[2011/07/10 17:35:05 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Hollis\Local Settings\Application Data\housecall.guid.cache
[2011/07/08 12:19:16 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Lxixezezoc.dat
[2011/07/08 12:19:16 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Ttubusefubemob.bin
[2010/11/13 11:51:09 | 000,000,286 | ---- | C] () -- C:\WINDOWS\reimage.ini
[2010/10/24 23:04:04 | 000,045,568 | ---- | C] () -- C:\Documents and Settings\Hollis\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/03 12:41:44 | 000,001,888 | ---- | C] () -- C:\WINDOWS\CA533A.INI
[2010/10/03 12:41:43 | 000,118,784 | ---- | C] () -- C:\WINDOWS\ShowBmp.exe
[2010/10/03 12:41:43 | 000,001,325 | ---- | C] () -- C:\WINDOWS\Remove.ini
[2010/07/13 14:20:40 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\qtXLS.dll
[2010/06/22 16:08:48 | 000,000,577 | ---- | C] () -- C:\WINDOWS\System32\gmsblist.dll
[2006/03/16 00:00:00 | 000,002,048 | -HS- | C] () -- C:\WINDOWS\Installer\{cd1cb43e-227b-d6c0-0e06-a6a1ffe5dedd}\@
[2006/03/16 00:00:00 | 000,002,048 | -HS- | C] () -- C:\Documents and Settings\Hollis\Local Settings\Application Data\{cd1cb43e-227b-d6c0-0e06-a6a1ffe5dedd}\@
========== Alternate Data Streams ========== @Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
< End of report >
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
This topic is locked
attach.txt.txt 16.09K
2 downloads
Back to top
