Infected - exploit.JS.Pdfka.ama and possibly more...

First, thank you very much in advance for entertaining my problem. This forum appears to be an amazing resource that I'm very pleased to have found. Now, on to the actual problem... :-(

My desktop came to a grinding halt the other day with IE crashing and now not working at all. I use Zone Labs Security Suite for both FW and AV so I immediately started scanning and found exploit.JS.Pdfka.ama along with some other garp that I promptly removed. Unfortunately after repeated scans and removals I still have the same disabled desktop behavior, so am looking for some more advanced help.

Symptoms include:

Upon startup I get the following dialog as Windows loads...

dialog box title = rundll32.exe - Bad Image
dialog contents = The application or DLL C:\DOCUME~\NETWOR~1\ntuser.dll is not a valid Windows image. Please check this against your installation diskette.

After clicking past that dialog I get...

dialog box title = RUNDLL
dialog contents line 1 = Error Loading C:\DOCUME~1\NETWOR~1\ntuser.dll
dialog contents line 2 = %1 is not a valid Win32 application.

When trying to open IE, I get...

dialog box title = iexplore.exe - Application Error
dialog contents = The instruction at "0xb067f0ac" referenced memory at "0xb067f0ac". The memory could not be "written".

When I close that dialog I get...

dialog box title = Data Execution Prevention - Microsoft Windows
dialog contents = To help protect your computer, Windows has closed this program.
Name: Internet Explorer
Publisher: Microsoft Corporation

Finally, at shutdown I get...

dialog box title = Exlporer.exe - Application Error
dialog contents = The instruction at "0x10001bce" referenced memory at "0x10001bce". The memory could not be "written".

Here is the DDS log and I am attaching the other files as instructed...

DDS (Ver_09-10-26.01) - NTFSx86
Run by SGR at 11:27:51.32 on Sat 11/21/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.511 [GMT -7:00]

AV: ZoneAlarm Security Suite Antivirus *On-access scanning enabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
AV: *On-access scanning disabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FW: ZoneAlarm Security Suite Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Preo\Printelligence\prprn.exe
C:\Program Files\Preo\Printelligence\prprncs.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Preo\Printelligence\prprnal.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Palm\hotsync.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\Documents and Settings\SGR\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.excite.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://us.mcafee.com/root/learnmore/learnmore.asp?close=true&lcode=en-us
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: ZoneAlarm Toolbar Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\googleafe\GoogleAE.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: ZoneAlarm Toolbar: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [calc] rundll32.exe c:\docume~1\networ~1\ntuser.dll,_IWMPEvents@0
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [Printelligence] c:\program files\preo\printelligence\prprnal.exe
mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [ISW] "c:\program files\checkpoint\zaforcefield\ForceField.exe" /icon="hidden"
mRun: [calc] rundll32.exe c:\windows\system32\calc.dll,_IWMPEvents@0
StartupFolder: c:\docume~1\sgr\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palm\hotsync.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
mPolicies-system: EnableLUA = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/3/9/8/398422c0-8d3e-40e1-a617-af65a72a0465/LegitCheckControl.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {6F750202-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
DPF: {6F750203-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
DPF: {712362BF-E411-4F43-99D2-EB15F80AF1DB} - hxxp://entimg.msn.com/client/msnediag7705.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\sgr\applic~1\mozilla\firefox\profiles\se01iekm.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\program files\checkpoint\zaforcefield\trustchecker\components\TrustCheckerMozillaPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2009-10-14 25208]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2009-10-14 476528]
R2 Printelligence;Printelligence;c:\program files\preo\printelligence\prprn.exe [2008-7-2 111928]
R2 PrintelligenceClientService;PrintelligenceClientService;c:\program files\preo\printelligence\prprncs.exe [2008-7-2 70968]
S3 getPlusHelper;getPlus® Helper;c:\windows\system32\svchost.exe -k getPlusHelper [2005-8-16 14336]
S3 VisorUsb;Handspring USB;c:\windows\system32\drivers\VisorUsb.sys [2006-3-3 19968]

=============== Created Last 30 ================

2009-11-21 18:02:58 0 d-----w- c:\program files\Trend Micro
2009-11-12 18:44:55 0 d-----w- c:\docume~1\alluse~1\applic~1\Kaspersky SDK
2009-11-12 18:22:46 0 d-----w- c:\docume~1\sgr\applic~1\CheckPoint
2009-11-12 18:22:03 0 d-----w- c:\program files\CheckPoint
2009-11-12 18:21:58 128016 ----a-w- c:\windows\system32\drivers\kl1.sys

==================== Find3M ====================

2009-11-21 18:02:48 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-10-22 09:19:04 5939712 ----a-w- c:\windows\system32\dllcache\mshtml.dll
2009-10-18 13:34:44 0 ---ha-w- c:\windows\system32\drivers\Msft_User_ZuneDriver_01_09_00.Wdf
2009-10-18 13:34:44 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_WinUSB_01009.Wdf
2009-10-18 13:33:54 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_09_00.Wdf
2009-10-17 08:39:40 72584 ----a-w- c:\windows\zllsputility.exe
2009-10-17 08:39:32 1238408 ----a-w- c:\windows\system32\zpeng25.dll
2009-10-11 11:17:27 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-29 15:41:38 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_zumbus_01009.Wdf
2009-09-29 15:41:35 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2009-09-11 14:18:39 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-11 14:18:39 136192 ------w- c:\windows\system32\dllcache\msv1_0.dll
2009-09-04 21:03:36 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-04 21:03:36 58880 ------w- c:\windows\system32\dllcache\msasn1.dll
2009-09-04 19:17:00 447216 ----a-w- c:\windows\system32\ZuneWlanCfgSvc.exe
2009-09-04 19:16:54 58592 ----a-w- c:\windows\system32\ZuneBusEnum.exe
2009-09-02 06:29:12 74240 ----a-w- c:\windows\system32\ZuneUsbTransport.dll
2009-09-02 06:29:10 57344 ----a-w- c:\windows\system32\ZuneRegUtil.dll
2009-09-02 06:29:10 18944 ----a-w- c:\windows\system32\ZuneTcp2Udp.dll
2009-09-02 06:29:10 12800 ----a-w- c:\windows\system32\ZunePTDNS.dll
2009-09-02 06:29:02 310784 ----a-w- c:\windows\system32\ZuneNetProxy.dll
2009-09-02 06:29:00 147456 ----a-w- c:\windows\system32\ZuneMTPZ.dll
2009-08-28 10:35:52 173056 ----a-w- c:\windows\system32\dllcache\ie4uinit.exe
2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-26 08:00:21 247326 ------w- c:\windows\system32\dllcache\strmdll.dll
2006-12-18 15:51:42 104 --sh--r- c:\windows\system32\3AED0C315E.sys
2007-07-04 16:52:53 88 --sh--r- c:\windows\system32\5E310CED3A.sys
2009-03-21 14:06:58 24064 --sha-w- c:\windows\system32\calc.dll
2007-07-04 16:55:10 5852 --sha-w- c:\windows\system32\KGyGaAvL.sys
2008-09-06 00:00:12 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090520080906\index.dat

============= FINISH: 11:30:21.07 ===============

Hello!
My name is Sam and I will be helping you.

In order to see what's going on with your computer I will ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.


Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

• Make sure you are connected to the Internet.
• Double-click on Download_mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.




We need to create an OTL Report

• Please download OTL from here
• Save it to your desktop.
• Double click on the icon on your desktop.
• Click the "Scan All Users" checkbox.
• Under the Custom Scan box paste this in
  
  netsvcs
  %systemdrive%\*.exe
  %SYSTEMDRIVE%\eventlog.dll /s /md5
  %SYSTEMDRIVE%\nvstor.sys /s /md5
  %SYSTEMDRIVE%\atapi.sys /s /md5
  %SYSTEMDRIVE%\viasraid.sys /s /md5
  %SYSTEMDRIVE%\AGP440.sys /s /md5
  %SYSTEMDRIVE%\vaxscsi.sys /s /md5
  %SYSTEMDRIVE%\nvatabus.sys /s /md5
  %SYSTEMDRIVE%\viamraid.sys /s /md5
  %SYSTEMDRIVE%\nvata.sys /s /md5
  %SYSTEMDRIVE%\tdl*.dll /s /md5
  CREATERESTOREPOINT
  
  
  
  
• Click the "Quick Scan" button.
• The scan should take just a few minutes.
• Please copy and paste both logs back here in your next reply.

First, thank you Sam for your help! It is greatly appreciated.

Not sure if it's relevant, but I thought perhaps I should let you know that I am working between computers because the desktop IE doesn't work. In other words, I'm using IE on my laptop, transferring stuff to the desktop, running it, getting the results back on a USB drive, and then sending via the laptop.

When I rebooted the desktop as requested by malwarebytes I got the following dialog...

Dialog box title = RUNDLL
Dialog contents line 1 = Error loading C:\WINDOWS\System32\calc.dll
Dialog contents line 2 = The specified module could not be found.

Here is the malwarebytes log:

Malwarebytes' Anti-Malware 1.41
Database version: 3210
Windows 5.1.2600 Service Pack 3

11/21/2009 4:20:43 PM
mbam-log-2009-11-21 (16-20-43).txt

Scan type: Quick Scan
Objects scanned: 127942
Time elapsed: 13 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 2
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 11

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\calc.dll (Trojan.Agent) -> Delete on reboot.

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\GenericMultiMedia (Trojan.WinCoDecPRO) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\calc (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Services\del (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\calc (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\MediaSystem (Trojan.WinCoDecPRO) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\calc.dll (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\SGR\Start Menu\Programs\Startup\scandisk.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\SGR\Local Settings\Temp\rundll32.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\SGR\ntuser.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\MediaSystem\1.gif (Trojan.WinCoDecPRO) -> Quarantined and deleted successfully.
C:\Program Files\MediaSystem\wall.html (Trojan.WinCoDecPRO) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\ntuser.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\SGR\Start Menu\Programs\Startup\scandisk.lnk (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\_id.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\SGR\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\SGR\Local Settings\Temp\c.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

...and here is the OTL log:

OTL logfile created on: 11/21/2009 4:29:13 PM - Run 1
OTL by OldTimer - Version 3.1.6.2 Folder = C:\Documents and Settings\SGR\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1022.07 Mb Total Physical Memory | 521.70 Mb Available Physical Memory | 51.04% Memory free
2.40 Gb Paging File | 1.94 Gb Available in Paging File | 81.06% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 69.80 Gb Total Space | 31.91 Gb Free Space | 45.72% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 971.97 Mb Total Space | 965.80 Mb Free Space | 99.37% Space Free | Partition Type: FAT32
Drive G: | 55.89 Gb Total Space | 28.16 Gb Free Space | 50.39% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SGR1
Current User Name: SGR
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2009/11/21 15:53:46 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\SGR\Desktop\OTL.exe
PRC - [2009/10/17 01:41:10 | 02,384,240 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2009/10/17 01:39:40 | 01,037,192 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2009/10/14 06:30:26 | 00,476,528 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe
PRC - [2009/10/14 06:30:06 | 00,730,480 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
PRC - [2009/10/11 04:17:36 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2009/10/11 04:17:35 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009/09/10 11:15:42 | 00,870,672 | ---- | M] (SonicWALL, Inc.) -- C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
PRC - [2009/09/04 12:16:54 | 00,158,448 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Zune\ZuneLauncher.exe
PRC - [2009/09/04 12:16:54 | 00,058,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ZuneBusEnum.exe
PRC - [2008/07/02 13:20:32 | 00,070,968 | ---- | M] (Preo) -- C:\Program Files\Preo\Printelligence\prprncs.exe
PRC - [2008/07/02 13:20:28 | 00,058,680 | ---- | M] (Preo Software Inc.) -- C:\Program Files\Preo\Printelligence\prprnal.exe
PRC - [2008/07/02 13:20:26 | 00,111,928 | ---- | M] (Preo) -- C:\Program Files\Preo\Printelligence\prprn.exe
PRC - [2008/04/13 17:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
PRC - [2008/04/13 17:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/06/22 15:28:49 | 00,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2007/03/15 10:09:36 | 00,460,784 | ---- | M] (Gteko Ltd.) -- C:\Program Files\DellSupport\DSAgnt.exe
PRC - [2006/10/09 16:16:56 | 00,237,568 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\ehrecvr.exe
PRC - [2005/09/29 13:01:14 | 00,067,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\ehtray.exe
PRC - [2005/09/23 22:05:26 | 00,029,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
PRC - [2005/08/05 12:56:32 | 00,102,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\ehSched.exe
PRC - [2005/08/05 12:56:28 | 00,046,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\ehmsas.exe
PRC - [2005/08/04 03:02:58 | 00,380,928 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe
PRC - [2005/06/10 09:44:02 | 00,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
PRC - [2005/03/22 23:20:44 | 00,339,968 | ---- | M] (SigmaTel, Inc.) -- C:\WINDOWS\stsystra.exe
PRC - [2005/02/23 15:19:56 | 00,053,248 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
PRC - [2003/06/19 22:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
PRC - [2000/03/17 14:11:10 | 00,265,728 | ---- | M] (Palm Computing, Inc., a 3Com Company) -- C:\Program Files\Palm\hotsync.exe


========== Modules (SafeList) ==========

MOD - [2009/11/21 15:53:46 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\SGR\Desktop\OTL.exe
MOD - [2009/10/14 06:30:36 | 00,628,080 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
MOD - [2009/09/10 11:15:48 | 00,013,072 | ---- | M] () -- C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\MlfHook.dll
MOD - [2009/03/21 07:06:58 | 00,024,064 | ---- | M] (Microsoft) -- C:\Documents and Settings\SGR\ntuser.dll
MOD - [2008/07/25 10:17:20 | 00,635,904 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
MOD - [2008/07/25 10:17:20 | 00,558,080 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
MOD - [2008/07/02 13:20:20 | 00,130,360 | ---- | M] (Preo Software Inc.) -- C:\Program Files\Preo\Printelligence\AppDetectA.dll
MOD - [2008/04/13 17:12:51 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
MOD - [2008/04/13 17:12:00 | 00,025,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mslbui.dll
MOD - [2008/04/13 17:11:53 | 00,185,344 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\framedyn.dll
MOD - [2004/08/10 04:00:00 | 00,002,560 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\lz32.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/10/17 01:41:10 | 02,384,240 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2009/10/14 06:30:26 | 00,476,528 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe -- (IswSvc)
SRV - [2009/10/11 04:17:35 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009/09/23 16:36:06 | 00,051,168 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus®
SRV - [2009/09/04 12:17:00 | 00,447,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc)
SRV - [2009/09/04 12:16:54 | 05,893,360 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc)
SRV - [2009/09/04 12:16:54 | 00,058,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ZuneBusEnum.exe -- (ZuneBusEnum)
SRV - [2009/04/29 14:21:40 | 00,182,768 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2008/07/29 20:10:04 | 00,046,104 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0)
SRV - [2008/07/29 18:24:50 | 00,881,664 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc)
SRV - [2008/07/29 18:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008/07/25 10:17:02 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/07/25 10:16:40 | 00,034,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state)
SRV - [2008/07/02 13:20:32 | 00,070,968 | ---- | M] (Preo) -- C:\Program Files\Preo\Printelligence\prprncs.exe -- (PrintelligenceClientService)
SRV - [2008/07/02 13:20:26 | 00,111,928 | ---- | M] (Preo) -- C:\Program Files\Preo\Printelligence\prprn.exe -- (Printelligence)
SRV - [2008/04/13 17:12:02 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll -- (helpsvc)
SRV - [2007/03/07 14:47:46 | 00,076,848 | ---- | M] () -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc)
SRV - [2006/10/09 16:16:56 | 00,237,568 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\ehrecvr.exe -- (ehRecvr)
SRV - [2005/08/05 12:56:32 | 00,102,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\ehSched.exe -- (ehSched)
SRV - [2005/08/05 12:27:08 | 00,099,328 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\mcrdsvc.exe -- (McrdSvc)
SRV - [2005/08/04 03:02:58 | 00,380,928 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller)
SRV - [2005/04/03 23:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/11/19 10:26:40 | 00,147,456 | ---- | M] (Intel® Corporation) -- C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe -- (NetSvc)
SRV - [2003/07/28 11:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003/06/19 22:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&client=dell
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://www.google.com/ig/dell?hl=en&client=dell


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&client=dell
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/dell?hl=en&client=dell
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&client=dell
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/dell?hl=en&client=dell
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&client=dell
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\S-1-5-21-1334875122-2706632779-302846874-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - HKLM\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/02 02:00:35 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2008/12/15 08:15:20 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2009/11/12 11:42:32 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.12\extensions\\Components: C:\PROGRA~1\Mozilla Firefox\components [2008/06/19 08:13:01 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.12\extensions\\Plugins: C:\PROGRA~1\Mozilla Firefox\plugins [2009/11/03 11:43:41 | 00,000,000 | ---D | M]

[2009/11/12 11:22:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Mozilla\Firefox\Profiles\se01iekm.default\extensions
[2009/11/12 11:22:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Mozilla\Firefox\Profiles\se01iekm.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/11/04 10:44:19 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2008/04/06 17:22:17 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2007/04/11 06:59:34 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
[2007/08/11 07:49:52 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
[2007/10/11 12:45:05 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
[2008/03/13 12:51:20 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
[2008/08/11 07:43:59 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
[2008/12/15 08:15:46 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2009/04/06 11:14:12 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009/06/12 18:30:17 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009/08/08 09:51:59 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2009/11/04 10:44:20 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2008/04/06 17:22:02 | 00,067,696 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jar50.dll
[2008/04/06 17:22:02 | 00,054,376 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jsd3250.dll
[2008/04/06 17:22:02 | 00,034,952 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\myspell.dll
[2008/04/06 17:22:04 | 00,046,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\spellchk.dll
[2008/04/06 17:22:04 | 00,172,144 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\xpinstal.dll
[2009/10/11 04:17:27 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll
[2008/04/06 17:22:13 | 00,022,664 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
[2009/09/23 16:36:40 | 00,032,448 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\Mozilla Firefox\plugins\np_gp.dll
[2008/04/06 17:22:16 | 00,001,514 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml
[2008/04/06 17:22:16 | 00,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml
[2008/04/06 17:22:16 | 00,001,038 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml
[2008/04/06 17:22:16 | 00,001,046 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml
[2008/04/06 17:22:16 | 00,002,351 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml
[2008/04/06 17:22:16 | 00,000,792 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml

O1 HOSTS File: (734 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ZoneAlarm Toolbar Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll (Google)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\..\Toolbar\WebBrowser: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [calc] C:\WINDOWS\System32\calc.DLL (Microsoft)
O4 - HKLM..\Run: [DVDLauncher] C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe (CyberLink Corp.)
O4 - HKLM..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Printelligence] C:\Program Files\Preo\Printelligence\prprnal.exe (Preo Software Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKLM..\Run: [Zune Launcher] c:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006..\Run: [calc] C:\Documents and Settings\NetworkService\ntuser.dll (Microsoft)
O4 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\SGR\Start Menu\Programs\Startup\HotSync Manager.lnk = C:\Program Files\Palm\hotsync.exe (Palm Computing, Inc., a 3Com Company)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\..Trusted Domains: 22 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cab (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/3/9...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab (Kodak Gallery Easy Upload Manager Class)
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab (Kodak Gallery Easy Upload Manager Class)
O16 - DPF: {712362BF-E411-4F43-99D2-EB15F80AF1DB} http://entimg.msn.com/client/msnediag7705.cab (MsneDiag Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 216.17.128.1 216.17.128.2
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/16 03:43:04 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun\command - "" = E:\setup.exe -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2005/08/16 03:22:48 | 00,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: helpsvc - C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (65024224313475072)

========== Files/Folders - Created Within 14 Days ==========

[2009/11/21 16:03:09 | 00,000,000 | ---D | C] -- C:\Documents and Settings\SGR\Application Data\Malwarebytes
[2009/11/21 16:03:00 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/11/21 16:02:59 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/11/21 16:02:59 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/11/21 16:02:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/11/21 15:55:26 | 00,529,408 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\SGR\Desktop\OTL.exe
[2009/11/21 11:27:42 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\SGR\Desktop\RootRepeal.exe
[2009/11/21 11:02:58 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/11/21 10:52:53 | 00,812,344 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\SGR\Desktop\HJTInstall.exe
[2009/11/12 11:44:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Kaspersky SDK
[2009/11/12 11:22:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\SGR\My Documents\ForceField Shared Files
[2009/11/12 11:22:46 | 00,000,000 | ---D | C] -- C:\Documents and Settings\SGR\Application Data\CheckPoint
[2009/11/12 11:22:03 | 00,000,000 | ---D | C] -- C:\Program Files\CheckPoint
[2009/11/12 11:21:58 | 00,128,016 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\kl1.sys
[2009/11/12 11:21:41 | 00,317,072 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys
[11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2009/11/21 16:26:22 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/11/21 16:25:15 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/11/21 16:25:02 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/11/21 16:24:59 | 10,717,96224 | -HS- | M] () -- C:\hiberfil.sys
[2009/11/21 16:24:04 | 04,980,736 | -H-- | M] () -- C:\Documents and Settings\SGR\NTUSER.DAT
[2009/11/21 16:24:04 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\SGR\ntuser.ini
[2009/11/21 16:03:03 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/11/21 15:53:46 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\SGR\Desktop\OTL.exe
[2009/11/21 12:09:32 | 00,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2009/11/21 11:16:36 | 00,472,064 | ---- | M] ( ) -- C:\Documents and Settings\SGR\Desktop\RootRepeal.exe
[2009/11/21 11:16:16 | 00,523,776 | ---- | M] () -- C:\Documents and Settings\SGR\Desktop\dds.scr
[2009/11/21 11:03:06 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\SGR\Desktop\HijackThis.lnk
[2009/11/19 22:17:12 | 00,812,344 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\SGR\Desktop\HJTInstall.exe
[2009/11/12 11:22:00 | 00,000,731 | ---- | M] () -- C:\Documents and Settings\SGR\Desktop\ZoneAlarm Security.lnk
[2009/11/12 11:21:04 | 00,423,126 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2009/11/12 10:59:08 | 00,003,359 | ---- | M] () -- C:\rollback.ini
[2009/11/10 20:11:46 | 00,138,848 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009/11/21 16:03:03 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/11/21 11:27:36 | 00,523,776 | ---- | C] () -- C:\Documents and Settings\SGR\Desktop\dds.scr
[2009/11/21 11:02:58 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\SGR\Desktop\HijackThis.lnk
[2009/11/12 11:22:00 | 00,000,731 | ---- | C] () -- C:\Documents and Settings\SGR\Desktop\ZoneAlarm Security.lnk
[2008/12/01 15:59:52 | 00,413,696 | ---- | C] () -- C:\Documents and Settings\SGR\Local Settings\Application Data\filesync.metadata
[2008/07/14 10:50:01 | 00,796,048 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2007/04/11 07:17:02 | 00,009,597 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2007/02/25 21:32:40 | 00,002,405 | ---- | C] () -- C:\WINDOWS\ssnew01.ini
[2007/02/25 21:27:37 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\USBPRN.DLL
[2007/02/25 21:27:37 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\SCANX.DLL
[2007/02/25 21:27:36 | 00,135,104 | ---- | C] () -- C:\WINDOWS\Tab16d20.dll
[2007/02/25 21:27:36 | 00,102,400 | ---- | C] () -- C:\WINDOWS\DLL2KUSB.DLL
[2007/02/25 21:27:36 | 00,098,304 | ---- | C] () -- C:\WINDOWS\DLL32.DLL
[2007/02/25 21:27:36 | 00,048,176 | ---- | C] () -- C:\WINDOWS\Imp16d20.dll
[2007/02/25 21:27:36 | 00,028,672 | ---- | C] () -- C:\WINDOWS\SSTHUNK.DLL
[2007/02/25 21:27:36 | 00,012,800 | ---- | C] () -- C:\WINDOWS\SS16FT.DLL
[2007/02/25 21:27:36 | 00,011,079 | ---- | C] () -- C:\WINDOWS\LxUsbOpn.dll
[2007/02/25 21:27:36 | 00,002,698 | ---- | C] () -- C:\WINDOWS\SSDS32.INI
[2007/02/25 21:27:36 | 00,002,554 | ---- | C] () -- C:\WINDOWS\SSDS16.INI
[2007/02/25 21:27:36 | 00,002,269 | ---- | C] () -- C:\WINDOWS\SSDEF32.INI
[2007/02/25 21:27:36 | 00,002,267 | ---- | C] () -- C:\WINDOWS\SSDEF16.INI
[2007/02/25 21:27:36 | 00,000,051 | ---- | C] () -- C:\WINDOWS\MyScan.ini
[2007/02/25 17:29:16 | 00,025,815 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2007/01/25 15:00:21 | 00,000,129 | ---- | C] () -- C:\WINDOWS\ANS2000.INI
[2007/01/25 15:00:21 | 00,000,020 | -H-- | C] () -- C:\WINDOWS\akebook.ini
[2007/01/25 15:00:21 | 00,000,004 | -H-- | C] () -- C:\WINDOWS\a3kebook.ini
[2006/12/27 19:11:11 | 00,001,751 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/07/04 18:56:42 | 00,000,088 | RHS- | C] () -- C:\WINDOWS\System32\5E310CED3A.sys
[2006/06/29 13:58:52 | 00,030,808 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/06/29 13:53:56 | 00,026,489 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 00,029,779 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/04/18 14:39:28 | 00,026,040 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/03/12 16:39:58 | 00,019,456 | ---- | C] () -- C:\Documents and Settings\SGR\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/03/03 13:10:39 | 00,007,812 | ---- | C] () -- C:\WINDOWS\System32\visorusb.dll
[2006/03/02 14:22:09 | 00,000,020 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
[2006/03/02 13:49:10 | 00,000,104 | RHS- | C] () -- C:\WINDOWS\System32\3AED0C315E.sys
[2006/03/02 13:49:09 | 00,005,852 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2006/03/01 19:11:18 | 00,000,305 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html
[2006/03/01 18:55:44 | 00,027,936 | ---- | C] () -- C:\Documents and Settings\SGR\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2006/03/01 16:11:32 | 00,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2006/03/01 16:04:31 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\SGR\Application Data\desktop.ini
[2006/03/01 16:04:30 | 03,792,414 | -H-- | C] () -- C:\Documents and Settings\SGR\Local Settings\Application Data\IconCache.db
[2006/03/01 16:04:30 | 00,000,126 | ---- | C] () -- C:\Documents and Settings\SGR\Local Settings\Application Data\fusioncache.dat
[2006/02/19 13:16:20 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/02/19 13:07:10 | 00,000,591 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/02/19 13:03:02 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/02/19 12:37:54 | 00,000,392 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/08/16 03:43:03 | 00,000,000 | ---- | C] () -- C:\WINDOWS\control.ini
[2005/08/16 03:38:33 | 00,000,037 | ---- | C] () -- C:\WINDOWS\vbaddin.ini
[2005/08/16 03:38:33 | 00,000,036 | ---- | C] () -- C:\WINDOWS\vb.ini
[2005/08/16 03:37:25 | 00,013,223 | ---- | C] () -- C:\WINDOWS\System32\tslabels.ini
[2005/08/16 03:37:25 | 00,001,931 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.ini
[2005/08/16 03:37:24 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2005/08/16 03:33:39 | 00,524,016 | ---- | C] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2005/08/16 03:33:38 | 00,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/08/16 03:33:24 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2005/08/16 03:19:02 | 00,498,742 | ---- | C] () -- C:\WINDOWS\System32\dxmasf.dll
[2005/08/16 03:19:02 | 00,004,126 | ---- | C] () -- C:\WINDOWS\System32\msdxmlc.dll
[2005/08/16 03:18:44 | 00,013,312 | ---- | C] () -- C:\WINDOWS\System32\win87em.dll
[2005/08/16 03:18:43 | 00,000,844 | ---- | C] () -- C:\WINDOWS\win.ini
[2005/08/16 03:18:41 | 00,053,478 | ---- | C] () -- C:\WINDOWS\System32\tcpmon.ini
[2005/08/16 03:18:41 | 00,015,360 | ---- | C] () -- C:\WINDOWS\System32\tsd32.dll
[2005/08/16 03:18:41 | 00,000,334 | ---- | C] () -- C:\WINDOWS\system.ini
[2005/08/16 03:18:35 | 00,291,840 | ---- | C] () -- C:\WINDOWS\System32\sbe.dll
[2005/08/16 03:18:35 | 00,010,240 | ---- | C] () -- C:\WINDOWS\System32\scriptpw.dll
[2005/08/16 03:18:34 | 00,012,082 | ---- | C] () -- C:\WINDOWS\System32\rsvp.ini
[2005/08/16 03:18:33 | 01,291,264 | ---- | C] () -- C:\WINDOWS\System32\quartz.dll
[2005/08/16 03:18:33 | 00,733,696 | ---- | C] () -- C:\WINDOWS\System32\qedwipes.dll
[2005/08/16 03:18:33 | 00,562,176 | ---- | C] () -- C:\WINDOWS\System32\qedit.dll
[2005/08/16 03:18:33 | 00,386,048 | ---- | C] () -- C:\WINDOWS\System32\qdvd.dll
[2005/08/16 03:18:33 | 00,279,040 | ---- | C] () -- C:\WINDOWS\System32\qdv.dll
[2005/08/16 03:18:33 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\qcap.dll
[2005/08/16 03:18:33 | 00,006,877 | ---- | C] () -- C:\WINDOWS\System32\pschdprf.ini
[2005/08/16 03:18:33 | 00,003,458 | ---- | C] () -- C:\WINDOWS\System32\rasctrs.ini
[2005/08/16 03:18:33 | 00,002,891 | ---- | C] () -- C:\WINDOWS\System32\perfci.ini
[2005/08/16 03:18:33 | 00,002,732 | ---- | C] () -- C:\WINDOWS\System32\perfwci.ini
[2005/08/16 03:18:33 | 00,001,152 | ---- | C] () -- C:\WINDOWS\System32\perffilt.ini
[2005/08/16 03:18:33 | 00,000,343 | ---- | C] () -- C:\WINDOWS\System32\prodspec.ini
[2005/08/16 03:18:29 | 00,035,648 | ---- | C] () -- C:\WINDOWS\System32\ntio411.sys
[2005/08/16 03:18:29 | 00,035,424 | ---- | C] () -- C:\WINDOWS\System32\ntio412.sys
[2005/08/16 03:18:29 | 00,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio804.sys
[2005/08/16 03:18:29 | 00,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio404.sys
[2005/08/16 03:18:29 | 00,033,840 | ---- | C] () -- C:\WINDOWS\System32\ntio.sys
[2005/08/16 03:18:29 | 00,029,370 | ---- | C] () -- C:\WINDOWS\System32\ntdos411.sys
[2005/08/16 03:18:29 | 00,029,274 | ---- | C] () -- C:\WINDOWS\System32\ntdos412.sys
[2005/08/16 03:18:29 | 00,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos804.sys
[2005/08/16 03:18:29 | 00,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos404.sys
[2005/08/16 03:18:29 | 00,027,866 | ---- | C] () -- C:\WINDOWS\System32\ntdos.sys
[2005/08/16 03:18:28 | 00,002,656 | ---- | C] () -- C:\WINDOWS\System32\netware.drv
[2005/08/16 03:18:25 | 00,094,282 | ---- | C] () -- C:\WINDOWS\System32\msencode.dll
[2005/08/16 03:18:25 | 00,014,336 | ---- | C] () -- C:\WINDOWS\System32\msdmo.dll
[2005/08/16 03:18:25 | 00,001,405 | ---- | C] () -- C:\WINDOWS\msdfmap.ini
[2005/08/16 03:18:23 | 00,010,110 | ---- | C] () -- C:\WINDOWS\System32\mqperf.ini
[2005/08/16 03:18:22 | 00,042,809 | ---- | C] () -- C:\WINDOWS\System32\key01.sys
[2005/08/16 03:18:22 | 00,042,537 | ---- | C] () -- C:\WINDOWS\System32\keyboard.sys
[2005/08/16 03:18:22 | 00,035,328 | ---- | C] () -- C:\WINDOWS\System32\mciqtz32.dll
[2005/08/16 03:18:20 | 00,199,168 | ---- | C] () -- C:\WINDOWS\System32\ir32_32.dll
[2005/08/16 03:18:19 | 00,004,768 | ---- | C] () -- C:\WINDOWS\System32\himem.sys
[2005/08/16 03:18:16 | 01,015,477 | ---- | C] () -- C:\WINDOWS\System32\esentprf.ini
[2005/08/16 03:18:16 | 00,456,192 | ---- | C] () -- C:\WINDOWS\System32\encdec.dll
[2005/08/16 03:18:08 | 00,059,904 | ---- | C] () -- C:\WINDOWS\System32\devenum.dll
[2005/08/16 03:18:07 | 00,027,097 | ---- | C] () -- C:\WINDOWS\System32\country.sys
[2005/08/16 03:18:05 | 00,252,928 | ---- | C] () -- C:\WINDOWS\System32\compatui.dll
[2005/08/16 03:18:04 | 00,355,112 | ---- | C] () -- C:\WINDOWS\System32\msjetoledb40.dll
[2005/08/16 03:18:03 | 00,070,656 | ---- | C] () -- C:\WINDOWS\System32\amstream.dll
[2005/08/16 03:18:03 | 00,009,029 | ---- | C] () -- C:\WINDOWS\System32\ansi.sys
[2005/08/05 13:01:54 | 00,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2003/01/07 14:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/01/08 16:57:34 | 00,110,592 | ---- | C] () -- C:\WINDOWS\System32\Jpeg32.dll
[2001/08/17 21:36:28 | 00,157,696 | ---- | C] () -- C:\WINDOWS\System32\paqsp.dll

========== LOP Check ==========

[2006/02/19 13:10:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Corel
[2006/02/19 13:13:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Google
[2005/08/16 03:50:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Identities
[2006/02/19 13:03:42 | 00,000,000 | --SD | M] -- C:\Documents and Settings\Administrator\Application Data\Microsoft
[2006/02/19 12:54:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Sun
[2007/02/02 17:22:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2006/03/01 16:11:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AOL
[2006/06/22 16:48:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2008/01/23 14:11:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Dell
[2006/03/02 14:22:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2009/03/01 14:51:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Google
[2008/01/15 12:19:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GTek
[2006/02/19 13:07:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InstallShield
[2009/11/12 11:44:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kaspersky SDK
[2008/06/21 07:00:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
[2009/11/21 16:02:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2006/02/19 13:12:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\McAfee
[2006/03/01 18:53:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\McAfee.com
[2006/03/01 16:42:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\McAfee.com Personal Firewall
[2009/09/29 08:40:32 | 00,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2009/11/03 11:45:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NOS
[2006/03/15 12:05:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\QuickTime
[2007/02/25 17:12:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2006/03/02 14:22:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2006/03/01 17:36:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2006/02/19 13:10:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Corel
[2006/02/19 13:13:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Google
[2005/08/16 03:50:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Identities
[2006/02/19 13:03:42 | 00,000,000 | --SD | M] -- C:\Documents and Settings\Default User\Application Data\Microsoft
[2006/02/19 12:54:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Sun
[2006/03/01 16:13:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\McAfee.com Personal Firewall
[2006/12/19 13:28:31 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2006/03/15 08:53:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Mozilla
[2006/03/15 08:53:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Talkback
[2005/08/16 03:30:12 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/02/22 13:00:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Adobe
[2007/05/22 15:17:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\AdobeAUM
[2007/02/02 17:20:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\AdobeUM
[2009/02/27 11:06:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Amazon
[2006/06/22 17:08:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Apple Computer
[2009/11/12 11:22:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\CheckPoint
[2006/02/19 13:10:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Corel
[2006/03/02 13:51:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Corel Photo Album
[2008/05/15 16:03:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\CyberLink
[2006/09/16 18:20:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Google
[2007/04/09 11:52:51 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\SGR\Application Data\Gtek
[2008/12/05 16:26:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Help
[2005/08/16 03:50:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Identities
[2006/03/12 15:07:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Leadertech
[2006/03/02 17:01:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Macromedia
[2008/10/27 09:16:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\MailFrontier
[2009/11/21 16:03:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Malwarebytes
[2006/03/01 16:41:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\McAfee.com Personal Firewall
[2009/05/06 18:57:56 | 00,000,000 | --SD | M] -- C:\Documents and Settings\SGR\Application Data\Microsoft
[2006/03/01 18:20:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Mozilla
[2006/03/02 14:22:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Nikon
[2008/06/02 11:03:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Real
[2009/09/29 08:48:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\SanDisk
[2006/03/29 21:00:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Seven Zip
[2006/03/12 15:07:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Sonic
[2006/02/19 12:54:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Sun
[2006/03/01 18:20:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Talkback
[2006/08/04 16:33:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\U3
[2006/03/01 19:51:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\WinPatrol
[2004/08/10 04:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009/11/21 16:25:15 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========



========== Custom Scans ==========


< %systemdrive%\*.exe >

< %SYSTEMDRIVE%\eventlog.dll /s /md5 >
[2004/08/10 04:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\i386\eventlog.dll
[1 C:\i386\*.tmp files -> C:\i386\*.tmp -> ]
[2004/08/10 04:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[2008/04/13 17:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 17:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[11 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %SYSTEMDRIVE%\nvstor.sys /s /md5 >

< %SYSTEMDRIVE%\atapi.sys /s /md5 >
[2004/08/03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\i386\atapi.sys
[1 C:\i386\*.tmp files -> C:\i386\*.tmp -> ]
[2004/08/03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2008/04/13 11:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 11:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys
[2004/08/03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\atapi.sys

< %SYSTEMDRIVE%\viasraid.sys /s /md5 >

< %SYSTEMDRIVE%\AGP440.sys /s /md5 >
[2004/08/03 22:07:42 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\i386\AGP440.SYS
[1 C:\i386\*.tmp files -> C:\i386\*.tmp -> ]
[2004/08/03 22:07:42 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2008/04/13 11:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 11:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

< %SYSTEMDRIVE%\vaxscsi.sys /s /md5 >

< %SYSTEMDRIVE%\nvatabus.sys /s /md5 >

< %SYSTEMDRIVE%\viamraid.sys /s /md5 >

< %SYSTEMDRIVE%\nvata.sys /s /md5 >

< %SYSTEMDRIVE%\tdl*.dll /s /md5 >

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe:SummaryInformation
< End of report >

Run OTL.exe

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  MOD - [2009/03/21 07:06:58 | 00,024,064 | ---- | M] (Microsoft) -- C:\Documents and Settings\SGR\ntuser.dll
  O4 - HKLM..\Run: [calc] C:\WINDOWS\System32\calc.DLL (Microsoft)
  [11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
  
  :Commands
  [purity]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• You will get a log that shows the results of the fix. Please post it.
• Then also run and post a new OTL log.

How is your computer behaving now?

In terms of behavior, it's better at boot (no errors), but IE still has the originally reported memory problem.

Also, I've got to step out til probably tomorrow morning, so I'll check back then. Thanks so much for all of the help so far!!!!

Here is the first OTL log after running the fix...

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\calc deleted successfully.
C:\WINDOWS\system32\calc.dll moved successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\SET34C.tmp deleted successfully.
C:\WINDOWS\System32\SET34D.tmp deleted successfully.
C:\WINDOWS\System32\SET386.tmp deleted successfully.
C:\WINDOWS\System32\SET38B.tmp deleted successfully.
C:\WINDOWS\System32\SET392.tmp deleted successfully.
C:\WINDOWS\System32\SET39A.tmp deleted successfully.
C:\WINDOWS\System32\SET39B.tmp deleted successfully.
C:\WINDOWS\System32\SET39D.tmp deleted successfully.
C:\WINDOWS\System32\SET3A0.tmp deleted successfully.
C:\WINDOWS\System32\SET3D1.tmp deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: LocalService
->Temp folder emptied: 1979960 bytes
->Temporary Internet Files folder emptied: 56826003 bytes
->FireFox cache emptied: 963067 bytes

User: NetworkService
->Temp folder emptied: 1982328 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: SGR
->Temp folder emptied: 14123905 bytes
->Temporary Internet Files folder emptied: 329849145 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 2459217 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 43632070 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 23947244 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34318 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 453.87 mb


OTL by OldTimer - Version 3.1.6.2 log created on 11212009_170715

Files\Folders moved on Reboot...
C:\Documents and Settings\SGR\Local Settings\Temp\nsrbgxod.bak moved successfully.
C:\Documents and Settings\SGR\Local Settings\Temp\~DF95CB.tmp moved successfully.
File move failed. C:\WINDOWS\temp\av1.tmp scheduled to be moved on reboot.
C:\WINDOWS\temp\iswift.dat moved successfully.
C:\WINDOWS\temp\sfdb.dat moved successfully.
File\Folder C:\WINDOWS\temp\ZLT04313.TMP not found!

Registry entries deleted on Reboot...


...and here is the OTL run after that. I wasn't sure if I was supposed to copy/paste the stuff from earlier and then run or if I should just check all users and run Quick Scan. I did the later, so please let me know if that wasn't correct...

OTL logfile created on: 11/21/2009 5:15:54 PM - Run 2
OTL by OldTimer - Version 3.1.6.2 Folder = C:\Documents and Settings\SGR\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1022.07 Mb Total Physical Memory | 517.02 Mb Available Physical Memory | 50.59% Memory free
2.40 Gb Paging File | 1.94 Gb Available in Paging File | 81.04% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 69.80 Gb Total Space | 32.31 Gb Free Space | 46.28% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 971.97 Mb Total Space | 965.58 Mb Free Space | 99.34% Space Free | Partition Type: FAT32
Drive G: | 55.89 Gb Total Space | 28.16 Gb Free Space | 50.39% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SGR1
Current User Name: SGR
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2009/11/21 15:53:46 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\SGR\Desktop\OTL.exe
PRC - [2009/10/17 01:41:10 | 02,384,240 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2009/10/17 01:39:40 | 01,037,192 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2009/10/14 06:30:26 | 00,476,528 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe
PRC - [2009/10/14 06:30:06 | 00,730,480 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
PRC - [2009/10/11 04:17:36 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2009/10/11 04:17:35 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009/09/10 11:15:42 | 00,870,672 | ---- | M] (SonicWALL, Inc.) -- C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
PRC - [2009/09/04 12:16:54 | 00,158,448 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Zune\ZuneLauncher.exe
PRC - [2009/09/04 12:16:54 | 00,058,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ZuneBusEnum.exe
PRC - [2008/07/02 13:20:32 | 00,070,968 | ---- | M] (Preo) -- C:\Program Files\Preo\Printelligence\prprncs.exe
PRC - [2008/07/02 13:20:28 | 00,058,680 | ---- | M] (Preo Software Inc.) -- C:\Program Files\Preo\Printelligence\prprnal.exe
PRC - [2008/07/02 13:20:26 | 00,111,928 | ---- | M] (Preo) -- C:\Program Files\Preo\Printelligence\prprn.exe
PRC - [2008/04/13 17:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
PRC - [2008/04/13 17:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/06/22 15:28:49 | 00,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2007/03/15 10:09:36 | 00,460,784 | ---- | M] (Gteko Ltd.) -- C:\Program Files\DellSupport\DSAgnt.exe
PRC - [2006/10/09 16:16:56 | 00,237,568 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\ehrecvr.exe
PRC - [2005/09/29 13:01:14 | 00,067,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\ehtray.exe
PRC - [2005/09/23 22:05:26 | 00,029,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
PRC - [2005/08/05 12:56:32 | 00,102,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\ehSched.exe
PRC - [2005/08/05 12:56:28 | 00,046,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\ehmsas.exe
PRC - [2005/08/04 03:02:58 | 00,380,928 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe
PRC - [2005/06/10 09:44:02 | 00,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
PRC - [2005/03/22 23:20:44 | 00,339,968 | ---- | M] (SigmaTel, Inc.) -- C:\WINDOWS\stsystra.exe
PRC - [2005/02/23 15:19:56 | 00,053,248 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
PRC - [2003/06/19 22:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
PRC - [2000/03/17 14:11:10 | 00,265,728 | ---- | M] (Palm Computing, Inc., a 3Com Company) -- C:\Program Files\Palm\hotsync.exe


========== Modules (SafeList) ==========

MOD - [2009/11/21 15:53:46 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\SGR\Desktop\OTL.exe
MOD - [2009/10/14 06:30:36 | 00,628,080 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
MOD - [2009/09/10 11:15:48 | 00,013,072 | ---- | M] () -- C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\MlfHook.dll
MOD - [2009/03/21 07:06:58 | 00,024,064 | -HS- | M] (Microsoft) -- C:\WINDOWS\system32\calc.dll
MOD - [2008/07/25 10:17:20 | 00,635,904 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
MOD - [2008/07/25 10:17:20 | 00,558,080 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
MOD - [2008/07/02 13:20:20 | 00,130,360 | ---- | M] (Preo Software Inc.) -- C:\Program Files\Preo\Printelligence\AppDetectA.dll
MOD - [2008/04/13 17:12:51 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
MOD - [2008/04/13 17:12:00 | 00,025,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mslbui.dll
MOD - [2008/04/13 17:11:56 | 00,019,968 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\linkinfo.dll
MOD - [2008/04/13 17:11:53 | 00,185,344 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\framedyn.dll
MOD - [2004/08/10 04:00:00 | 00,002,560 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\lz32.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/10/17 01:41:10 | 02,384,240 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2009/10/14 06:30:26 | 00,476,528 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe -- (IswSvc)
SRV - [2009/10/11 04:17:35 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009/09/23 16:36:06 | 00,051,168 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus®
SRV - [2009/09/04 12:17:00 | 00,447,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc)
SRV - [2009/09/04 12:16:54 | 05,893,360 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc)
SRV - [2009/09/04 12:16:54 | 00,058,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ZuneBusEnum.exe -- (ZuneBusEnum)
SRV - [2009/04/29 14:21:40 | 00,182,768 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2008/07/29 20:10:04 | 00,046,104 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0)
SRV - [2008/07/29 18:24:50 | 00,881,664 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc)
SRV - [2008/07/29 18:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008/07/25 10:17:02 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/07/25 10:16:40 | 00,034,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state)
SRV - [2008/07/02 13:20:32 | 00,070,968 | ---- | M] (Preo) -- C:\Program Files\Preo\Printelligence\prprncs.exe -- (PrintelligenceClientService)
SRV - [2008/07/02 13:20:26 | 00,111,928 | ---- | M] (Preo) -- C:\Program Files\Preo\Printelligence\prprn.exe -- (Printelligence)
SRV - [2008/04/13 17:12:02 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll -- (helpsvc)
SRV - [2007/03/07 14:47:46 | 00,076,848 | ---- | M] () -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc)
SRV - [2006/10/09 16:16:56 | 00,237,568 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\ehrecvr.exe -- (ehRecvr)
SRV - [2005/08/05 12:56:32 | 00,102,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\ehSched.exe -- (ehSched)
SRV - [2005/08/05 12:27:08 | 00,099,328 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\mcrdsvc.exe -- (McrdSvc)
SRV - [2005/08/04 03:02:58 | 00,380,928 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller)
SRV - [2005/04/03 23:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/11/19 10:26:40 | 00,147,456 | ---- | M] (Intel® Corporation) -- C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe -- (NetSvc)
SRV - [2003/07/28 11:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003/06/19 22:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&client=dell
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://www.google.com/ig/dell?hl=en&client=dell


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&client=dell
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/dell?hl=en&client=dell
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&client=dell
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/dell?hl=en&client=dell
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&client=dell
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\S-1-5-21-1334875122-2706632779-302846874-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - HKLM\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/02 02:00:35 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2008/12/15 08:15:20 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2009/11/12 11:42:32 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.12\extensions\\Components: C:\PROGRA~1\Mozilla Firefox\components [2008/06/19 08:13:01 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.12\extensions\\Plugins: C:\PROGRA~1\Mozilla Firefox\plugins [2009/11/03 11:43:41 | 00,000,000 | ---D | M]

[2009/11/12 11:22:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Mozilla\Firefox\Profiles\se01iekm.default\extensions
[2009/11/12 11:22:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Mozilla\Firefox\Profiles\se01iekm.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/11/04 10:44:19 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2008/04/06 17:22:17 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2007/04/11 06:59:34 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
[2007/08/11 07:49:52 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
[2007/10/11 12:45:05 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
[2008/03/13 12:51:20 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
[2008/08/11 07:43:59 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
[2008/12/15 08:15:46 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2009/04/06 11:14:12 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009/06/12 18:30:17 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009/08/08 09:51:59 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2009/11/04 10:44:20 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2008/04/06 17:22:02 | 00,067,696 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jar50.dll
[2008/04/06 17:22:02 | 00,054,376 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jsd3250.dll
[2008/04/06 17:22:02 | 00,034,952 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\myspell.dll
[2008/04/06 17:22:04 | 00,046,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\spellchk.dll
[2008/04/06 17:22:04 | 00,172,144 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\xpinstal.dll
[2009/10/11 04:17:27 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll
[2008/04/06 17:22:13 | 00,022,664 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
[2009/09/23 16:36:40 | 00,032,448 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\Mozilla Firefox\plugins\np_gp.dll
[2008/04/06 17:22:16 | 00,001,514 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml
[2008/04/06 17:22:16 | 00,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml
[2008/04/06 17:22:16 | 00,001,038 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml
[2008/04/06 17:22:16 | 00,001,046 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml
[2008/04/06 17:22:16 | 00,002,351 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml
[2008/04/06 17:22:16 | 00,000,792 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml

O1 HOSTS File: (734 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ZoneAlarm Toolbar Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll (Google)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\..\Toolbar\WebBrowser: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [calc] C:\WINDOWS\System32\calc.DLL (Microsoft)
O4 - HKLM..\Run: [DVDLauncher] C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe (CyberLink Corp.)
O4 - HKLM..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Printelligence] C:\Program Files\Preo\Printelligence\prprnal.exe (Preo Software Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKLM..\Run: [Zune Launcher] c:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006..\Run: [calc] C:\Documents and Settings\NetworkService\ntuser.dll (Microsoft)
O4 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\SGR\Start Menu\Programs\Startup\HotSync Manager.lnk = C:\Program Files\Palm\hotsync.exe (Palm Computing, Inc., a 3Com Company)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-1334875122-2706632779-302846874-1006\..Trusted Domains: 22 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cab (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/3/9...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab (Kodak Gallery Easy Upload Manager Class)
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab (Kodak Gallery Easy Upload Manager Class)
O16 - DPF: {712362BF-E411-4F43-99D2-EB15F80AF1DB} http://entimg.msn.com/client/msnediag7705.cab (MsneDiag Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 216.17.128.1 216.17.128.2
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/16 03:43:04 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun\command - "" = E:\setup.exe -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 14 Days ==========

[2009/11/21 17:07:15 | 00,000,000 | ---D | C] -- C:\_OTL
[2009/11/21 16:03:09 | 00,000,000 | ---D | C] -- C:\Documents and Settings\SGR\Application Data\Malwarebytes
[2009/11/21 16:03:00 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/11/21 16:02:59 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/11/21 16:02:59 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/11/21 16:02:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/11/21 15:55:26 | 00,529,408 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\SGR\Desktop\OTL.exe
[2009/11/21 11:27:42 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\SGR\Desktop\RootRepeal.exe
[2009/11/21 11:02:58 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/11/21 10:52:53 | 00,812,344 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\SGR\Desktop\HJTInstall.exe
[2009/11/12 11:44:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Kaspersky SDK
[2009/11/12 11:22:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\SGR\My Documents\ForceField Shared Files
[2009/11/12 11:22:46 | 00,000,000 | ---D | C] -- C:\Documents and Settings\SGR\Application Data\CheckPoint
[2009/11/12 11:22:03 | 00,000,000 | ---D | C] -- C:\Program Files\CheckPoint
[2009/11/12 11:21:58 | 00,128,016 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\kl1.sys
[2009/11/12 11:21:41 | 00,317,072 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys

========== Files - Modified Within 14 Days ==========

[2009/11/21 17:12:34 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/11/21 17:11:21 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/11/21 17:11:09 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/11/21 17:11:06 | 10,717,96224 | -HS- | M] () -- C:\hiberfil.sys
[2009/11/21 17:10:19 | 04,980,736 | -H-- | M] () -- C:\Documents and Settings\SGR\NTUSER.DAT
[2009/11/21 17:10:19 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\SGR\ntuser.ini
[2009/11/21 16:43:10 | 00,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2009/11/21 16:03:03 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/11/21 15:53:46 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\SGR\Desktop\OTL.exe
[2009/11/21 11:16:36 | 00,472,064 | ---- | M] ( ) -- C:\Documents and Settings\SGR\Desktop\RootRepeal.exe
[2009/11/21 11:16:16 | 00,523,776 | ---- | M] () -- C:\Documents and Settings\SGR\Desktop\dds.scr
[2009/11/21 11:03:06 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\SGR\Desktop\HijackThis.lnk
[2009/11/19 22:17:12 | 00,812,344 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\SGR\Desktop\HJTInstall.exe
[2009/11/12 11:22:00 | 00,000,731 | ---- | M] () -- C:\Documents and Settings\SGR\Desktop\ZoneAlarm Security.lnk
[2009/11/12 11:21:04 | 00,423,126 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2009/11/12 10:59:08 | 00,003,359 | ---- | M] () -- C:\rollback.ini
[2009/11/10 20:11:46 | 00,138,848 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2009/11/21 16:03:03 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/11/21 11:27:36 | 00,523,776 | ---- | C] () -- C:\Documents and Settings\SGR\Desktop\dds.scr
[2009/11/21 11:02:58 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\SGR\Desktop\HijackThis.lnk
[2009/11/12 11:22:00 | 00,000,731 | ---- | C] () -- C:\Documents and Settings\SGR\Desktop\ZoneAlarm Security.lnk
[2008/12/01 15:59:52 | 00,413,696 | ---- | C] () -- C:\Documents and Settings\SGR\Local Settings\Application Data\filesync.metadata
[2008/07/14 10:50:01 | 00,796,048 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2007/04/11 07:17:02 | 00,009,597 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2007/02/25 21:32:40 | 00,002,405 | ---- | C] () -- C:\WINDOWS\ssnew01.ini
[2007/02/25 21:27:37 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\USBPRN.DLL
[2007/02/25 21:27:37 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\SCANX.DLL
[2007/02/25 21:27:36 | 00,135,104 | ---- | C] () -- C:\WINDOWS\Tab16d20.dll
[2007/02/25 21:27:36 | 00,102,400 | ---- | C] () -- C:\WINDOWS\DLL2KUSB.DLL
[2007/02/25 21:27:36 | 00,098,304 | ---- | C] () -- C:\WINDOWS\DLL32.DLL
[2007/02/25 21:27:36 | 00,048,176 | ---- | C] () -- C:\WINDOWS\Imp16d20.dll
[2007/02/25 21:27:36 | 00,028,672 | ---- | C] () -- C:\WINDOWS\SSTHUNK.DLL
[2007/02/25 21:27:36 | 00,012,800 | ---- | C] () -- C:\WINDOWS\SS16FT.DLL
[2007/02/25 21:27:36 | 00,011,079 | ---- | C] () -- C:\WINDOWS\LxUsbOpn.dll
[2007/02/25 21:27:36 | 00,002,698 | ---- | C] () -- C:\WINDOWS\SSDS32.INI
[2007/02/25 21:27:36 | 00,002,554 | ---- | C] () -- C:\WINDOWS\SSDS16.INI
[2007/02/25 21:27:36 | 00,002,269 | ---- | C] () -- C:\WINDOWS\SSDEF32.INI
[2007/02/25 21:27:36 | 00,002,267 | ---- | C] () -- C:\WINDOWS\SSDEF16.INI
[2007/02/25 21:27:36 | 00,000,051 | ---- | C] () -- C:\WINDOWS\MyScan.ini
[2007/02/25 17:29:16 | 00,025,815 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2007/01/25 15:00:21 | 00,000,129 | ---- | C] () -- C:\WINDOWS\ANS2000.INI
[2007/01/25 15:00:21 | 00,000,020 | -H-- | C] () -- C:\WINDOWS\akebook.ini
[2007/01/25 15:00:21 | 00,000,004 | -H-- | C] () -- C:\WINDOWS\a3kebook.ini
[2006/12/27 19:11:11 | 00,001,751 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/07/04 18:56:42 | 00,000,088 | RHS- | C] () -- C:\WINDOWS\System32\5E310CED3A.sys
[2006/06/29 13:58:52 | 00,030,808 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/06/29 13:53:56 | 00,026,489 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 00,029,779 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/04/18 14:39:28 | 00,026,040 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/03/12 16:39:58 | 00,019,456 | ---- | C] () -- C:\Documents and Settings\SGR\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/03/03 13:10:39 | 00,007,812 | ---- | C] () -- C:\WINDOWS\System32\visorusb.dll
[2006/03/02 14:22:09 | 00,000,020 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
[2006/03/02 13:49:10 | 00,000,104 | RHS- | C] () -- C:\WINDOWS\System32\3AED0C315E.sys
[2006/03/02 13:49:09 | 00,005,852 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2006/03/01 19:11:18 | 00,000,305 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html
[2006/03/01 18:55:44 | 00,027,936 | ---- | C] () -- C:\Documents and Settings\SGR\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2006/03/01 16:11:32 | 00,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2006/03/01 16:04:31 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\SGR\Application Data\desktop.ini
[2006/03/01 16:04:30 | 03,792,414 | -H-- | C] () -- C:\Documents and Settings\SGR\Local Settings\Application Data\IconCache.db
[2006/03/01 16:04:30 | 00,000,126 | ---- | C] () -- C:\Documents and Settings\SGR\Local Settings\Application Data\fusioncache.dat
[2006/02/19 13:16:20 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/02/19 13:07:10 | 00,000,591 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/02/19 13:03:02 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/02/19 12:37:54 | 00,000,392 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/08/16 03:43:03 | 00,000,000 | ---- | C] () -- C:\WINDOWS\control.ini
[2005/08/16 03:38:33 | 00,000,037 | ---- | C] () -- C:\WINDOWS\vbaddin.ini
[2005/08/16 03:38:33 | 00,000,036 | ---- | C] () -- C:\WINDOWS\vb.ini
[2005/08/16 03:37:25 | 00,013,223 | ---- | C] () -- C:\WINDOWS\System32\tslabels.ini
[2005/08/16 03:37:25 | 00,001,931 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.ini
[2005/08/16 03:37:24 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2005/08/16 03:33:39 | 00,524,016 | ---- | C] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2005/08/16 03:33:38 | 00,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/08/16 03:33:24 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2005/08/16 03:19:02 | 00,498,742 | ---- | C] () -- C:\WINDOWS\System32\dxmasf.dll
[2005/08/16 03:19:02 | 00,004,126 | ---- | C] () -- C:\WINDOWS\System32\msdxmlc.dll
[2005/08/16 03:18:44 | 00,013,312 | ---- | C] () -- C:\WINDOWS\System32\win87em.dll
[2005/08/16 03:18:43 | 00,000,844 | ---- | C] () -- C:\WINDOWS\win.ini
[2005/08/16 03:18:41 | 00,053,478 | ---- | C] () -- C:\WINDOWS\System32\tcpmon.ini
[2005/08/16 03:18:41 | 00,015,360 | ---- | C] () -- C:\WINDOWS\System32\tsd32.dll
[2005/08/16 03:18:41 | 00,000,334 | ---- | C] () -- C:\WINDOWS\system.ini
[2005/08/16 03:18:35 | 00,291,840 | ---- | C] () -- C:\WINDOWS\System32\sbe.dll
[2005/08/16 03:18:35 | 00,010,240 | ---- | C] () -- C:\WINDOWS\System32\scriptpw.dll
[2005/08/16 03:18:34 | 00,012,082 | ---- | C] () -- C:\WINDOWS\System32\rsvp.ini
[2005/08/16 03:18:33 | 01,291,264 | ---- | C] () -- C:\WINDOWS\System32\quartz.dll
[2005/08/16 03:18:33 | 00,733,696 | ---- | C] () -- C:\WINDOWS\System32\qedwipes.dll
[2005/08/16 03:18:33 | 00,562,176 | ---- | C] () -- C:\WINDOWS\System32\qedit.dll
[2005/08/16 03:18:33 | 00,386,048 | ---- | C] () -- C:\WINDOWS\System32\qdvd.dll
[2005/08/16 03:18:33 | 00,279,040 | ---- | C] () -- C:\WINDOWS\System32\qdv.dll
[2005/08/16 03:18:33 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\qcap.dll
[2005/08/16 03:18:33 | 00,006,877 | ---- | C] () -- C:\WINDOWS\System32\pschdprf.ini
[2005/08/16 03:18:33 | 00,003,458 | ---- | C] () -- C:\WINDOWS\System32\rasctrs.ini
[2005/08/16 03:18:33 | 00,002,891 | ---- | C] () -- C:\WINDOWS\System32\perfci.ini
[2005/08/16 03:18:33 | 00,002,732 | ---- | C] () -- C:\WINDOWS\System32\perfwci.ini
[2005/08/16 03:18:33 | 00,001,152 | ---- | C] () -- C:\WINDOWS\System32\perffilt.ini
[2005/08/16 03:18:33 | 00,000,343 | ---- | C] () -- C:\WINDOWS\System32\prodspec.ini
[2005/08/16 03:18:29 | 00,035,648 | ---- | C] () -- C:\WINDOWS\System32\ntio411.sys
[2005/08/16 03:18:29 | 00,035,424 | ---- | C] () -- C:\WINDOWS\System32\ntio412.sys
[2005/08/16 03:18:29 | 00,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio804.sys
[2005/08/16 03:18:29 | 00,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio404.sys
[2005/08/16 03:18:29 | 00,033,840 | ---- | C] () -- C:\WINDOWS\System32\ntio.sys
[2005/08/16 03:18:29 | 00,029,370 | ---- | C] () -- C:\WINDOWS\System32\ntdos411.sys
[2005/08/16 03:18:29 | 00,029,274 | ---- | C] () -- C:\WINDOWS\System32\ntdos412.sys
[2005/08/16 03:18:29 | 00,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos804.sys
[2005/08/16 03:18:29 | 00,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos404.sys
[2005/08/16 03:18:29 | 00,027,866 | ---- | C] () -- C:\WINDOWS\System32\ntdos.sys
[2005/08/16 03:18:28 | 00,002,656 | ---- | C] () -- C:\WINDOWS\System32\netware.drv
[2005/08/16 03:18:25 | 00,094,282 | ---- | C] () -- C:\WINDOWS\System32\msencode.dll
[2005/08/16 03:18:25 | 00,014,336 | ---- | C] () -- C:\WINDOWS\System32\msdmo.dll
[2005/08/16 03:18:25 | 00,001,405 | ---- | C] () -- C:\WINDOWS\msdfmap.ini
[2005/08/16 03:18:23 | 00,010,110 | ---- | C] () -- C:\WINDOWS\System32\mqperf.ini
[2005/08/16 03:18:22 | 00,042,809 | ---- | C] () -- C:\WINDOWS\System32\key01.sys
[2005/08/16 03:18:22 | 00,042,537 | ---- | C] () -- C:\WINDOWS\System32\keyboard.sys
[2005/08/16 03:18:22 | 00,035,328 | ---- | C] () -- C:\WINDOWS\System32\mciqtz32.dll
[2005/08/16 03:18:20 | 00,199,168 | ---- | C] () -- C:\WINDOWS\System32\ir32_32.dll
[2005/08/16 03:18:19 | 00,004,768 | ---- | C] () -- C:\WINDOWS\System32\himem.sys
[2005/08/16 03:18:16 | 01,015,477 | ---- | C] () -- C:\WINDOWS\System32\esentprf.ini
[2005/08/16 03:18:16 | 00,456,192 | ---- | C] () -- C:\WINDOWS\System32\encdec.dll
[2005/08/16 03:18:08 | 00,059,904 | ---- | C] () -- C:\WINDOWS\System32\devenum.dll
[2005/08/16 03:18:07 | 00,027,097 | ---- | C] () -- C:\WINDOWS\System32\country.sys
[2005/08/16 03:18:05 | 00,252,928 | ---- | C] () -- C:\WINDOWS\System32\compatui.dll
[2005/08/16 03:18:04 | 00,355,112 | ---- | C] () -- C:\WINDOWS\System32\msjetoledb40.dll
[2005/08/16 03:18:03 | 00,070,656 | ---- | C] () -- C:\WINDOWS\System32\amstream.dll
[2005/08/16 03:18:03 | 00,009,029 | ---- | C] () -- C:\WINDOWS\System32\ansi.sys
[2005/08/05 13:01:54 | 00,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2003/01/07 14:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/01/08 16:57:34 | 00,110,592 | ---- | C] () -- C:\WINDOWS\System32\Jpeg32.dll
[2001/08/17 21:36:28 | 00,157,696 | ---- | C] () -- C:\WINDOWS\System32\paqsp.dll

========== LOP Check ==========

[2006/02/19 13:10:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Corel
[2006/02/19 13:13:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Google
[2005/08/16 03:50:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Identities
[2006/02/19 13:03:42 | 00,000,000 | --SD | M] -- C:\Documents and Settings\Administrator\Application Data\Microsoft
[2006/02/19 12:54:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Sun
[2007/02/02 17:22:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2006/03/01 16:11:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AOL
[2006/06/22 16:48:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2008/01/23 14:11:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Dell
[2006/03/02 14:22:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2009/03/01 14:51:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Google
[2008/01/15 12:19:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GTek
[2006/02/19 13:07:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InstallShield
[2009/11/12 11:44:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kaspersky SDK
[2008/06/21 07:00:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
[2009/11/21 16:02:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2006/02/19 13:12:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\McAfee
[2006/03/01 18:53:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\McAfee.com
[2006/03/01 16:42:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\McAfee.com Personal Firewall
[2009/09/29 08:40:32 | 00,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2009/11/03 11:45:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NOS
[2006/03/15 12:05:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\QuickTime
[2007/02/25 17:12:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2006/03/02 14:22:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2006/03/01 17:36:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2006/02/19 13:10:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Corel
[2006/02/19 13:13:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Google
[2005/08/16 03:50:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Identities
[2006/02/19 13:03:42 | 00,000,000 | --SD | M] -- C:\Documents and Settings\Default User\Application Data\Microsoft
[2006/02/19 12:54:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Sun
[2006/03/01 16:13:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\McAfee.com Personal Firewall
[2006/12/19 13:28:31 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2006/03/15 08:53:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Mozilla
[2006/03/15 08:53:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Talkback
[2005/08/16 03:30:12 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/02/22 13:00:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Adobe
[2007/05/22 15:17:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\AdobeAUM
[2007/02/02 17:20:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\AdobeUM
[2009/02/27 11:06:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Amazon
[2006/06/22 17:08:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Apple Computer
[2009/11/12 11:22:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\CheckPoint
[2006/02/19 13:10:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Corel
[2006/03/02 13:51:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Corel Photo Album
[2008/05/15 16:03:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\CyberLink
[2006/09/16 18:20:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Google
[2007/04/09 11:52:51 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\SGR\Application Data\Gtek
[2008/12/05 16:26:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Help
[2005/08/16 03:50:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Identities
[2006/03/12 15:07:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Leadertech
[2006/03/02 17:01:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Macromedia
[2008/10/27 09:16:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\MailFrontier
[2009/11/21 16:03:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Malwarebytes
[2006/03/01 16:41:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\McAfee.com Personal Firewall
[2009/05/06 18:57:56 | 00,000,000 | --SD | M] -- C:\Documents and Settings\SGR\Application Data\Microsoft
[2006/03/01 18:20:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Mozilla
[2006/03/02 14:22:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Nikon
[2008/06/02 11:03:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Real
[2009/09/29 08:48:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\SanDisk
[2006/03/29 21:00:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Seven Zip
[2006/03/12 15:07:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Sonic
[2006/02/19 12:54:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Sun
[2006/03/01 18:20:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\Talkback
[2006/08/04 16:33:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\U3
[2006/03/01 19:51:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\SGR\Application Data\WinPatrol
[2004/08/10 04:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009/11/21 17:11:21 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe:SummaryInformation
< End of report >

No problem on getting back to me tomorrow. I'm just about done on here tonight as well.

Please download ComboFix from one of these locations:

Link 1
Link 2
Link 3

Important!
You should NOT use Combofix unless you have been instructed to do so by a Malware Removal Expert.
It is intended by its creator to be used under the guidance and supervision of an Malware Removal Expert, not for private use.
Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.


Make sure that you save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.





Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please copy and paste the contents of C:\ComboFix.txt in your next reply.

Thanks for being patient! I ran combofix, the system rebooted, and the log produced is here...

ComboFix 09-11-22.02 - SGR 11/22/2009 14:44.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.578 [GMT -7:00]
Running from: c:\documents and settings\SGR\Desktop\ComboFix.exe
AV: *On-access scanning disabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\NetworkService\ntuser.dll
c:\documents and settings\SGR\ntuser.dll
c:\documents and settings\SGR\Start Menu\Programs\Startup\scandisk.dll
c:\documents and settings\SGR\Start Menu\Programs\Startup\scandisk.lnk
c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\kb913800.exe
c:\windows\system32\calc.dll

.
((((((((((((((((((((((((( Files Created from 2009-10-22 to 2009-11-22 )))))))))))))))))))))))))))))))
.

2009-11-22 00:07 . 2009-11-22 00:07 -------- d-----w- C:\_OTL
2009-11-21 23:03 . 2009-11-21 23:03 -------- d-----w- c:\documents and settings\SGR\Application Data\Malwarebytes
2009-11-21 23:03 . 2009-09-10 21:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-21 23:02 . 2009-11-21 23:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-21 23:02 . 2009-11-21 23:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-21 23:02 . 2009-09-10 21:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-21 18:02 . 2009-11-21 18:02 -------- d-----w- c:\program files\Trend Micro
2009-11-12 18:44 . 2009-11-12 18:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky SDK
2009-11-12 18:22 . 2009-11-12 18:22 -------- d-----w- c:\documents and settings\SGR\Application Data\CheckPoint
2009-11-12 18:22 . 2009-11-12 18:22 -------- d-----w- c:\program files\CheckPoint
2009-11-12 18:21 . 2009-10-13 01:15 128016 ----a-w- c:\windows\system32\drivers\kl1.sys
2009-11-04 17:42 . 2009-11-04 17:42 152576 ----a-w- c:\documents and settings\SGR\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-03 18:43 . 2009-11-03 18:45 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-11-03 18:43 . 2009-11-03 18:43 -------- d-----w- c:\program files\NOS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-22 18:10 . 2006-06-04 21:57 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-11-04 18:03 . 2009-11-04 18:04 69632 ----a-w- c:\windows\Internet Logs\xDB12.tmp
2009-11-04 17:44 . 2006-02-19 19:54 -------- d-----w- c:\program files\Java
2009-11-03 18:58 . 2009-11-03 19:11 2484736 ----a-w- c:\windows\Internet Logs\xDB11.tmp
2009-10-26 16:49 . 2009-10-27 20:17 2967552 ----a-w- c:\windows\Internet Logs\xDB10.tmp
2009-10-18 13:34 . 2009-10-18 13:34 0 ---ha-w- c:\windows\system32\drivers\Msft_User_ZuneDriver_01_09_00.Wdf
2009-10-18 13:34 . 2009-10-18 13:34 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_WinUSB_01009.Wdf
2009-10-18 13:33 . 2009-10-18 13:33 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_09_00.Wdf
2009-10-17 08:39 . 2008-07-14 17:50 72584 ----a-w- c:\windows\zllsputility.exe
2009-10-17 08:39 . 2009-06-08 15:05 1238408 ----a-w- c:\windows\system32\zpeng25.dll
2009-10-17 08:39 . 2009-06-08 15:06 69000 ----a-w- c:\windows\system32\zlcomm.dll
2009-10-17 08:39 . 2009-06-08 15:06 103816 ----a-w- c:\windows\system32\zlcommdb.dll
2009-10-11 11:17 . 2008-12-15 15:15 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-29 15:48 . 2009-05-06 22:53 -------- d-----w- c:\documents and settings\SGR\Application Data\SanDisk
2009-09-29 15:41 . 2009-09-29 15:41 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_zumbus_01009.Wdf
2009-09-29 15:41 . 2009-09-29 15:41 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2009-09-29 15:40 . 2008-05-31 20:59 -------- d-----w- c:\program files\Zune
2009-09-16 14:16 . 2008-10-08 17:06 49685927 ----a-w- c:\windows\Internet Logs\tvDebug.Zip
2009-09-11 14:18 . 2005-08-16 10:18 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2005-08-16 10:18 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-04 19:17 . 2009-09-04 19:17 447216 ----a-w- c:\windows\system32\ZuneWlanCfgSvc.exe
2009-09-04 19:16 . 2009-09-04 19:16 58592 ----a-w- c:\windows\system32\ZuneBusEnum.exe
2009-09-02 06:29 . 2009-09-02 06:29 74240 ----a-w- c:\windows\system32\ZuneUsbTransport.dll
2009-09-02 06:29 . 2009-09-02 06:29 57344 ----a-w- c:\windows\system32\ZuneRegUtil.dll
2009-09-02 06:29 . 2009-09-02 06:29 18944 ----a-w- c:\windows\system32\ZuneTcp2Udp.dll
2009-09-02 06:29 . 2009-09-02 06:29 12800 ----a-w- c:\windows\system32\ZunePTDNS.dll
2009-09-02 06:29 . 2009-09-02 06:29 310784 ----a-w- c:\windows\system32\ZuneNetProxy.dll
2009-09-02 06:29 . 2009-09-02 06:29 147456 ----a-w- c:\windows\system32\ZuneMTPZ.dll
2009-09-02 06:28 . 2009-09-02 06:28 40832 ----a-w- c:\windows\system32\drivers\zumbus.sys
2009-08-29 08:08 . 2005-08-16 10:18 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:00 . 2005-08-16 10:19 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-25 14:49 . 2009-08-25 14:49 2873344 ----a-w- c:\windows\Internet Logs\xDBF.tmp
2008-04-07 00:22 . 2006-06-22 19:41 67696 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-04-07 00:22 . 2006-06-22 19:41 54376 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-04-07 00:22 . 2007-12-06 18:08 34952 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2008-04-07 00:22 . 2007-12-06 18:08 46720 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2008-04-07 00:22 . 2006-06-22 19:41 172144 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2006-12-18 15:51 . 2006-03-02 20:49 104 --sh--r- c:\windows\system32\3AED0C315E.sys
2007-07-04 16:52 . 2006-07-05 01:56 88 --sh--r- c:\windows\system32\5E310CED3A.sys
2007-07-04 16:55 . 2006-03-02 20:49 5852 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-22 68856]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2007-12-26 344064]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"Printelligence"="c:\program files\Preo\Printelligence\prprnal.exe" [2008-07-02 58680]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2009-09-04 158448]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-10-17 1037192]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2009-10-14 730480]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-03-23 339968]

c:\documents and settings\SGR\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\program files\Palm\hotsync.exe [2006-3-3 265728]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=

R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [10/14/2009 6:30 AM 25208]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [10/14/2009 6:30 AM 476528]
R2 Printelligence;Printelligence;c:\program files\Preo\Printelligence\prprn.exe [7/2/2008 1:20 PM 111928]
R2 PrintelligenceClientService;PrintelligenceClientService;c:\program files\Preo\Printelligence\prprncs.exe [7/2/2008 1:20 PM 70968]
S3 getPlusHelper;getPlus® Helper;c:\windows\System32\svchost.exe -k getPlusHelper [8/16/2005 3:18 AM 14336]
S3 VisorUsb;Handspring USB;c:\windows\system32\drivers\VisorUsb.sys [3/3/2006 1:10 PM 19968]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.excite.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://us.mcafee.com/root/learnmore/learnmore.asp?close=true&lcode=en-us
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\SGR\Application Data\Mozilla\Firefox\Profiles\se01iekm.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\TrustCheckerMozillaPlugin.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-WudfPf
SafeBoot-WudfRd



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-22 15:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(696)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

- - - - - - - > 'lsass.exe'(756)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

- - - - - - - > 'explorer.exe'(1532)
c:\windows\system32\WININET.dll
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\program files\Zone Labs\ZoneAlarm\MailFrontier\mlfhook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\ZuneBusEnum.exe
c:\windows\system32\dllhost.exe
c:\windows\eHome\ehmsas.exe
c:\program files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
.
**************************************************************************
.
Completion time: 2009-11-22 15:16 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-22 22:16

Pre-Run: 34,736,193,536 bytes free
Post-Run: 34,337,157,120 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

- - End Of File - - C51A070F477D22C75DF897F3C956CF2E

How is your computer behaving now?

MUCH better!!! Exlporer now runs without a problem. Thank you so much for all the help!

Other than checking out the Tutorials and advice and guidance on this site generally to avoid future issues, have you got any specific pointers to stuff that would be most valuable to study?

Donation also on the way, as this site and your help have been invaluable. I can't imagine how long it would have taken and how much it would have cost to get fixed without this resource.

Thanks again!

Excellent to hear!

Here's some good reading for you.

http://www.bleepingcomputer.com/forums/t/2520/how-did-i-get-infected/
http://www.geekstogo.com/forum/index.php?a...;page=How_did_I
http://forums.spybot.info/showthread.php?t=279



We need to remove Combofix now that we're done with it.

• Click START then RUN
• Now type Combofix /u in the runbox and click OK
  
  
• 

==================



Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Disable and Enable System Restore. - You should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.
  
  You can find instructions on how to enable and reenable system restore here:
  
  Windows XP System Restore Guide
  
  Renable system restore with instructions from tutorial above
  
  
• Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
  
  See this link for a listing of some online & their stand-alone antivirus programs:
  
  Virus, Spyware, and Malware Protection and Removal Resources
  
  
• Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
  
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  
  Understanding and Using Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  
  A tutorial on installing & using this product can be found here:
  
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Excellent, thank you very much for the pointers/resources! It helps to narrow things down a little bit and to have some expert guidance.

I'm a little confused on the removal of combofix though, as I ran the instruction with the /u switch and it just ran again, asked if I wanted to use the updated version, scanned, and then produced a log.

Is the /u switch for "update" or is it supposed to be for "uninstall?" Or is there perhaps another switch for uninstall? Or maybe I'm just doing something wrong...

Try this instead.

ComboFix /uninstall