Slow...

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

KennedyRec

Thread Starter
Joined
Nov 9, 2011
Messages
4
Looking for some help, slow running Dell. Sorry, this is long.

Windows defender is now disabled.

HiJackthis info on the attachment, i had trouble getting a log .txt file created, so i took a screen shot and pasted into word.

Thanks in advance-

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421
Run by Kennedy Rec at 14:52:03 on 2011-11-09
Microsoft® Windows Vista™ Business 6.0.6002.2.1252.1.1033.18.2046.457 [GMT -6:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\sttray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.foxnews.com/
uInternet Settings,ProxyOverride = <local>;*.local
uInternet Settings,ProxyServer = http=127.0.0.1:6092
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar2.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
uRun: [msiegent] rundll32 "c:\users\kenned~1\appdata\local\temp\bridgini.dll",CreateProcessNotify
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [avast] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SigmatelSysTrayApp] sttray.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\windows\installer\{53a01cc6-14b0-4512-a2e7-10d39bf83dc4}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} - hxxp://support.dell.com/systemprofiler/SysProExe.CAB
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{7C77959A-BBAF-4F4A-A803-AA0AB6C4057A} : DhcpNameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{D3684C8E-0509-45B9-BE0F-786D46571729} : DhcpNameServer = 209.18.47.61 209.18.47.62
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-5-13 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-9-15 320856]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-9-15 20568]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-9-15 54616]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-15 44768]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-9-15 21504]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-3-30 366152]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-3-30 22216]
S1 nuswvopi;nuswvopi;c:\windows\system32\drivers\nuswvopi.sys [2009-10-27 30784]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 elDiag;Diagostics Port Device Driver;c:\windows\system32\drivers\FTD2XX.sys [2007-2-15 34639]
S3 elUsbCardBus;elu132.sys device driver;c:\windows\system32\drivers\elu132.sys [2007-2-15 95360]
.
=============== Created Last 30 ================
.
2011-11-09 18:08:22 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{cbb5be55-c5cf-49b6-b35e-aa4c56e2e025}\offreg.dll
2011-11-09 17:11:03 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2011-11-09 17:11:02 98816 ----a-w- c:\windows\system32\mfps.dll
2011-11-09 17:11:02 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
2011-11-09 17:11:02 302592 ----a-w- c:\windows\system32\mfmp4src.dll
2011-11-09 17:11:02 2873344 ----a-w- c:\windows\system32\mf.dll
2011-11-09 17:11:02 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-11-09 17:11:01 586240 ----a-w- c:\windows\system32\stobject.dll
2011-11-09 17:11:01 209920 ----a-w- c:\windows\system32\mfplat.dll
2011-11-09 17:07:47 519680 ----a-w- c:\windows\system32\d3d11.dll
2011-11-09 17:07:47 369664 ----a-w- c:\windows\system32\WMPhoto.dll
2011-11-09 17:07:47 252928 ----a-w- c:\windows\system32\dxdiag.exe
2011-11-09 17:07:47 195584 ----a-w- c:\windows\system32\dxdiagn.dll
2011-11-09 17:07:46 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
2011-11-09 17:07:46 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2011-11-09 17:07:46 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2011-11-09 16:35:16 -------- d-----w- c:\windows\system32\eu-ES
2011-11-09 16:35:16 -------- d-----w- c:\windows\system32\ca-ES
2011-11-09 16:35:15 -------- d-----w- c:\windows\system32\vi-VN
2011-11-09 16:25:37 -------- d-----w- c:\windows\system32\SPReview
2011-11-09 15:32:09 928768 ----a-w- c:\windows\system32\scavenge.dll
2011-11-09 15:31:53 57856 ----a-w- c:\windows\system32\compcln.exe
2011-11-09 15:22:59 800768 ----a-w- c:\windows\system32\advapi32.dll
2011-11-09 15:21:54 1514496 ----a-w- c:\windows\system32\WindowsAnytimeUpgradeCPL.dll
2011-11-09 15:20:59 324608 ----a-w- c:\program files\windows nt\tabletextservice\TableTextService.dll
2011-11-09 15:09:00 -------- d-----w- c:\windows\system32\EventProviders
2011-11-09 15:05:45 -------- d-----w- C:\e20a8ea623d106bcf201c9
2011-11-08 12:50:03 6668624 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{cbb5be55-c5cf-49b6-b35e-aa4c56e2e025}\mpengine.dll
2011-10-13 16:37:30 388096 ----a-r- c:\users\kennedy rec\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-10-13 16:37:27 -------- d-----w- c:\program files\Trend Micro
2011-10-13 14:47:54 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-10-13 14:47:54 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2011-10-13 14:45:27 -------- d-----w- c:\program files\iPod
2011-10-13 14:45:22 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2011-10-13 14:45:22 -------- d-----w- c:\program files\iTunes
2011-10-13 14:38:02 -------- d-----w- c:\program files\Bonjour
.
==================== Find3M ====================
.
2011-11-09 17:10:58 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-11-09 17:07:48 4096 ----a-w- c:\windows\system32\drivers\en-us\dxgkrnl.sys.mui
2011-10-19 23:10:58 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-06 20:45:29 41184 ----a-w- c:\windows\avastSS.scr
2011-09-06 20:38:05 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-06 20:36:26 54616 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-08-31 22:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-31 04:05:04 83816 ----a-w- c:\windows\system32\dns-sd.exe
2011-08-31 04:05:04 73064 ----a-w- c:\windows\system32\dnssd.dll
2011-08-31 04:05:04 50536 ----a-w- c:\windows\system32\jdns_sd.dll
2011-08-31 04:05:04 178536 ----a-w- c:\windows\system32\dnssdX.dll
.
============= FINISH: 14:54:17.25 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Business
Boot Device: \Device\HarddiskVolume3
Install Date: 2/9/2007 6:02:24 AM
System Uptime: 11/9/2011 12:07:13 PM (2 hours ago)
.
Motherboard: Dell Inc. | | 0YD479
Processor: Genuine Intel(R) CPU T2250 @ 1.73GHz | Microprocessor | 800/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 137 GiB total, 97.746 GiB free.
D: is FIXED (NTFS) - 10 GiB total, 0.288 GiB free.
E: is CDROM (UDF)
F: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP2023: 11/9/2011 9:17:17 AM - Windows Vista™ Service Pack 2
RP2024: 11/9/2011 11:06:07 AM - Windows Modules Installer
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Reader 7.0.8
Apple Application Support
Apple Mobile Device Support
Apple Software Update
avast! Free Antivirus
Bonjour
Conexant HDA D110 MDC V.92 Modem
Dell Support Center (Support Software)
Dell System Customization Wizard
DellSupport
Google Toolbar for Internet Explorer
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Internet Explorer (Enable DEP)
iTunes
Java Auto Updater
Java(TM) 6 Update 25
Malwarebytes' Anti-Malware version 1.51.2.1300
MediaDirect
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Office File Validation Add-In
Microsoft Office Professional Edition 2003
Microsoft Office Small Business Edition 2003
Microsoft Streets & Trips 2006
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Modem Diagnostic Tool
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Navionics Chart Installer
Navionics PC app-V1.3
NetWaiting
OGA Notifier 2.0.0048.0
OutlookAddinSetup
Picasa 3
QuickSet
QuickTime
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
SigmaTel Audio
Sonic Activation Module
Synaptics Pointing Device Driver
U132 Diagnostics port drivers
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
URL Assistant
USB CardBus Adapter Drivers
User's Guides
Windows Live OneCare safety scanner
.
==== Event Viewer Messages From Past Week ========
.
11/9/2011 11:16:26 AM, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control.
.
==== End Of File ===========================

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421
Run by Kennedy Rec at 14:52:03 on 2011-11-09
Microsoft® Windows Vista™ Business 6.0.6002.2.1252.1.1033.18.2046.457 [GMT -6:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\sttray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.foxnews.com/
uInternet Settings,ProxyOverride = <local>;*.local
uInternet Settings,ProxyServer = http=127.0.0.1:6092
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar2.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
uRun: [msiegent] rundll32 "c:\users\kenned~1\appdata\local\temp\bridgini.dll",CreateProcessNotify
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [avast] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SigmatelSysTrayApp] sttray.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\windows\installer\{53a01cc6-14b0-4512-a2e7-10d39bf83dc4}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} - hxxp://support.dell.com/systemprofiler/SysProExe.CAB
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{7C77959A-BBAF-4F4A-A803-AA0AB6C4057A} : DhcpNameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{D3684C8E-0509-45B9-BE0F-786D46571729} : DhcpNameServer = 209.18.47.61 209.18.47.62
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-5-13 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-9-15 320856]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-9-15 20568]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-9-15 54616]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-15 44768]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-9-15 21504]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-3-30 366152]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-3-30 22216]
S1 nuswvopi;nuswvopi;c:\windows\system32\drivers\nuswvopi.sys [2009-10-27 30784]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 elDiag;Diagostics Port Device Driver;c:\windows\system32\drivers\FTD2XX.sys [2007-2-15 34639]
S3 elUsbCardBus;elu132.sys device driver;c:\windows\system32\drivers\elu132.sys [2007-2-15 95360]
.
=============== Created Last 30 ================
.
2011-11-09 18:08:22 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{cbb5be55-c5cf-49b6-b35e-aa4c56e2e025}\offreg.dll
2011-11-09 17:11:03 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2011-11-09 17:11:02 98816 ----a-w- c:\windows\system32\mfps.dll
2011-11-09 17:11:02 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
2011-11-09 17:11:02 302592 ----a-w- c:\windows\system32\mfmp4src.dll
2011-11-09 17:11:02 2873344 ----a-w- c:\windows\system32\mf.dll
2011-11-09 17:11:02 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-11-09 17:11:01 586240 ----a-w- c:\windows\system32\stobject.dll
2011-11-09 17:11:01 209920 ----a-w- c:\windows\system32\mfplat.dll
2011-11-09 17:07:47 519680 ----a-w- c:\windows\system32\d3d11.dll
2011-11-09 17:07:47 369664 ----a-w- c:\windows\system32\WMPhoto.dll
2011-11-09 17:07:47 252928 ----a-w- c:\windows\system32\dxdiag.exe
2011-11-09 17:07:47 195584 ----a-w- c:\windows\system32\dxdiagn.dll
2011-11-09 17:07:46 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
2011-11-09 17:07:46 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2011-11-09 17:07:46 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2011-11-09 16:35:16 -------- d-----w- c:\windows\system32\eu-ES
2011-11-09 16:35:16 -------- d-----w- c:\windows\system32\ca-ES
2011-11-09 16:35:15 -------- d-----w- c:\windows\system32\vi-VN
2011-11-09 16:25:37 -------- d-----w- c:\windows\system32\SPReview
2011-11-09 15:32:09 928768 ----a-w- c:\windows\system32\scavenge.dll
2011-11-09 15:31:53 57856 ----a-w- c:\windows\system32\compcln.exe
2011-11-09 15:22:59 800768 ----a-w- c:\windows\system32\advapi32.dll
2011-11-09 15:21:54 1514496 ----a-w- c:\windows\system32\WindowsAnytimeUpgradeCPL.dll
2011-11-09 15:20:59 324608 ----a-w- c:\program files\windows nt\tabletextservice\TableTextService.dll
2011-11-09 15:09:00 -------- d-----w- c:\windows\system32\EventProviders
2011-11-09 15:05:45 -------- d-----w- C:\e20a8ea623d106bcf201c9
2011-11-08 12:50:03 6668624 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{cbb5be55-c5cf-49b6-b35e-aa4c56e2e025}\mpengine.dll
2011-10-13 16:37:30 388096 ----a-r- c:\users\kennedy rec\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-10-13 16:37:27 -------- d-----w- c:\program files\Trend Micro
2011-10-13 14:47:54 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-10-13 14:47:54 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2011-10-13 14:45:27 -------- d-----w- c:\program files\iPod
2011-10-13 14:45:22 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2011-10-13 14:45:22 -------- d-----w- c:\program files\iTunes
2011-10-13 14:38:02 -------- d-----w- c:\program files\Bonjour
.
==================== Find3M ====================
.
2011-11-09 17:10:58 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-11-09 17:07:48 4096 ----a-w- c:\windows\system32\drivers\en-us\dxgkrnl.sys.mui
2011-10-19 23:10:58 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-06 20:45:29 41184 ----a-w- c:\windows\avastSS.scr
2011-09-06 20:38:05 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-06 20:36:26 54616 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-08-31 22:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-31 04:05:04 83816 ----a-w- c:\windows\system32\dns-sd.exe
2011-08-31 04:05:04 73064 ----a-w- c:\windows\system32\dnssd.dll
2011-08-31 04:05:04 50536 ----a-w- c:\windows\system32\jdns_sd.dll
2011-08-31 04:05:04 178536 ----a-w- c:\windows\system32\dnssdX.dll
.
============= FINISH: 14:54:17.25 ===============
 

eddie5659

Moderator
Malware Specialist
Joined
Mar 19, 2001
Messages
37,298
Hiya and welcome to Tech Support Guy :)

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
  • Under "Configuration and Preferences", click the Preferences button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.

Please include the MBAM log and, SUPERAntiSpyware Scan Log and a fresh HijackThis log in your next reply

eddie
 

KennedyRec

Thread Starter
Joined
Nov 9, 2011
Messages
4
Here are the requested files-- Thanks again.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:32:57 PM, on 11/12/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Dell Support Center\gs_agent\dsc.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6092
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell.com/systemprofiler/SysProExe.CAB
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 5311 bytes

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Database version: 8147
Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421
11/12/2011 2:36:11 PM
mbam-log-2011-11-12 (14-36-10).txt
Scan type: Full scan (C:\|)
Objects scanned: 311481
Time elapsed: 1 hour(s), 43 minute(s), 41 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 11/12/2011 at 04:26 PM
Application Version : 5.0.1136
Core Rules Database Version : 7937
Trace Rules Database Version: 5749
Scan type : Quick Scan
Total Scan Time : 00:40:03
Operating System Information
Windows Vista Business 32-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Limited User (Administrator User)
Memory items scanned : 713
Memory threats detected : 0
Registry items scanned : 36507
Registry threats detected : 0
File items scanned : 14381
File threats detected : 106
Adware.Tracking Cookie
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\N81GNET0.txt [ /legolas-media.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\EXGIBKHV.txt [ /invitemedia.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\8RJGI4ZW.txt [ /2o7.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\48CO5446.txt [ /liveperson.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\GP52R4FP.txt [ /ad.yieldmanager.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\8PCT29BR.txt [ /serving-sys.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\5WUSJ013.txt [ /pointroll.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\IALRGV86.txt [ /amazon-adsystem.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\843B6G4Y.txt [ /insightexpressai.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\1DTRTV0W.txt [ /steelhousemedia.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\T6MKL7KQ.txt [ /a1.interclick.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\K150SDYE.txt [ /apmebf.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\UYV6QU4S.txt [ /atdmt.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\Z5RI01SJ.txt [ /collective-media.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\ML7HYIMV.txt [ /advertising.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\UZ0O480G.txt [ /liveperson.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\S9UHJQ76.txt [ /liveperson.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\OPYLK85F.txt [ /realmedia.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\ZL3JH07U.txt [ /doubleclick.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\5QGXPXWJ.txt [ /at.atwola.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\KB348R27.txt [ /adxpose.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\2V5A2WUZ.txt [ /ads.pointroll.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\4ORVF3PN.txt [ /bs.serving-sys.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\VCGU1NAC.txt [ /imrworldwide.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\XDLBJCOC.txt [ /specificclick.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\LN60U7G1.txt [ /revsci.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\B07D3DAR.txt [ /ad.wsod.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\8Y6W5QAH.txt [ /questionmarket.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\14A1AF9I.txt [ /ru4.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\9EUTQ08D.txt [ /zedo.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\MH2PDBX6.txt [ /yieldmanager.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\UIKBEV39.txt [ /liveperson.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\VHHXJ4ZM.txt [ /tribalfusion.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\11PVY7FL.txt [ /ads.pubmatic.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\NATZ89CA.txt [ /liveperson.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\3NC1LC6S.txt [ /r1-ads.ace.advertising.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\JIVJCKH7.txt [ /media6degrees.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\SG7M649Y.txt [ /kontera.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\U5JOT3O4.txt [ /viewablemedia.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\AG8KA45W.txt [ /ar.atwola.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\X1Y9IC9Q.txt [ /o1.qnsr.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\R9K97JD5.txt [ /s.clickability.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\B3L0LQ31.txt [ /e1.cdn.qnsr.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\0NQD7Q16.txt [ /qnsr.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\WE0PZ5LT.txt [ /tacoda.at.atwola.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\XS5YNFOY.txt [ /akamai.interclickproxy.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\L07VOTL3.txt [ /liveperson.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\K8N6Q90O.txt [ /statse.webtrendslive.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\PTJB2SB2.txt [ /www.qsstats.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\QNITC097.txt [ /interclick.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\A5PL4YF4.txt [ /lm.logicalmedia.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\RB2XWNAE.txt [ /ads.undertone.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\7DWS6V94.txt [ /trackalyzer.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\ZMOGDIXQ.txt [ /sales.liveperson.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\7M8VCGJZ.txt [ /fastclick.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\82GYN1EK.txt [ /adinterax.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\Q7K36CWW.txt [ /www.googleadservices.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\DZXTVRQM.txt [ /www.qsstats.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\0DB0B9DX.txt [ /eyewonder.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\K8YGXGFP.txt [ /mediaplex.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\Y7LF0DO6.txt [ /pro-market.net ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\CNGHJQDY.txt [ /casalemedia.com ]
C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\E8ME5K6T.txt [ /www.googleadservices.com ]
C:\USERS\KENNEDY REC\AppData\Roaming\Microsoft\Windows\Cookies\ZQ6ZHJTK.txt [ Cookie:kennedy [email protected]/adserving ]
C:\USERS\KENNEDY REC\Cookies\N81GNET0.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\8RJGI4ZW.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\CYGADY3F.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\8PCT29BR.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\VC9LNBJX.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\5WUSJ013.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\IALRGV86.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\843B6G4Y.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\1DTRTV0W.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\Z5RI01SJ.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\KOPXZQ9J.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\S9UHJQ76.txt [ Cookie:kennedy [email protected]/hc/71605247 ]
C:\USERS\KENNEDY REC\Cookies\OPYLK85F.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\ZL3JH07U.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\KB348R27.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\2V5A2WUZ.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\4ORVF3PN.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\VCGU1NAC.txt [ Cookie:kennedy [email protected]/cgi-bin ]
C:\USERS\KENNEDY REC\Cookies\XDLBJCOC.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\8Y6W5QAH.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\14A1AF9I.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\9EUTQ08D.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\MH2PDBX6.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\VHHXJ4ZM.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\ZQ6ZHJTK.txt [ Cookie:kennedy [email protected]/adserving ]
C:\USERS\KENNEDY REC\Cookies\3NC1LC6S.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\SG7M649Y.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\U5JOT3O4.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\TUZ5YVPR.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\TVAX6Q1M.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\L07VOTL3.txt [ Cookie:kennedy [email protected]/hc/63000276 ]
C:\USERS\KENNEDY REC\Cookies\QNITC097.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\A5PL4YF4.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\7DWS6V94.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\ZMOGDIXQ.txt [ Cookie:kennedy [email protected]/hc/76226072 ]
C:\USERS\KENNEDY REC\Cookies\7M8VCGJZ.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\82GYN1EK.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\Q7K36CWW.txt [ Cookie:kennedy [email protected]/pagead/conversion/1071232054/ ]
C:\USERS\KENNEDY REC\Cookies\DZXTVRQM.txt [ Cookie:kennedy [email protected]/dcsfvmrnb00000ctq1udd7gnx_2c8n ]
C:\USERS\KENNEDY REC\Cookies\0DB0B9DX.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\K8YGXGFP.txt [ Cookie:kennedy [email protected]/ ]
C:\USERS\KENNEDY REC\Cookies\CNGHJQDY.txt [ Cookie:kennedy [email protected]/ ]
 

eddie5659

Moderator
Malware Specialist
Joined
Mar 19, 2001
Messages
37,298
Thanks :)

Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

eddie
 

KennedyRec

Thread Starter
Joined
Nov 9, 2011
Messages
4
Sorry for the delay, here are the logs- Thanks in advance-
PK

OTL Extras logfile created on: 11/17/2011 9:13:58 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Kennedy Rec\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 0.87 Gb Available Physical Memory | 43.59% Memory free
4.23 Gb Paging File | 1.93 Gb Available in Paging File | 45.65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 137.00 Gb Total Space | 78.58 Gb Free Space | 57.36% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 0.29 Gb Free Space | 2.88% Space Free | Partition Type: NTFS
Drive E: | 4.38 Gb Total Space | 1.53 Gb Free Space | 34.87% Space Free | Partition Type: UDF
Drive F: | 7.39 Gb Total Space | 7.02 Gb Free Space | 94.87% Space Free | Partition Type: FAT32

Computer Name: KENNEDYREC-PC | User Name: Kennedy Rec | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UpdatesDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1774953698-1593180319-2558697840-1001]
"EnableNotifications" = 1
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0431B717-5B65-47D2-ADB3-71699E2862C3}" = lport=139 | protocol=6 | dir=in | app=system |
"{1C5254EE-160A-469E-A350-1E26F86AB021}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{23256069-F40A-4241-B984-009546CDA7E3}" = rport=139 | protocol=6 | dir=out | app=system |
"{35393636-07DE-40C5-9730-12679B214E7A}" = rport=445 | protocol=6 | dir=out | app=system |
"{5DD769F4-48A3-478B-ABA3-D5474CFB60DB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{62385AD8-8333-4D99-BB4C-D1DE49058E65}" = rport=137 | protocol=17 | dir=out | app=system |
"{939B3BE8-3901-4323-943D-2F6D16F626EE}" = rport=138 | protocol=17 | dir=out | app=system |
"{AD0870D3-1173-449C-965E-A4784AD37A87}" = lport=137 | protocol=17 | dir=in | app=system |
"{C15C0363-8D5C-430D-B6DF-D84E60DD6FA6}" = lport=138 | protocol=17 | dir=in | app=system |
"{DCE415D0-678A-4BEB-AF1B-26A6BB808410}" = lport=445 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{20296AED-D63E-4B81-A1C3-5BA91E11648C}" = protocol=1 | dir=in | [email protected],-28543 |
"{5C528167-C560-48FE-9256-C200CE721B7E}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{82808125-5B70-4A7C-AA10-80A7B0AD5016}" = protocol=1 | dir=out | [email protected],-28544 |
"{8B1A9990-1CA3-49E5-9640-FE9ED34003F7}" = protocol=17 | dir=in | app=c:\windows\system32\wininit.exe |
"{B7DDCBE0-BA6B-4215-A206-DD48C28C48FF}" = protocol=6 | dir=in | app=c:\windows\system32\wininit.exe |
"{CA04DC00-95B3-4915-A1C0-9456E313544F}" = protocol=58 | dir=in | [email protected],-28545 |
"{D78CB90A-914D-4C6D-9C50-741AA3E1723A}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{DC16F467-32F4-4CDE-B370-EE9253EFA2C3}" = protocol=6 | dir=in | app=c:\windows\system32\wininit.exe |
"{DD97DDE9-180C-4FE8-8E62-1A73D5B9CFDA}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{DE62F1ED-FA28-4A0E-949E-1C3F74C92219}" = protocol=17 | dir=in | app=c:\windows\system32\wininit.exe |
"{EBEC2CE9-DE7F-4F90-8C66-CFFB0242E877}" = protocol=58 | dir=out | [email protected],-28546 |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01A20F31-98A4-38AC-75C0-8F2AB27C1510}" = Navionics Chart Installer
"{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}" = Dell System Customization Wizard
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20BF56A9-AD50-40F5-9C85-F02EBE356241}" = Navionics PC app-V1.3
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 25
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{53A01CC6-14B0-4512-A2E7-10D39BF83DC4}" = QuickSet
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{83ED1E80-A1B7-4226-BCF1-AC4A88151A6B}" = Microsoft Streets & Trips 2006
"{8DC42D05-680B-41B0-8878-6C14D24602DB}" = QuickTime
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{91CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003
"{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect
"{A00B9A50-3090-4CFF-9CDA-82DA0BEDAA21}" = Apple Mobile Device Support
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb" = Internet Explorer (Enable DEP)
"{AC76BA86-7AD7-1033-7B44-A70800000002}" = Adobe Reader 7.0.8
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"avast" = avast! Free Antivirus
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3" = Conexant HDA D110 MDC V.92 Modem
"elDiag" = U132 Diagnostics port drivers
"elUsbCardBus" = USB CardBus Adapter Drivers
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Navionics PC app-V1.3" = Navionics PC app-V1.3
"navionicsChartInstaller.Air.A3B2DB703D5E0A7ECA24FBD4B07176191EDD3C63.1" = Navionics Chart Installer
"Picasa 3" = Picasa 3
"SynTPDeinstKey" = Synaptics Pointing Device Driver

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/17/2011 12:09:01 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 5538

Error - 11/17/2011 12:09:03 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/17/2011 12:09:03 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7660

Error - 11/17/2011 12:09:03 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7660

Error - 11/17/2011 12:09:04 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/17/2011 12:09:04 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8690

Error - 11/17/2011 12:09:04 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8690

Error - 11/17/2011 12:09:05 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/17/2011 12:09:05 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9844

Error - 11/17/2011 12:09:05 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9844

[ System Events ]
Error - 11/10/2011 10:34:13 AM | Computer Name = KennedyRec-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

Error - 11/10/2011 10:53:11 AM | Computer Name = KennedyRec-PC | Source = DCOM | ID = 10010
Description =

Error - 11/10/2011 1:10:58 PM | Computer Name = KennedyRec-PC | Source = bowser | ID = 8003
Description =

Error - 11/10/2011 7:01:35 PM | Computer Name = KennedyRec-PC | Source = DCOM | ID = 10010
Description =

Error - 11/12/2011 7:28:06 PM | Computer Name = KennedyRec-PC | Source = DCOM | ID = 10010
Description =

Error - 11/14/2011 7:12:40 PM | Computer Name = KennedyRec-PC | Source = DCOM | ID = 10010
Description =

Error - 11/15/2011 12:45:29 AM | Computer Name = KennedyRec-PC | Source = DCOM | ID = 10010
Description =

Error - 11/15/2011 11:12:14 AM | Computer Name = KennedyRec-PC | Source = DCOM | ID = 10010
Description =

Error - 11/16/2011 10:13:02 PM | Computer Name = KennedyRec-PC | Source = Service Control Manager | ID = 7011
Description =

Error - 11/17/2011 9:51:04 PM | Computer Name = KennedyRec-PC | Source = Service Control Manager | ID = 7011
Description =

< End of report >

OTL logfile created on: 11/17/2011 9:13:58 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Kennedy Rec\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 0.87 Gb Available Physical Memory | 43.59% Memory free
4.23 Gb Paging File | 1.93 Gb Available in Paging File | 45.65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 137.00 Gb Total Space | 78.58 Gb Free Space | 57.36% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 0.29 Gb Free Space | 2.88% Space Free | Partition Type: NTFS
Drive E: | 4.38 Gb Total Space | 1.53 Gb Free Space | 34.87% Space Free | Partition Type: UDF
Drive F: | 7.39 Gb Total Space | 7.02 Gb Free Space | 94.87% Space Free | Partition Type: FAT32

Computer Name: KENNEDYREC-PC | User Name: Kennedy Rec | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/11/17 21:12:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Kennedy Rec\Desktop\OTL.exe
PRC - [2011/11/07 12:04:36 | 004,617,600 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
PRC - [2011/09/06 14:45:30 | 003,722,416 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2011/09/06 14:45:28 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2011/08/31 16:00:48 | 000,449,608 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011/08/31 16:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/08/11 17:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe
PRC - [2009/05/21 09:55:32 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
PRC - [2009/04/10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/08/13 17:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2006/05/16 23:15:10 | 000,071,288 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe


========== Modules (No Company Name) ==========

MOD - [2011/11/15 09:32:38 | 000,063,488 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
MOD - [2011/11/15 09:32:38 | 000,052,736 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
MOD - [2011/11/12 03:15:09 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\c1c06a392871267db27f7cbc40e1c4fb\System.Xml.ni.dll
MOD - [2011/11/12 03:14:38 | 007,950,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\f9c36ea806e77872dce891c77b68fac3\System.ni.dll
MOD - [2011/11/12 03:14:08 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll
MOD - [2011/11/09 17:24:49 | 000,117,760 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
MOD - [2011/11/09 17:24:48 | 000,052,224 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
MOD - [2006/10/24 22:44:00 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (stllssvr)
SRV - File not found [Auto | Stopped] -- -- (CLTNetCnService)
SRV - [2011/09/06 14:45:28 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2011/08/31 16:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/08/11 17:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)
SRV - [2008/08/13 17:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2008/01/19 01:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2006/11/07 13:27:02 | 000,070,656 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)


========== Driver Services (SafeList) ==========

DRV - [2011/09/06 14:38:05 | 000,442,200 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/09/06 14:37:53 | 000,320,856 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/09/06 14:36:38 | 000,034,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/09/06 14:36:36 | 000,052,568 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/09/06 14:36:26 | 000,054,616 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2011/09/06 14:36:12 | 000,020,568 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2011/08/31 16:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/07/22 10:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011/07/12 15:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2009/10/27 20:00:30 | 000,030,784 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\nuswvopi.sys -- (nuswvopi)
DRV - [2007/02/13 03:00:00 | 000,383,800 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2006/12/01 15:40:46 | 000,647,680 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2006/11/20 13:13:58 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006/11/20 13:13:58 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006/11/20 13:13:56 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006/11/11 17:10:40 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2006/11/02 01:30:55 | 000,200,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2006/11/02 01:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/10/30 11:42:28 | 001,786,880 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2006/10/24 22:53:08 | 002,068,992 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006/10/05 16:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2006/08/17 15:43:52 | 000,007,424 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Program Files\DellSupport\Drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2006/03/21 11:07:33 | 000,095,360 | ---- | M] (Elan Digital Systems Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\elu132.sys -- (elUsbCardBus)
DRV - [2005/12/15 09:27:52 | 000,034,639 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\FTD2XX.sys -- (elDiag)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6092

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)



O1 HOSTS File: ([2009/10/27 20:38:32 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" File not found
O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} http://support.dell.com/systemprofiler/SysProExe.CAB (WMI Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7C77959A-BBAF-4F4A-A803-AA0AB6C4057A}: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D3684C8E-0509-45B9-BE0F-786D46571729}: DhcpNameServer = 209.18.47.61 209.18.47.62
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Users\Kennedy Rec\Desktop\P1040035.JPG
O24 - Desktop BackupWallPaper: C:\Users\Kennedy Rec\Desktop\P1040035.JPG
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 15:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009/08/28 08:22:40 | 000,000,000 | RH-- | M] () - E:\autorun.wbcat -- [ UDF ]
O32 - AutoRun File - [2009/08/28 08:22:42 | 000,000,132 | ---- | M] () - E:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/11/17 21:12:24 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Kennedy Rec\Desktop\OTL.exe
[2011/11/10 09:11:41 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices
[2011/11/10 08:52:44 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2011/11/09 17:24:29 | 000,000,000 | ---D | C] -- C:\Users\Kennedy Rec\AppData\Roaming\SUPERAntiSpyware.com
[2011/11/09 17:23:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2011/11/09 17:23:14 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2011/11/09 17:23:14 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2011/11/09 10:35:16 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2011/11/09 10:35:16 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2011/11/09 10:35:15 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2011/11/09 10:25:37 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview
[2011/11/09 09:09:00 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2011/11/09 09:05:45 | 000,000,000 | ---D | C] -- C:\e20a8ea623d106bcf201c9
[2011/11/03 18:17:26 | 000,000,000 | ---D | C] -- C:\Users\Kennedy Rec\Desktop\Cover Letters
[2011/11/03 18:17:19 | 000,000,000 | ---D | C] -- C:\Users\Kennedy Rec\Desktop\Resumes

========== Files - Modified Within 30 Days ==========

[2011/11/17 21:12:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Kennedy Rec\Desktop\OTL.exe
[2011/11/17 20:05:14 | 000,003,680 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/11/17 20:05:14 | 000,003,680 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/11/17 19:51:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/11/17 10:45:24 | 000,002,533 | ---- | M] () -- C:\Users\Kennedy Rec\Desktop\Microsoft Streets & Trips 2006.lnk
[2011/11/15 09:34:43 | 000,607,406 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/11/15 09:34:43 | 000,105,014 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/11/15 09:29:29 | 2145,849,344 | -HS- | M] () -- C:\hiberfil.sys
[2011/11/14 10:20:49 | 000,006,656 | ---- | M] () -- C:\Users\Kennedy Rec\Desktop\Boulder Junction, Wisconsin, United States.est
[2011/11/12 17:32:40 | 000,002,535 | ---- | M] () -- C:\Users\Kennedy Rec\Desktop\HiJackThis.lnk
[2011/11/10 09:15:42 | 000,378,808 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/11/10 09:11:05 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2011/11/10 09:10:17 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2011/11/09 17:23:27 | 000,001,802 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/11/09 15:02:36 | 000,302,592 | ---- | M] () -- C:\Users\Kennedy Rec\Desktop\pngsbrwc.exe
[2011/11/09 12:09:54 | 000,000,418 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2011/11/09 11:51:57 | 000,000,945 | ---- | M] () -- C:\Users\Kennedy Rec\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/11/09 11:13:17 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat
[2011/11/09 11:13:17 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat
[2011/11/09 11:12:49 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2011/11/08 11:50:53 | 000,007,592 | ---- | M] () -- C:\Users\Kennedy Rec\AppData\Local\d3d9caps.dat
[2011/11/05 13:43:09 | 000,026,383 | ---- | M] () -- C:\Users\Kennedy Rec\Desktop\Mantel.jpg
[2011/11/05 13:17:23 | 001,835,523 | ---- | M] () -- C:\Users\Kennedy Rec\Desktop\Gun Show.JPG
[2011/10/24 15:06:12 | 000,127,571 | ---- | M] () -- C:\Users\Kennedy Rec\Desktop\Explorer Title _Abstract[1].pdf

========== Files Created - No Company Name ==========

[2011/11/10 09:11:05 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2011/11/10 09:10:17 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2011/11/09 17:23:27 | 000,001,802 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/11/09 15:02:31 | 000,302,592 | ---- | C] () -- C:\Users\Kennedy Rec\Desktop\pngsbrwc.exe
[2011/11/09 11:12:49 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2011/11/09 09:23:40 | 000,392,170 | ---- | C] () -- C:\Windows\System32\onex.tmf
[2011/11/09 09:23:35 | 000,009,212 | ---- | C] () -- C:\Windows\System32\RacUR.xml
[2011/11/09 09:23:35 | 000,000,153 | ---- | C] () -- C:\Windows\System32\RacUREx.xml
[2011/11/09 09:23:33 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011/11/09 09:23:21 | 000,344,698 | ---- | C] () -- C:\Windows\System32\eaphost.tmf
[2011/11/09 09:23:17 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011/11/09 09:23:14 | 000,442,788 | ---- | C] () -- C:\Windows\System32\dot3.tmf
[2011/11/09 09:21:53 | 000,208,966 | ---- | C] () -- C:\Windows\System32\WFP.TMF
[2011/11/09 09:21:25 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011/11/09 09:21:14 | 000,092,918 | ---- | C] () -- C:\Windows\System32\slmgr.vbs
[2011/11/09 09:21:12 | 000,009,239 | ---- | C] () -- C:\Windows\System32\spcinstrumentation.man
[2011/11/09 09:21:01 | 000,130,008 | ---- | C] () -- C:\Windows\System32\systemsf.ebd
[2011/11/05 14:27:10 | 000,026,383 | ---- | C] () -- C:\Users\Kennedy Rec\Desktop\Mantel.jpg
[2011/11/05 13:17:23 | 001,835,523 | ---- | C] () -- C:\Users\Kennedy Rec\Desktop\Gun Show.JPG
[2011/10/24 15:06:12 | 000,127,571 | ---- | C] () -- C:\Users\Kennedy Rec\Desktop\Explorer Title _Abstract[1].pdf
[2010/02/09 19:06:27 | 000,000,418 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2009/10/27 20:23:31 | 000,236,544 | ---- | C] () -- C:\Windows\PEV.exe
[2009/10/27 20:23:31 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2009/10/27 20:23:31 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2009/10/27 20:23:31 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2009/10/27 20:23:31 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009/03/03 18:18:42 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2007/07/30 20:29:08 | 000,004,096 | -H-- | C] () -- C:\Users\Kennedy Rec\AppData\Local\keyfile3.drm
[2007/02/23 14:24:21 | 000,003,957 | ---- | C] () -- C:\Windows\checkip.dat
[2007/02/16 18:40:36 | 000,000,254 | ---- | C] () -- C:\Users\Kennedy Rec\AppData\Roaming\wklnhst.dat
[2007/02/15 17:55:17 | 000,077,824 | ---- | C] () -- C:\Windows\System32\FTDIUNIN.exe
[2007/02/15 17:55:17 | 000,000,077 | ---- | C] () -- C:\Windows\System32\elu132u1.ini
[2007/02/15 17:55:17 | 000,000,077 | ---- | C] () -- C:\Windows\System32\elu132u0.ini
[2007/02/14 16:54:10 | 000,007,592 | ---- | C] () -- C:\Users\Kennedy Rec\AppData\Local\d3d9caps.dat
[2007/02/14 15:43:45 | 000,017,408 | ---- | C] () -- C:\Users\Kennedy Rec\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/02/09 13:55:58 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2007/02/09 13:55:58 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2007/02/09 13:55:58 | 000,138,101 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2007/02/09 13:55:42 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2007/02/09 13:55:32 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007/02/09 06:33:24 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2007/02/09 06:21:23 | 000,000,120 | ---- | C] () -- C:\Windows\wininit.ini
[2006/11/02 06:56:48 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 06:47:43 | 000,378,808 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 04:33:01 | 000,607,406 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 04:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 04:33:01 | 000,105,014 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 04:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 04:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 02:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 02:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 01:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 01:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI

========== LOP Check ==========

[2008/09/10 20:00:15 | 000,000,000 | ---D | M] -- C:\Users\Kennedy Rec\AppData\Roaming\GlarySoft
[2011/04/28 17:17:27 | 000,000,000 | ---D | M] -- C:\Users\Kennedy Rec\AppData\Roaming\navionicsChartInstaller.Air.A3B2DB703D5E0A7ECA24FBD4B07176191EDD3C63.1
[2008/08/12 19:47:24 | 000,000,000 | ---D | M] -- C:\Users\Kennedy Rec\AppData\Roaming\Snapfish
[2007/02/16 18:40:38 | 000,000,000 | ---D | M] -- C:\Users\Kennedy Rec\AppData\Roaming\Template
[2011/11/15 09:14:07 | 000,032,594 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Users\Kennedy Rec\Documents\My Google Gadgets:Roxio EMC Stream
@Alternate Data Stream - 1524 bytes -> C:\Windows\System32\drivers\nuswvopi.sys:changelist
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DFC5A2B2
< End of report >
 

eddie5659

Moderator
Malware Specialist
Joined
Mar 19, 2001
Messages
37,298
Thanks :)

Please download JavaRa to your desktop and unzip it to its own folder
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
  • Now, go here and download the latest Java Version.

After doing that, can you do this for me:

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    Code:
    :OTL
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6092
    O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" File not found
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_25)
    O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_25)
    O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
    @Alternate Data Stream - 1524 bytes -> C:\Windows\System32\drivers\nuswvopi.sys:changelist
    @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DFC5A2B2
    :Files
    ipconfig /flushdns /c 
    :Commands 
    [purity] 
    [resethosts] 
    [emptytemp] 
    [EMPTYFLASH] 
    [CREATERESTOREPOINT] 
    [Reboot]
  • Then click the Run Fix button at the top
  • Click OK.
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot. Copy/Paste the report in your next reply


eddie
 

KennedyRec

Thread Starter
Joined
Nov 9, 2011
Messages
4
Here you go:

All processes killed
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
ADS C:\Windows\System32\drivers\nuswvopi.sys:changelist deleted successfully.
ADS C:\ProgramData\TEMP:DFC5A2B2 deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Kennedy Rec\Desktop\cmd.bat deleted successfully.
C:\Users\Kennedy Rec\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56466 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Kennedy Rec
->Temp folder emptied: 14673507 bytes
->Temporary Internet Files folder emptied: 408766431 bytes
->Java cache emptied: 2208783 bytes
->Flash cache emptied: 3318099 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 62100820 bytes
RecycleBin emptied: 42997945 bytes

Total Files Cleaned = 509.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Kennedy Rec
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 11202011_195328
Files\Folders moved on Reboot...
File\Folder C:\Users\Kennedy Rec\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UP1SMZ2H\bind[3].htm not found!
File\Folder C:\Users\Kennedy Rec\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OVEU1XRL\espn_go_com[1].htm not found!
C:\Users\Kennedy Rec\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OVEU1XRL\mail[4].htm moved successfully.
File\Folder C:\Users\Kennedy Rec\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\COWJ5WMH\streakModule[1].htm not found!
C:\Users\Kennedy Rec\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3T5BZ6PM\mail[1].htm moved successfully.
C:\Users\Kennedy Rec\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BCY7VT9\mail[2].htm moved successfully.
File\Folder C:\Windows\temp\_avast_\unp176828600.tmp not found!
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
Registry entries deleted on Reboot...
 

eddie5659

Moderator
Malware Specialist
Joined
Mar 19, 2001
Messages
37,298
Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! As you download it rename it to username123.exe and save it to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Remember to re-enable the protection again afterwards before connecting to the Internet.
  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.




Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

eddie
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top