Massive Infection, can't get online

[guestolo]

Open up your copy of Adobe Reader, click on HELP>>Check for Updates
Download and install any update found
Keep rechecking for updates till you have them all

To make sure you have the latest version of Adobe Flash Player installed:
1. To uninstall an older version, download this file to your Desktop: uninstall_flash_player.exe
2. Quit ALL running applications, including all Internet Explorer or other browser windows, and messenger applications (like AOL Instant Messenger, Yahoo Messenger, MSN Messenger).
3. Double-click on the file you've downloaded to uninstall Flash.
Delete the uninstaller
we'll update it in a bit

Keep all browser windows closed
Access your Add/Remove Programs and uninstall older version of Java
Remove Java™ 6 Update 13

Restart the computer afterwards
Back in Windows
Let's update Adobe Flash
Go to the following link
http://get.adobe.com/flashplayer/otherversions/

Choose operating system and version
Note: Do this procedure twice and get both
"Flash player for IE" then "Flash player for other browsers"
Save the installers to desktop
Untick the selections for 'Google toolbar' or 'McAfee Security Scan' if it is an option
Close browser windows, then install both
install_flash_player_ax.exe and install_flash_player.exe

Let's now update Sun Java

• Download the latest version of  Java Runtime Environment (JRE) .
  
• Scroll down to where it says "Java SE 6 Update 25".
  
• Click the "Download JRE" button to the right.
  
• In the Window that opens, select Windows,>>Check the "agree" box and click Continue.
  
• Click on the link to download Windows Offline Installation and save to your desktop.
  
• Then from your desktop double-click on jre-6u25-windows-i586.exe that you downloaded to install the newest version.
  

NOTE: Java installs a Quick starter service that is not really required, you can disable this after every update by the following:
Open Windows Control Panel and open the Java icon
Click on 'Advanced' >>Expand (+) on Miscellaneous
Untick "Java Quick Starter"
Apply and OK out of there

Restart the computer to set.

if you have a fast Internet connection
Download and save to desktop Service pack 3 from the following location>>>> http://www.microsoft.com/downloads/en/details.aspx?FamilyID=5b33b5a8-5e76-401f-be08-1e1555d4f3d4&displaylang=en
After you have it saved to desktop
If you have installed an AntiVirus, temporarily disable it, if no AV installed yet
Go ahead and install SP3, it can take a bit of time, so be patient

After the installation of SP3, and a restart of the computer
Ensure you visit Windows Updates from the following link using Internet Explorer
http://windowsupdate.microsoft.com/
Do and Express Scan
ONLY install the High Priority updates
Keep rechecking Windows updates till you have all High priority updates installed
Don't worry about recommended updates, your after the High Priority only
NOTE: Probably a good idea to leave Automatic Updates set to Automatic in the future, as you were/are way behind

After a final restart of the computer
I would take the time to run CCleaner and do a Disk Defragment of your C: drive
Try to refrain from too much browsing or downloading on the internet till the above and the next step is done


Finally, why not try installing the AntiVirus from Microsoft
You can get Microsoft Security Essentials from the following link
http://www.microsoft.com/en-us/security_essentials/default.aspx

After installation, ensure it's right updated and then I would take the time to do a Full system scan
It can take some time, but worth it
By default, MSE will set to scan a Quick Scan once per week

When all the above is done, can you please come back one last time
Run OTL.exe and do a Quick Scan, don't worry about Extra Registry
Post the log that opens, tell me how things are now running

[mickapoo]

Sorry for the delay. I had two more servers get infected with malware. Ok, so I'm following your instructions above and am down to the part where I am installing the Windows updates. One of the updates was, "Windows Malicious Software Removal Tool - May 2011 (KB890830)"- do you think this is necessary to install?

Also, you had mentioned IF I had a fast internet connection to install Service pack 3. Does this mean if my connection is slow, I should not install SP3?

Thanks again for your continued help.

[guestolo]

Please do all my last instructions, Including updating to SP3, you probably have a fast connection

Then let me know how things are then running

[mickapoo]

This what I have done so far from your instructions above:

Installed Windows Updates (from http://windowsupdate.microsoft.com)
Installed Java SE 6 Update 25 and updated Flash player

I haven't done anything else as far as SP3, or the Windows anti-virus program. The reason being, something from implementing the items above has caused my computer to slow down immensely. I need to try and figure out what of the three things above has slowed it down and if possible, uninstall or reverse the change.

Thank you.

[guestolo]

Why not run a Quick Scan with OTL.exe, when it's done scanning, post the log that opens

[mickapoo]

[quote name='guestolo' timestamp='1306074466' post='479572']
Why not run a Quick Scan with OTL.exe, when it's done scanning, post the log that opens
[/quote]

Sorry for the long delay...everything seems to be good, other than it is a little slow running at times, but we realize that may be due to the memory and processor (it's getting up there in years http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\'\' />

Here are the results from the OTL.Txt log that opened:


OTL logfile created on: 7/15/2011 10:18:57 AM - Run 8
OTL by OldTimer - Version 3.2.26.1     Folder = C:\Documents and Settings\Evelyn\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
1014.42 Mb Total Physical Memory | 678.89 Mb Available Physical Memory | 66.92% Memory free
2.38 Gb Paging File | 2.16 Gb Available in Paging File | 90.77% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 93.15 Gb Total Space | 35.10 Gb Free Space | 37.68% Space Free | Partition Type: NTFS
 
Computer Name: HP-WINDOWSXP | User Name: Evelyn | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011/07/15 10:18:19 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Evelyn\Desktop\OTL.exe
PRC - [2010/06/19 17:27:18 | 002,480,048 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
PRC - [2010/03/27 16:07:26 | 000,362,232 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
PRC - [2010/03/27 16:07:20 | 000,751,464 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
PRC - [2009/09/28 10:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2007/10/19 13:19:22 | 000,141,848 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2007/10/19 13:17:28 | 000,186,904 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
PRC - [2007/06/13 06:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004/10/14 09:11:10 | 001,388,544 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
PRC - [2004/09/29 12:14:36 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [2002/09/20 14:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011/07/15 10:18:19 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Evelyn\Desktop\OTL.exe
MOD - [2007/10/19 13:19:10 | 000,109,080 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcInj.dll
MOD - [2006/08/25 11:45:55 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] --  -- (AppMgmt)
SRV - [2011/06/29 17:04:47 | 003,435,096 | ---- | M] () [Auto | Running] -- c:\Program Files\Common Files\Akamai\netsession_win_e477fed.dll -- (Akamai)
SRV - [2010/06/19 17:27:18 | 002,480,048 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe -- (afcdpsrv)
SRV - [2010/03/27 16:07:20 | 000,751,464 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2010/02/19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/09/28 10:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2007/10/19 13:21:16 | 000,141,848 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)
SRV - [2007/10/19 13:19:22 | 000,141,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2007/10/19 13:17:28 | 000,186,904 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer)
SRV - [2005/01/06 17:41:22 | 000,462,848 | ---- | M] (Lexmark International, Inc.) [On_Demand | Stopped] -- C:\WINDOWS\System32\lxbucoms.exe -- (lxbu_device)
SRV - [2004/09/29 12:14:36 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2002/09/20 14:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2010/06/19 17:27:23 | 000,160,704 | ---- | M] (Acronis) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afcdp.sys -- (afcdp)
DRV - [2010/06/19 17:27:12 | 000,911,680 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\tdrpm258.sys -- (tdrpman258) Acronis Try&Decide and Restore Points filter (build 258)
DRV - [2010/06/19 17:27:10 | 000,581,984 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\timntr.sys -- (timounter)
DRV - [2010/06/19 17:26:59 | 000,166,272 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\snapman.sys -- (snapman)
DRV - [2009/04/04 14:42:24 | 000,044,704 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)
DRV - [2008/11/04 11:37:28 | 000,043,552 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tbhsd.sys -- (tbhsd)
DRV - [2007/10/19 13:16:30 | 002,109,976 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Lvckap.sys -- (LVcKap)
DRV - [2007/10/11 22:00:42 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/10/11 21:55:58 | 001,279,000 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2007/10/11 21:55:58 | 000,013,848 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lv302af.sys -- (pepifilter)
DRV - [2007/10/11 18:59:24 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2007/10/11 18:59:02 | 002,142,488 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVMVdrv.sys -- (LVMVDrv)
DRV - [2007/07/26 00:44:28 | 002,210,048 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel(R)
DRV - [2007/03/22 12:57:14 | 000,028,672 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\elagopro.sys -- (elagopro)
DRV - [2007/03/22 12:57:14 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\elaunidr.sys -- (elaunidr)
DRV - [2005/03/01 12:01:40 | 000,392,704 | ---- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
DRV - [2004/09/14 12:55:44 | 000,088,960 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MidiSyn.sys -- (MidiSyn)
DRV - [2004/08/03 18:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@emusic.com/dlm-plugin: C:\Program Files\eMusic Download Manager\plugin\npemusic.dll (eMusic.com)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.46: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.46: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.46: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKCU\Software\MozillaPlugins\@emusic.com/dlm-plugin: C:\Program Files\eMusic Download Manager\plugin\npemusic.dll (eMusic.com)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.1: C:\Documents and Settings\Evelyn\Application Data\Facebook\npfbplugin_1_0_1.dll ( )
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\eMusic Download Manager\Extensions\\Components: C:\Program Files\eMusic Download Manager\xulrunner\components [2011/07/10 20:24:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\eMusic Download Manager\Extensions\\Plugins: C:\Program Files\eMusic Download Manager\xulrunner\plugins [2011/07/10 20:24:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2009/11/30 21:56:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/05/06 14:44:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Firefox\components [2011/06/24 11:05:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Firefox\plugins [2011/06/24 10:41:29 | 000,000,000 | ---D | M]
 
[2009/01/07 13:04:54 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Evelyn\Application Data\Mozilla\Extensions
[2011/06/30 07:45:05 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\vu97i6ae.default\extensions
[2010/09/20 14:22:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\vu97i6ae.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/06/30 07:45:05 | 000,000,000 | ---D | M] (Page Speed) -- C:\Documents and Settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\vu97i6ae.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}
[2009/01/29 22:54:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/07/10 20:24:55 | 000,000,000 | ---D | M] (eMusic - Apple iTunes Support) -- C:\PROGRAM FILES\EMUSIC DOWNLOAD MANAGER\XULRUNNER\EXTENSIONS\[email protected]
[2011/07/10 20:24:55 | 000,000,000 | ---D | M] (eMusic - Nullsoft Winamp Support) -- C:\PROGRAM FILES\EMUSIC DOWNLOAD MANAGER\XULRUNNER\EXTENSIONS\[email protected]
[2011/07/10 20:24:56 | 000,000,000 | ---D | M] (eMusic - Microsoft Media Player Support) -- C:\PROGRAM FILES\EMUSIC DOWNLOAD MANAGER\XULRUNNER\EXTENSIONS\[email protected]
 
O1 HOSTS File: ([2011/05/19 12:01:49 | 000,000,470 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [LXBUCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.DLL ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKCU..\Run: [EasyLinkAdvisor] C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe (Linksys, a Division of Cisco Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoBandCustomize = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoMovingBands = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCloseDragDropBands = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoToolbarsOnTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photos.walmart.com/WalmartActivia.cab (Snapfish Activia)
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} http://ipgweb.cce.hp.com/rdqnbk2/downloads/sysinfo.cab (SysData Class)
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab (DeviceEnum Class)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} http://mickapoo.spaces.live.com/PhotoUpload/MsnPUpld.cab (Windows Live Photo Upload Control)
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} http://ipgweb.cce.hp.com/rdqnbk2/downloads/msxml4.cab (XML DOM Document 4.0)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F73BE1F4-82AA-4405-AB81-FAFB5A122359} http://store02.prostores.com/storeadmin/utilities/pssbedit.cab (SiteBuilderEditor Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 65.32.5.111 65.32.5.112
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Evelyn\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Evelyn\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/03/25 01:01:16 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/07/15 10:18:19 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Evelyn\Desktop\OTL.exe
[2011/07/13 23:47:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Evelyn\My Documents\Downloads
[2011/07/10 20:25:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Evelyn\Desktop\Brie's mp3s
[2011/07/10 20:25:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Evelyn\Local Settings\Application Data\eMusic
[2011/07/10 20:25:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Evelyn\Application Data\eMusic
[2011/07/10 20:24:51 | 000,000,000 | ---D | C] -- C:\Program Files\eMusic Download Manager
[2011/06/30 19:39:51 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Evelyn\Recent
[2011/06/25 08:08:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
 
========== Files - Modified Within 30 Days ==========
 
[2011/07/15 10:18:19 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Evelyn\Desktop\OTL.exe
[2011/07/15 09:53:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/15 08:48:52 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/15 08:46:16 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/07/14 22:53:48 | 000,001,456 | ---- | M] () -- C:\Documents and Settings\Evelyn\Local Settings\Application Data\Adobe Save for Web 12.0 Prefs
[2011/07/13 07:08:04 | 000,137,216 | ---- | M] () -- C:\Documents and Settings\Evelyn\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/24 10:41:29 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
 
========== Files Created - No Company Name ==========
 
[2011/02/11 22:07:52 | 000,000,065 | ---- | C] () -- C:\WINDOWS\Overdub.ini
[2011/02/11 22:07:33 | 000,000,066 | ---- | C] () -- C:\WINDOWS\System32\HYSBUAYB.SYS
[2011/02/04 15:45:55 | 000,001,456 | ---- | C] () -- C:\Documents and Settings\Evelyn\Local Settings\Application Data\Adobe Save for Web 12.0 Prefs
[2010/10/07 18:33:20 | 000,017,505 | ---- | C] () -- C:\WINDOWS\hpomdl07.dat.temp
[2010/06/17 17:47:08 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Evelyn\Local Settings\Application Data\PUTTY.RND
[2010/05/08 18:37:36 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/05/08 18:37:36 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/05/08 18:37:36 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/05/08 18:37:36 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/05/08 18:37:36 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2009/12/01 20:37:51 | 000,000,004 | ---- | C] () -- C:\Documents and Settings\Evelyn\Application Data\FEED65
[2009/12/01 20:37:50 | 000,870,128 | ---- | C] () -- C:\Documents and Settings\Evelyn\Application Data\mcs.rma
[2009/06/18 20:43:58 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\IsUser11b.dll
[2009/02/27 15:27:23 | 000,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2009/01/17 10:50:13 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\FoxImager.dll
[2008/06/18 15:59:56 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2008/06/12 16:13:43 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2008/06/10 10:09:52 | 000,000,044 | ---- | C] () -- C:\WINDOWS\SMWizard.INI
[2008/06/06 11:41:26 | 000,000,050 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2008/05/27 16:23:46 | 000,006,540 | ---- | C] () -- C:\Documents and Settings\Evelyn\Application Data\PrimoPDFSet.xml
[2008/05/27 16:23:45 | 000,000,310 | ---- | C] () -- C:\Documents and Settings\Evelyn\Application Data\APUSet.xml
[2008/05/27 16:05:15 | 000,176,235 | ---- | C] () -- C:\WINDOWS\System32\Primomonnt.dll
[2008/04/26 09:07:13 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxbuvs.dll
[2008/04/10 20:12:32 | 000,001,359 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2008/04/08 17:51:01 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2008/04/08 17:42:49 | 000,000,032 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ezsid.dat
[2008/04/04 09:28:10 | 000,059,500 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2008/04/04 09:27:44 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2008/04/03 21:23:40 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2008/04/02 15:35:42 | 000,102,236 | ---- | C] () -- C:\WINDOWS\hpoins05.dat
[2008/03/30 18:52:22 | 000,137,216 | ---- | C] () -- C:\Documents and Settings\Evelyn\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/03/27 19:53:00 | 000,000,173 | ---- | C] () -- C:\WINDOWS\KPCMS.INI
[2008/03/27 19:52:47 | 000,040,129 | ---- | C] () -- C:\WINDOWS\iccsigs.dat
[2008/03/27 19:52:36 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL
[2008/03/27 14:54:59 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/03/25 01:03:20 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2008/03/25 00:58:17 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008/03/24 16:15:32 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008/03/24 16:12:21 | 001,441,352 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2007/10/11 18:59:24 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2004/08/04 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 08:00:00 | 000,496,526 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/04 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 08:00:00 | 000,084,844 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/04 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 08:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2004/08/04 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003/01/07 19:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/05/28 13:55:42 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002/05/28 13:54:40 | 000,004,605 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/07/06 15:30:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini
 
========== LOP Check ==========
 
[2008/11/04 21:11:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\acccore
[2010/06/19 19:53:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acronis
[2009/01/29 17:45:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ashampoo
[2011/05/06 09:08:01 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2010/06/05 09:18:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\eFax Messenger 4.4 Output
[2011/05/06 09:04:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2009/02/03 15:38:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nitro PDF
[2009/01/19 14:10:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RapidSolution
[2008/05/31 22:19:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TechSmith
[2008/10/03 21:07:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/05/08 11:40:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/03/04 13:01:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2009/04/04 23:51:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\Acronis
[2009/01/29 17:45:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\Ashampoo
[2008/06/10 08:41:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\BitZipper
[2011/05/19 21:45:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\CoreFTP
[2011/05/18 12:17:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\Dropbox
[2010/06/05 09:18:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\eFax Messenger
[2011/07/10 20:25:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\eMusic
[2010/02/23 11:04:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\Facebook
[2010/06/17 19:55:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\FileZilla
[2009/04/04 14:39:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\GetRightToGo
[2008/03/28 19:45:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\GlobalSCAPE
[2008/04/03 18:59:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\Helios
[2010/06/05 09:18:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\j2 Global
[2010/06/14 09:22:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\JGsoft
[2009/02/03 15:39:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\Nitro PDF
[2011/06/27 05:56:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\Orbit
[2009/01/05 11:06:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\Radmin
[2008/05/24 22:23:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\SecondLife
[2008/04/12 09:00:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\Snapfish
[2011/04/03 14:54:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2009/01/05 10:58:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Evelyn\Application Data\TeamViewer

 
========== Purity Check ==========
 
 

< End of report >

[mickapoo]

Oh, one other thing I forgot to mention...I notice that when IE loads a page, I see in the taskbar area (I think that is what it is called- down at the bottom of the browser window in lower left corner) it will say, "loading Ad Mountain" or "Loading doubleclick.net".

Thank you.