Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Ie and Firefox browser trouble [Solved]

Started by patfan4lif , Apr 29 2009 03:18 PM

This topic is locked

#1
patfan4lif

Posted 29 April 2009 - 03:18 PM

Member

Member
78 posts

Shutting down after running only a few minutes. I have no problem starting themback up, but only for a few minutes. I'm even having problems posting this because it shuts down before I can complete my post.

Attached are the requested log

OTListIt logfile created on: 4/29/2009 4:31:52 PM - Run 1
OTListIt2 by OldTimer - Version 2.0.14.0 Folder = C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\W79784MZ
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

959.48 Mb Total Physical Memory | 321.77 Mb Available Physical Memory | 33.54% Memory free
1.51 Gb Paging File | 0.93 Gb Available in Paging File | 61.37% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.37 Gb Total Space | 27.40 Gb Free Space | 38.93% Space Free | Partition Type: NTFS
Drive D: | 4.14 Gb Total Space | 0.57 Gb Free Space | 13.72% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DELUCA
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe (CA, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\McShield.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (Microsoft Corporation)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - c:\WINDOWS\system32\ZuneBusEnum.exe (Microsoft Corporation)
PRC - c:\Program Files\Zune\ZuneNss.exe (Microsoft Corporation)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\Program Files\Common Files\AOL\1194992387\ee\AOLSoftware.exe (AOL LLC)
PRC - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
PRC - C:\Program Files\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\AOL 9.1\waol.exe (AOL, LLC.)
PRC - C:\Program Files\AOL 9.1\shellmon.exe (AOL, LLC.)
PRC - C:\Program Files\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe (AOL LLC)
PRC - C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\W79784MZ\OTListIt2[1].exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (aawservice [Auto | Stopped]) -- C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (Lavasoft AB)
SRV - (AOL ACS [Auto | Running]) -- C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (Apple Mobile Device [Auto | Running]) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (Bonjour Service [Auto | Running]) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (CCALib8 [Auto | Running]) -- C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (gusvc [Auto | Stopped]) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (hpqcxs08 [On_Demand | Running]) -- C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll (Hewlett-Packard Co.)
SRV - (hpqddsvc [Auto | Running]) -- C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll (Hewlett-Packard Co.)
SRV - (IDriverT [On_Demand | Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (iPod Service [On_Demand | Stopped]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (ITMRTSVC [Auto | Running]) -- C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe (CA, Inc.)
SRV - (JavaQuickStarterService [Auto | Running]) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (mcmscsvc [Auto | Running]) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McNASvc [Auto | Running]) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (McODS [On_Demand | Stopped]) -- C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McProxy [Auto | Running]) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McShield [Unknown | Running]) -- C:\Program Files\McAfee\VirusScan\McShield.exe (McAfee, Inc.)
SRV - (McSysmon [On_Demand | Running]) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (MDM [Auto | Running]) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (Microsoft Corporation)
SRV - (Microsoft Office Groove Audit Service [On_Demand | Stopped]) -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (MpfService [Auto | Running]) -- C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (Net Driver HPZ12 [Auto | Stopped]) -- C:\WINDOWS\system32\HPZinw12.dll (Hewlett-Packard)
SRV - (odserv [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Pml Driver HPZ12 [Auto | Running]) -- C:\WINDOWS\system32\HPZipm12.dll (Hewlett-Packard)
SRV - (Viewpoint Manager Service [Auto | Running]) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (ZuneBusEnum [Auto | Running]) -- c:\WINDOWS\system32\ZuneBusEnum.exe (Microsoft Corporation)
SRV - (ZuneNetworkSvc [Auto | Running]) -- c:\Program Files\Zune\ZuneNss.exe (Microsoft Corporation)
SRV - (ZuneWlanCfgSvc [On_Demand | Stopped]) -- c:\WINDOWS\system32\ZuneWlanCfgSvc.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AFS2K [System | Running]) -- C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (ALCXSENS [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd)
DRV - (ALCXWDM [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (AR5523 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\WG11TND5.sys (NETGEAR, Inc.)
DRV - (fasttx2k [Boot | Stopped]) -- C:\WINDOWS\System32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.)
DRV - (FETND5BV [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys (VIA Technologies, Inc. )
DRV - (FETNDISB [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\fetnd5b.sys (VIA Technologies, Inc. )
DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (HPZid412 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HPZid412.sys (HP)
DRV - (HPZipr12 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HPZipr12.sys (HP)
DRV - (HPZius12 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HPZius12.sys (HP)
DRV - (ialm [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (ICAM3NT5 [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\Icam3.sys (Microsoft Corporation)
DRV - (ltmodem5 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys (Agere Systems)
DRV - (mfeavfk [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfebopk [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mfehidk [System | Running]) -- C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mferkdk [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (mfesmfk [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (MPFP [System | Running]) -- C:\WINDOWS\System32\Drivers\Mpfp.sys (McAfee, Inc.)
DRV - (MREMPR5 [On_Demand | Stopped]) -- C:\Program Files\Common Files\Motive\MREMPR5.sys (Motive, Inc.)
DRV - (MRENDIS5 [On_Demand | Stopped]) -- C:\Program Files\Common Files\Motive\MRENDIS5.sys (Motive, Inc.)
DRV - (nv [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (nv_agp [Boot | Stopped]) -- C:\WINDOWS\System32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (pcouffin [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\pcouffin.sys (VSO Software)
DRV - (Ps2 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company)
DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\DRIVERS\PxHelp20.sys (Sonic Solutions)
DRV - (ROOTMODEM [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\RootMdm.sys (Microsoft Corporation)
DRV - (rtl8139 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\R8139n51.SYS (Realtek Semiconductor Corporation )
DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SiS315 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SISAGP [Boot | Stopped]) -- C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp [System | Running]) -- C:\WINDOWS\System32\DRIVERS\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SunkFilt [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\sunkfilt.sys (Alcor Micro Corp.)
DRV - (USBAAPL [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\usbaapl.sys (Apple, Inc.)
DRV - (usbsermpt [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usbsermpt.sys (Microsoft Corporation)
DRV - (usb_rndisx [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usb8023x.sys (Microsoft Corporation)
DRV - (viaagp1 [Boot | Running]) -- C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (viagfx [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\vtmini.sys (Copyright © VIA/S3 Graphics Co, Ltd.)
DRV - (wanatw [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys (America Online, Inc.)
DRV - (zumbus [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\zumbus.sys (Microsoft Corporation)
DRV - ({6080A529-897E-4629-A488-ABA0C29B635E} [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ialmsbw.sys (Intel Corporation)
DRV - ({D31A0762-0CEB-444e-ACFF-B049A1F6FE91} [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ialmkchw.sys (Intel Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft...p...ER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft...amp;ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Local Page = http://www.google.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Local Page Restore =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...m...tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig?hl=en
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com/ig?hl=en
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost;*.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.co...en&source=iglk"
FF - prefs.js..extensions.enabledItems: [email protected]:1.0.12514
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12
FF - prefs.js..extensions.enabledItems: {CC929838-C203-4D1C-8611-4C9535AD2AE2}:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10

FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MOZILLA\FIREFOX EXTENSIONS\{3112CA9C-DE6D-4884-A869-9855DE68056C} [2007/12/21 00:02:00 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD [2007/12/21 00:03:12 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2008/12/27 16:01:52 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\PROGRAM FILES\HP\DIGITAL IMAGING\SMART WEB PRINTING\MOZILLAADDON2 [2009/04/17 17:07:01 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/28 19:27:30 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/04/28 19:27:29 | 00,000,000 | ---D | M]

[2009/04/22 15:39:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\mozilla\Extensions
[2009/04/22 15:39:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/04/22 15:39:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\3lxmc16f.default\extensions
[2009/04/29 15:44:02 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009/04/28 19:27:29 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/03/11 09:01:41 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
[2009/04/14 23:20:52 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CC929838-C203-4D1C-8611-4C9535AD2AE2}
[2009/04/29 15:34:23 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\[email protected]
[2009/04/28 19:27:22 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/04/28 19:27:22 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/04/09 01:51:14 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/04/09 01:51:14 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/04/09 01:51:14 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/04/09 01:51:14 | 00,002,343 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/04/09 01:51:14 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/04/09 01:51:14 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/04/09 01:51:14 | 00,000,792 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (736 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - Reg Error: Key error. File not found
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - Reg Error: Key error. File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (&Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AlcxMonitor] ALCXMNTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1194992387\ee\AOLSoftware.exe (AOL LLC)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot (RealNetworks, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Auto Detect.lnk = C:\Program Files\iConcepts Music Express\MEAutoDetect.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\runit_32.lnk = C:\Program Files\runit\runit_32.exe (BB Inc)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O8 - Extra context menu item: &search - Reg Error: Value error. File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - Reg Error: Value error. File not found
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - Reg Error: Value error. File not found
O9 - Extra Button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [NWLink IPX/SPX/NetBIOS Compatible Transport Protocol] - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Sites: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Sites: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Sites: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: 23 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} https://activatemyfi...IOS/tgctlcm.cab (Support.com Configuration Class)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://a1540.g.akama...ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} http://support.f-sec...m/ols/fscax.cab (F-Secure Online Scanner 3.1)
O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} https://h20364.www2....DataManager.CAB (Hewlett-Packard Online Support Services)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.micr...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} http://fpdownload2.m...ash/swflash.cab (MetaStreamCtlSecondary Class)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} http://catalog.updat...b?1206149902140 (MUCatalogWebControl Class)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebo...otoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1137349355015 (WUWebControl Class)
O16 - DPF: {6BAB93B7-1917-4214-A7D2-874FA6DB4740} http://pictures.aolc...ns.10.1.0.0.cab (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.micros...b?1174605601604 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} http://floridakeysme...sCamControl.ocx (CamImage Class)
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} http://h20264.www2.h...nosticsxp2k.cab (DDRevision Class)
O16 - DPF: {B3E32D88-8E7F-468F-B0E2-3A300FD4A82C} http://myitlab.pears...ces/ax/stub.cab (Enlite 2.x Simulation Engine Installer)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.ma...ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} http://aolsvc.aol.co...sh.1.0.0.72.cab (CPlayFirstDinerDashControl Object)
O16 - DPF: {EBF85371-A38F-485B-B28F-0B4C82D25937} http://update.hpphot.../HPSWUpdate.ocx (CUpdateCtl Object)
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} http://cvs.pnimedia....tupv2.0.0.9.cab? (Photo Upload Plugin Class)
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} http://cvs.pnimedia....upv2.0.0.10.cab? (Photo Upload Plugin Class)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\system32\igfxsrvc.dll (Intel Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O32 - Autorun File - D:\AUTOEXEC.BAT () - [ FAT32 ]
O33 - MountPoints2\{81bd707e-dc13-11dc-9e31-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{81bd707e-dc13-11dc-9e31-00038a000015}\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[5 C:\WINDOWS\*.tmp files]
[1 C:\Documents and Settings\Owner\My Documents\*.tmp files]
[2009/04/29 10:52:00 | 00,866,904 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\SetupGamevance.exe
[2009/04/28 22:36:55 | 00,000,775 | ---- | C] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/04/28 22:36:52 | 00,000,619 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\NTREGOPT.lnk
[2009/04/28 22:36:52 | 00,000,600 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\ERUNT.lnk
[2009/04/28 22:36:51 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/04/28 22:36:20 | 00,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\Owner\Desktop\erunt_setup.exe
[2009/04/28 22:34:48 | 00,000,954 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\AVS4YOU Software Navigator.lnk
[2009/04/28 22:34:34 | 00,000,910 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\AVS Registry Cleaner.lnk
[2009/04/28 22:33:03 | 19,735,128 | ---- | C] (Online Media Technologies Ltd. ) -- C:\Documents and Settings\Owner\Desktop\AVSRegistryCleaner.exe
[2009/04/26 13:55:05 | 00,157,349 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\brian on ladder.jpg
[2009/04/25 10:45:11 | 00,001,737 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2009/04/22 16:25:31 | 00,000,000 | ---D | C] -- C:\Program Files\internet explorer
[2009/04/22 16:23:05 | 10,061,61920 | -HS- | C] () -- C:\hiberfil.sys
[2009/04/22 15:38:16 | 00,001,610 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2009/04/21 15:21:33 | 00,018,830 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\Norton reg key.docx
[2009/04/18 15:59:57 | 01,003,416 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\100_3200.JPG
[2009/04/18 10:37:15 | 00,000,868 | ---- | C] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2009/04/17 16:42:20 | 00,078,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ieencode.dll
[2009/04/17 16:42:20 | 00,078,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieencode.dll
[2009/04/16 19:45:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\McAfee
[2009/04/15 19:54:12 | 00,000,000 | ---D | C] -- C:\HP LJ P4010 Series Printer
[2009/04/15 19:51:06 | 00,000,512 | ---- | C] () -- C:\WINDOWS\System32\VA720.ICM
[2009/04/15 19:45:16 | 00,026,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\CTL3D.DLL
[2009/04/15 19:41:12 | 00,000,275 | ---- | C] () -- C:\WINDOWS\UChromeP.uns
[2009/04/15 19:33:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\PC_Drivers_Headquarters
[2009/04/15 19:29:03 | 00,002,194 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Driver Detective.lnk
[2009/04/15 19:29:00 | 00,000,000 | ---D | C] -- C:\Program Files\PC Drivers HeadQuarters
[2009/04/15 18:37:00 | 00,000,000 | ---D | C] -- C:\VundoFix Backups
[2009/04/15 14:43:48 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Xilisoft Corporation
[2009/04/15 14:43:48 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Xilisoft Corporation
[2009/04/15 14:43:21 | 00,001,786 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Xilisoft Video Converter Standard.lnk
[2009/04/15 14:43:00 | 00,000,000 | ---D | C] -- C:\Program Files\Xilisoft
[2009/04/15 14:36:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\dBpoweramp
[2009/04/15 14:28:28 | 00,000,155 | ---- | C] () -- C:\WINDOWS\System32\SelfDel.bat
[2009/04/15 14:18:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\AccurateRip
[2009/04/15 14:18:07 | 05,433,520 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall.exe
[2009/04/15 14:18:07 | 00,033,846 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp Music Converter.bmp
[2009/04/15 14:18:07 | 00,014,373 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp Music Converter.dat
[2009/04/15 14:18:05 | 00,000,000 | ---D | C] -- C:\Program Files\Illustrate
[2009/04/15 14:02:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
[2009/04/15 13:34:48 | 00,827,392 | ---- | C] (Macromedia, Inc.) -- C:\WINDOWS\System32\FLASH.OCX
[2009/04/15 10:01:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\COWON
[2009/04/15 08:01:08 | 00,000,206 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2009/04/15 04:56:33 | 00,074,240 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll
[2009/04/15 03:36:33 | 00,044,544 | ---- | C] () -- C:\WINDOWS\System32\Winset20.exe
[2009/04/14 23:34:51 | 00,000,000 | ---D | C] -- C:\Program Files\setups
[2009/04/14 23:34:43 | 00,000,000 | ---D | C] -- C:\Program Files\f3setupinstall2
[2009/04/14 23:34:22 | 00,868,352 | ---- | C] (iehlsvc) -- C:\WINDOWS\System32\hlidelnk.exe
[2009/04/14 23:34:20 | 00,386,048 | ---- | C] () -- C:\WINDOWS\twxdo01672.exe
[2009/04/14 23:34:17 | 00,905,670 | ---- | C] () -- C:\WINDOWS\ddquc05038.exe
[2009/04/14 23:34:16 | 00,000,000 | ---D | C] -- C:\Program Files\p2pmax
[2009/04/14 23:34:15 | 00,000,677 | ---- | C] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\runit_32.lnk
[2009/04/14 23:34:14 | 00,000,000 | ---D | C] -- C:\Program Files\runit
[2009/04/14 23:34:10 | 00,069,697 | ---- | C] () -- C:\WINDOWS\lhfls4237.exe
[2009/04/14 23:34:05 | 00,032,768 | ---- | C] (BB Inc) -- C:\WINDOWS\lntak31610.exe
[2009/04/14 23:34:01 | 00,085,654 | ---- | C] () -- C:\WINDOWS\System32\3466247d-1dff-1e0a-cfd5-338c87a98fad.exe
[2009/04/14 23:33:50 | 00,048,285 | ---- | C] () -- C:\WINDOWS\System32\xirkgmmack.exe
[2009/04/14 23:33:47 | 00,201,870 | ---- | C] () -- C:\WINDOWS\onxk08114.exe
[2009/04/14 23:21:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\Crack Installer
[2009/04/14 23:21:53 | 00,000,043 | ---- | C] () -- C:\WINDOWS\System32\ovfsthxkktqnaho.dat
[2009/04/14 23:20:52 | 00,013,262 | ---- | C] () -- C:\WINDOWS\System32\ovfsthxfhcvxkfu.dat
[2009/04/14 23:20:51 | 00,061,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ovfsthxrdxnhiec.dll
[2009/04/14 23:20:34 | 00,716,925 | ---- | C] () -- C:\WINDOWS\hjqvg20588.exe
[2009/04/14 23:20:19 | 00,888,867 | ---- | C] () -- C:\WINDOWS\mvtgq2134.exe
[2009/04/14 23:16:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\BitDownload
[2009/04/14 23:07:38 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2009/04/14 23:07:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\NCH Swift Sound
[2009/04/14 22:58:30 | 00,000,000 | ---D | C] -- C:\Program Files\FixTunes
[2009/04/14 16:52:34 | 00,002,560 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpsp4res.dll
[2009/04/13 12:16:18 | 00,694,272 | ---- | C] () -- C:\WINDOWS\System32\nsk897.dll
[2009/04/07 18:17:59 | 00,107,163 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Larry Bird Magic Johnson 4-09.JPG
[2009/04/06 06:41:32 | 00,396,288 | ---- | C] () -- C:\WINDOWS\System32\azolalrbamcx.dll
[2009/04/05 16:58:58 | 00,031,877 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\palm cross.docx
[2009/03/31 21:56:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Privacy center
[2009/03/31 21:56:13 | 00,000,000 | ---D | C] -- C:\Program Files\Privacy center
[2009/03/31 09:19:50 | 00,293,889 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\E-mail pic.JPG
[2008/12/13 17:25:13 | 00,147,456 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2008/11/04 13:39:19 | 00,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008/11/04 13:39:18 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008/11/04 10:06:15 | 00,003,350 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2008/11/04 10:06:15 | 00,000,088 | RHS- | C] () -- C:\WINDOWS\System32\A0AECBFCA9.sys
[2008/10/27 16:38:46 | 00,000,121 | ---- | C] () -- C:\WINDOWS\disney.ini
[2008/10/27 16:38:01 | 00,000,199 | ---- | C] () -- C:\WINDOWS\disneysy.ini
[2008/10/05 18:56:15 | 00,003,603 | ---- | C] () -- C:\WINDOWS\Solitaire.ini
[2007/12/07 11:07:40 | 00,099,712 | ---- | C] () -- C:\WINDOWS\HPBroker.dll
[2007/09/12 23:54:48 | 00,141,180 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2007/04/08 10:22:08 | 00,000,010 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2006/11/22 00:30:16 | 00,000,137 | ---- | C] () -- C:\WINDOWS\qti.ini
[2006/08/16 12:29:51 | 00,009,279 | ---- | C] () -- C:\WINDOWS\AmvTransform.ini
[2006/08/16 12:29:51 | 00,008,157 | ---- | C] () -- C:\WINDOWS\AmvPlayer.ini
[2006/08/16 12:29:51 | 00,003,677 | ---- | C] () -- C:\WINDOWS\SoundCon.INI
[2006/08/16 12:29:51 | 00,000,170 | ---- | C] () -- C:\WINDOWS\settings.ini
[2006/07/31 21:50:04 | 00,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2006/07/31 21:50:04 | 00,000,001 | ---- | C] () -- C:\WINDOWS\yedlat.dll
[2006/03/15 21:20:03 | 00,050,784 | ---- | C] () -- C:\WINDOWS\System32\drivers\atntwink.sys
[2005/12/30 23:08:42 | 00,000,000 | ---- | C] () -- C:\WINDOWS\slingox.INI
[2005/12/21 06:45:00 | 00,000,000 | ---- | C] () -- C:\WINDOWS\winfg32.dll
[2005/12/18 10:33:57 | 00,000,000 | ---- | C] () -- C:\WINDOWS\ipom.dll
[2005/08/31 11:43:32 | 00,098,304 | ---- | C] () -- C:\WINDOWS\System32\resourceGeneric.dll
[2005/08/12 17:57:09 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005/07/14 12:31:20 | 00,027,648 | RHS- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2005/07/12 10:20:30 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2005/07/07 23:57:48 | 00,000,131 | ---- | C] () -- C:\WINDOWS\EurekaLog.ini
[2005/06/21 22:37:42 | 00,045,568 | RHS- | C] () -- C:\WINDOWS\System32\cygz.dll
[2005/05/11 18:53:46 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Slingo2x.INI
[2005/03/27 12:20:42 | 00,002,120 | ---- | C] () -- C:\WINDOWS\1Way.ini
[2005/03/27 12:20:42 | 00,000,028 | ---- | C] () -- C:\WINDOWS\Progs_.ini
[2005/02/22 16:30:24 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Setup32.INI
[2005/02/11 19:29:10 | 00,000,177 | ---- | C] () -- C:\WINDOWS\upst.ini
[2005/02/03 20:53:57 | 00,000,000 | ---- | C] () -- C:\WINDOWS\BARBIE.INI
[2005/02/03 20:46:03 | 00,000,028 | ---- | C] () -- C:\WINDOWS\PSetup.ini
[2005/01/10 21:31:14 | 00,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI
[2005/01/07 19:48:44 | 00,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2004/12/24 16:59:13 | 00,003,879 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2004/12/19 16:40:51 | 00,000,021 | ---- | C] () -- C:\WINDOWS\atid.ini
[2004/12/19 16:24:04 | 00,000,018 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2004/12/18 20:43:34 | 00,000,000 | ---- | C] () -- C:\WINDOWS\slingo.INI
[2004/12/18 15:03:25 | 00,000,021 | ---- | C] () -- C:\WINDOWS\PI_setup.ini
[2004/12/18 14:57:06 | 00,000,195 | ---- | C] () -- C:\WINDOWS\EPSONCX6400.ini
[2004/09/17 21:37:42 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\vuins32.dll
[2004/09/16 13:26:40 | 00,012,634 | ---- | C] () -- C:\WINDOWS\System32\drivers\ADFUUD.SYS
[2004/09/16 13:26:40 | 00,012,634 | ---- | C] () -- C:\WINDOWS\ADFUUD.SYS
[2004/02/04 14:30:47 | 01,614,848 | ---- | C] () -- C:\WINDOWS\System32\sfcfiles.dll
[2004/01/28 22:21:05 | 00,000,451 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini
[2004/01/28 22:21:05 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2004/01/27 06:47:39 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/01/27 06:26:18 | 00,002,158 | ---- | C] () -- C:\WINDOWS\System32\mshrml.ini
[2004/01/26 09:23:22 | 00,167,936 | ---- | C] () -- C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2004/01/26 09:17:11 | 00,029,216 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS
[2004/01/26 09:16:36 | 00,024,576 | ---- | C] () -- C:\WINDOWS\System32\syscontr.dll
[2004/01/26 09:16:00 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll
[2004/01/26 09:00:28 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/01/26 08:46:03 | 00,000,889 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
[2004/01/26 06:56:30 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/01/26 06:14:16 | 00,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/01/26 06:02:59 | 00,299,073 | ---- | C] () -- C:\WINDOWS\System32\PythonCOM22.dll
[2004/01/26 06:02:59 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\PyWinTypes22.dll
[2004/01/26 06:02:33 | 00,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll
[2004/01/26 05:33:52 | 00,000,802 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/01/26 04:11:44 | 00,000,553 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/01/26 04:11:01 | 00,000,807 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/01/26 04:10:51 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini
[2003/09/23 04:19:42 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini

========== Files - Modified Within 30 Days ==========

[1 C:\WINDOWS\System32\drivers\*.tmp files]
[1 C:\WINDOWS\System32\*.tmp files]
[5 C:\WINDOWS\*.tmp files]
[1 C:\Documents and Settings\Owner\My Documents\*.tmp files]
[2009/04/29 16:03:03 | 00,000,807 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/04/29 13:21:10 | 00,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2009/04/29 10:54:20 | 00,957,440 | -HS- | M] () -- C:\Documents and Settings\Owner\My Documents\Thumbs.db
[2009/04/29 10:52:00 | 00,866,904 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\SetupGamevance.exe
[2009/04/28 23:05:08 | 00,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/04/28 23:04:22 | 00,044,156 | ---- | M] () -- C:\WINDOWS\System32\Config.MPF
[2009/04/28 23:04:18 | 00,000,438 | ---- | M] () -- C:\WINDOWS\tasks\RegCure Program Check.job
[2009/04/28 23:01:10 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/04/28 23:00:56 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/04/28 23:00:50 | 00,380,040 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/04/28 23:00:49 | 10,061,61920 | -HS- | M] () -- C:\hiberfil.sys
[2009/04/28 22:36:55 | 00,000,775 | ---- | M] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/04/28 22:36:52 | 00,000,619 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\NTREGOPT.lnk
[2009/04/28 22:36:52 | 00,000,600 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\ERUNT.lnk
[2009/04/28 22:36:20 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\Owner\Desktop\erunt_setup.exe
[2009/04/28 22:34:48 | 00,000,954 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\AVS4YOU Software Navigator.lnk
[2009/04/28 22:34:34 | 00,000,910 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\AVS Registry Cleaner.lnk
[2009/04/28 22:33:36 | 19,735,128 | ---- | M] (Online Media Technologies Ltd. ) -- C:\Documents and Settings\Owner\Desktop\AVSRegistryCleaner.exe
[2009/04/26 17:10:14 | 00,228,352 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/26 13:54:19 | 00,157,349 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\brian on ladder.jpg
[2009/04/25 14:17:07 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/04/25 10:45:11 | 00,001,737 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2009/04/23 03:27:07 | 00,000,372 | ---- | M] () -- C:\WINDOWS\tasks\RegCure.job
[2009/04/22 17:33:46 | 00,410,574 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/04/22 17:33:46 | 00,065,044 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/04/22 17:33:45 | 00,483,752 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/04/22 16:20:24 | 00,001,917 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/04/22 15:38:16 | 00,001,610 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2009/04/22 11:57:23 | 00,002,194 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Driver Detective.lnk
[2009/04/21 15:21:34 | 00,018,830 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\Norton reg key.docx
[2009/04/20 21:02:13 | 00,116,936 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/04/19 09:19:05 | 00,000,736 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/04/17 16:51:34 | 00,000,076 | -HS- | M] () -- C:\Documents and Settings\Owner\My Documents\desktop.ini
[2009/04/16 16:34:15 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/04/15 19:41:13 | 00,000,275 | ---- | M] () -- C:\WINDOWS\UChromeP.uns
[2009/04/15 18:28:43 | 00,013,262 | ---- | M] () -- C:\WINDOWS\System32\ovfsthxfhcvxkfu.dat
[2009/04/15 18:28:43 | 00,000,043 | ---- | M] () -- C:\WINDOWS\System32\ovfsthxkktqnaho.dat
[2009/04/15 14:43:21 | 00,001,786 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Xilisoft Video Converter Standard.lnk
[2009/04/15 14:28:28 | 00,000,155 | ---- | M] () -- C:\WINDOWS\System32\SelfDel.bat
[2009/04/15 14:18:07 | 00,014,373 | ---- | M] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp Music Converter.dat
[2009/04/15 14:17:46 | 00,033,846 | ---- | M] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp Music Converter.bmp
[2009/04/15 14:17:44 | 05,433,520 | ---- | M] () -- C:\WINDOWS\System32\SpoonUninstall.exe
[2009/04/15 13:34:48 | 00,827,392 | ---- | M] (Macromedia, Inc.) -- C:\WINDOWS\System32\FLASH.OCX
[2009/04/15 08:01:08 | 00,000,206 | ---- | M] () -- C:\WINDOWS\System32\MRT.INI
[2009/04/15 07:54:35 | 00,000,340 | ---- | M] () -- C:\WINDOWS\tasks\McDefragTask.job
[2009/04/15 04:56:33 | 00,074,240 | ---- | M] () -- C:\WINDOWS\System32\zlib.dll
[2009/04/15 03:36:41 | 00,044,544 | ---- | M] () -- C:\WINDOWS\System32\Winset20.exe
[2009/04/14 23:34:22 | 00,868,352 | ---- | M] (iehlsvc) -- C:\WINDOWS\System32\hlidelnk.exe
[2009/04/14 23:34:21 | 00,386,048 | ---- | M] () -- C:\WINDOWS\twxdo01672.exe
[2009/04/14 23:34:19 | 00,905,670 | ---- | M] () -- C:\WINDOWS\ddquc05038.exe
[2009/04/14 23:34:15 | 00,000,677 | ---- | M] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\runit_32.lnk
[2009/04/14 23:34:10 | 00,069,697 | ---- | M] () -- C:\WINDOWS\lhfls4237.exe
[2009/04/14 23:34:05 | 00,032,768 | ---- | M] (BB Inc) -- C:\WINDOWS\lntak31610.exe
[2009/04/14 23:34:01 | 00,085,654 | ---- | M] () -- C:\WINDOWS\System32\3466247d-1dff-1e0a-cfd5-338c87a98fad.exe
[2009/04/14 23:33:50 | 00,048,285 | ---- | M] () -- C:\WINDOWS\System32\xirkgmmack.exe
[2009/04/14 23:33:48 | 00,201,870 | ---- | M] () -- C:\WINDOWS\onxk08114.exe
[2009/04/14 23:20:51 | 00,061,952 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ovfsthxrdxnhiec.dll
[2009/04/14 23:20:35 | 00,716,925 | ---- | M] () -- C:\WINDOWS\hjqvg20588.exe
[2009/04/14 23:20:20 | 00,888,867 | ---- | M] () -- C:\WINDOWS\mvtgq2134.exe
[2009/04/13 12:16:18 | 00,694,272 | ---- | M] () -- C:\WINDOWS\System32\nsk897.dll
[2009/04/07 18:17:59 | 00,107,163 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Larry Bird Magic Johnson 4-09.JPG
[2009/04/06 18:21:16 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/04/06 10:57:24 | 24,921,544 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
[2009/04/06 06:41:32 | 00,396,288 | ---- | M] () -- C:\WINDOWS\System32\azolalrbamcx.dll
[2009/04/05 16:58:59 | 00,031,877 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\palm cross.docx
[2009/04/01 01:00:37 | 00,000,332 | ---- | M] () -- C:\WINDOWS\tasks\McQcTask.job
[2009/03/31 09:19:50 | 00,293,889 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\E-mail pic.JPG

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Owner\My Documents\PHONEwork2.bak:SummaryInformation
@Alternate Data Stream - 3567 bytes -> C:\WINDOWS\svcpack.log:hgtnce
@Alternate Data Stream - 197761 bytes -> C:\WINDOWS\spuninst.log:ofbhic
< End of report >

OTListIt Extras logfile created on: 4/29/2009 4:31:52 PM - Run 1
OTListIt2 by OldTimer - Version 2.0.14.0 Folder = C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\W79784MZ
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

959.48 Mb Total Physical Memory | 321.77 Mb Available Physical Memory | 33.54% Memory free
1.51 Gb Paging File | 0.93 Gb Available in Paging File | 61.37% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.37 Gb Total Space | 27.40 Gb Free Space | 38.93% Space Free | Partition Type: NTFS
Drive D: | 4.14 Gb Total Space | 0.57 Gb Free Space | 13.72% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DELUCA
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Value error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\mcafeeantivirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 1
"DisableNotifications" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe File not found
C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe File not found
C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe File not found
C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader (AOL LLC)
C:\Program Files\Common Files\AOL\1194992387\ee\aolsoftware.exe:*:Enabled:AOL Services (AOL LLC)
C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM File not found
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08 (Hewlett-Packard Co.)
C:\Program Files\HP\Digital Imaging\bin\hpqdstcp.exe:*:Enabled:hpqdstcp (Hewlett-Packard Co.)
C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp (Hewlett-Packard)
C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw ()
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08 (Hewlett-Packard Co.)
C:\Program Files\ABBYY FineReader 5.0 Sprint\Sprint.exe:*:Enabled:ABBYY FineReader 5.0 Sprint Plus (ABBYY (BIT Software))
C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire (Lime Wire, LLC)
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent (McAfee, Inc.)
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe File not found
C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe File not found
C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe File not found
C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe File not found
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook (Microsoft Corporation)
C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove (Microsoft Corporation)
C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote (Microsoft Corporation)
C:\Program Files\Namo\WebEditor 2006 Trial\bin\WebEditor.exe:*:Enabled:Namo WebEditor 2006 File not found
C:\Program Files\AOL 9.1\waol.exe:*:Disabled:AOL Software (AOL, LLC.)
C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour (Apple Inc.)
C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes (Apple Inc.)
C:\Program Files\Namo\WebEditor 2006\bin\WebEditor.exe:*:Enabled:Namo WebEditor 2006 (Sejoong Namo Interactive, Inc.)
C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting® (Microsoft Corporation)
C:\Program Files\Verizon\Media Manager\MediaManager.exe:*:Disabled:Verizon Media Manager Executable File not found
C:\Program Files\BitDownload\BitDownload.exe:*:Enabled:BitDownload File not found

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{001E7FB6-BB6B-4ED0-BEDC-B5404ED96D4E}" = DocProc
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{0076E1AC-9E7B-4B9F-A62A-4CC9511AD8E3}" = Zune Language Pack (FR)
"{0609D0AF-1382-42BE-81DB-CF30F8B0F6E2}" = Serif PhotoPlus 6.0
"{10E1E87C-656C-4D08-86D6-5443D28583BE}" = TrayApp
"{13F00518-807A-4B3A-83B0-A7CD90F3A398}" = MarketResearch
"{14589F05-C658-4594-9429-D437BA688686}" = IntelliMover Data Transfer Demo
"{1753255A-0AEB-4220-8C75-607B73F0C133}" = Copy
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1EBB57D4-63FF-87CC-A0F0-D73982CF6008}" = Adobe Media Player
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{22466889-7642-488d-AA0E-F619704CF7AB}" = DeviceDiscovery
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 12
"{27D0C7AB-59F1-4D4D-A0BB-05A31AC919EA}" = Windows XP Winter Fun Pack Screensavers
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{2A267BC6-F77F-4DD4-825F-7AEB1F68B4B1}" = HpSdpAppCoreApp
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{2E132061-C78A-48D4-A899-1D13B9D189FA}" = Memories Disc Creator 2.0
"{2F28B3C9-2C89-4206-8B33-8ADC9577C49B}" = Scan
"{2F750C77-1FEC-44F9-88CC-2CE322EBD61E}" = Microsoft Games for Windows - LIVE Redistributable
"{2FCE4FC5-6930-40E7-A4F1-F862207424EF}" = WCreator2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{483616D1-867E-46F8-BEC7-3C6475933908}" = Adobe Photoshop Album Starter Edition
"{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply
"{48963b63-7a10-49d6-8b08-61e6132453d0}" = ViewSonic Monitor Drivers
"{4CCC7F68-A437-4559-A840-F5E010934951}" = HP Driver Diagnostics
"{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport
"{5E06C076-E4E7-4239-A886-B3D8AC84C166}" = HP Print Diagnostic Utility
"{5EC9AD36-5167-470E-B0F9-CB3EA12F442E}" = Avery Wizard 3.1
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{66C8BE35-8BBB-472B-96C7-C7C9A499F988}" = ArcSoft Software Suite
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7395d650-ae5d-4d68-b8fe-d3fa6b51467f}" = Driver Detective
"{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}" = Microsoft Works 7.0
"{7784A172-61F1-445E-8368-601607E0DD22}" = MP3 Player Utilities 3.68
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{797EE0CA-8165-405C-B5CE-F11EC20F1BB0}" = Microsoft VC9 runtime libraries
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}" = Bonjour
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" =
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{F7A31780-33C4-4E39-951A-5EC9B91D7BF1}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000ff1ce}_enterprise_{471159eb-becc-453c-b6f2-fe4fab29b3f3}" =
"{90120000-0030-0000-0000-0000000ff1ce}_enterprise_{bee75e01-dd3f-4d5f-b96c-609e6538d419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = RecordNow!
"{980A3C34-1652-472D-84AC-2A4D3D4955BF}" = Namo WebEditor 2006
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = InterVideo WinDVD Player
"{A7B5CF5F-6BB3-4616-950E-0CF3C9A023AD}" = Namo WebUtilities 2006
"{A9DE7D74-A4D9-465A-9EE1-49D1577983AA}" = Namo WebCanvas 2006
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
"{ACA85783-8EEA-4f0a-B2A3-A8173F30209F}" = C4200_doccd
"{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant
"{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan
"{B09BCBF6-87EE-4403-A336-3A9510856535}" = HP Photosmart All-In-One Software 9.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{B662D841-AAA0-41E8-B2AB-E374560DC5B1}" = Multimedia Card Reader
"{BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}" = Motorola Phone Tools
"{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter
"{BE9880CD-73A9-4EFD-83E5-4BB38D48E2BD}" = HP Smart Web Printing
"{BEF106F8-2689-4530-925A-E1117836E8CD}" = Google SketchUp 7
"{BFDE4176-5DFE-4db9-AA00-8F30CB001BDA}" = c4200_Help
"{C39E671D-0528-4c5e-A034-8470C5BC393A}" = C4200
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D01653EF-9F9F-41D6-B879-654A6BF5892C}" = Digital Locker Assistant
"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
"{D1696920-9794-4BBC-8A30-7A88763DE5A2}" = ABBYY FineReader 5.0 Sprint Plus
"{D361C406-ED11-4A88-AD42-4A749BBAE6F9}" = Hoyle Card Games 2007
"{D8B7A682-20DA-4797-8415-B1FB14D4D32B}" = PS_AIO_Software
"{D8E363A7-88B7-446D-B2C0-E26CE4DC8E54}" = U3Launcher
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware 2007
"{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm
"{E28750A2-45F2-4b63-99F7-9F81A94B1E2D}" = PS_AIO_Software_min
"{E65CA2A8-1F2A-4400-AE55-FFD43D3B6980}" = c4200_Help
"{E9C18EBD-85BE-47D0-AA73-3FEDCC976B04}" = Toolbox
"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb
"{EC4455AB-F155-4CC1-A4C5-88F3777F9886}" = Apple Mobile Device Support
"{EC90EAE9-0E03-44A1-BF36-0B670B8B8E19}" = CoffeeCup Direct FTP
"{EE4ACABF-531E-419A-9225-B8E0FA4955AF}" = Zune Language Pack (ES)
"{F05A5232-CE5E-4274-AB27-44EB8105898D}" = CA Pest Patrol Realtime Protection
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F5C63795-2708-4D15-BF18-5ABBFF7DFFC8}" = iTunes
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FD7F242B-9AA0-40c3-941E-3A9821D19C09}" = PS_AIO_ProductContext
"{FD8D8B04-BEAD-4A55-AA1D-62D2373E7DEA}" = Status
"{FE0256DB-509C-40AC-B888-2543AD4298E6}" = Zune
"{FE57DE70-95DE-4B64-9266-84DA811053DB}" = HP Update
"3466247d-1dff-1e0a-cfd5-338c87a98fad" = Contextual Platform Blueskyadagency
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"AIMTunes" = AIMTunes
"Amazing Windows XP Screen Saver_is1" = Amazing Windows XP Screen Saver 1.2
"Any Video Converter_is1" = Any Video Converter 2.6.7
"AOL Emergency Connect Utility 1.0" = Uninstall AOL Emergency Connect Utility 1.0
"AOL Uninstaller" = AOL Uninstaller (Choose which Products to Remove)
"AolCoach2_en" = AOL Coach Version 2.0(Build:20041026.5 en)
"AVS Registry Cleaner 1.1_is1" = AVS Registry Cleaner version 1.1
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"BackWeb-1940576 Uninstaller" = Compaq Connections
"Barbie® Pet Rescue" = Barbie® Pet Rescue
"CAL" = Canon Camera Access Library
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDVC5" = Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"CoffeeCup HTML Editor 2006" = CoffeeCup HTML Editor 2006
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Compaq Instant Support" = Compaq Instant Support
"Coupon Printer for Windows4.0" = Coupon Printer for Windows
"CSCLIB" = Canon Camera Support Core Library
"dbpoweramp music converter" = dBpoweramp Music Converter
"DPS" = DPS
"DVD Photo Slideshow Pro" = DVD Photo Slideshow Pro 6.32
"DVD Photo Slideshow Professional" = DVD Photo Slideshow Pro 7.92
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EOS Utility" = Canon Utilities EOS Utility
"ERUNT_is1" = ERUNT 1.1j
"Google Updater" = Google Updater
"GoogleVideoPlayer" = Google Video Player
"Graph paper printer" = Graph paper printer
"HijackThis" = HijackThis 2.0.2
"HP Imaging Device Functions" = HP Imaging Device Functions 9.0
"HP Smart Web Printing" = HP Smart Web Printing
"HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0
"HPExtendedCapabilities" = HP Customer Participation Program 9.0
"HPOCR" = HP OCR Software 9.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{5EC9AD36-5167-470E-B0F9-CB3EA12F442E}" = Avery Wizard 3.1
"installshield_{7395d650-ae5d-4d68-b8fe-d3fa6b51467f}" = Driver Detective
"InstallShield_{B662D841-AAA0-41E8-B2AB-E374560DC5B1}" = Multimedia Card Reader
"LimeWire" = LimeWire 4.16.6
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox (3.0.10)" = Mozilla Firefox (3.0.10)
"MSC" = McAfee SecurityCenter
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSTTS" = Microsoft Text-to-Speech Engine 4.0 (English)
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA" =
"NVIDIA GART Driver" = NVIDIA GART Driver
"p2pmax" = P2P Max
"Photags Music Express" = iConcepts Music Express
"PhotoStitch" = Canon Utilities PhotoStitch
"Picasa 3" = Picasa 3
"PS2" = PS2
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RealPlayer 6.0" = RealPlayer
"RegCure" = RegCure 1.5.0.0
"RemoteCaptureDC" = Canon Utilities RemoteCapture DC
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"runit" = Run It
"S3" = VIA/S3G Display Driver
"SpywareBlaster_is1" = SpywareBlaster v3.5.1
"TrueSwitch Wizard Verizon" = TrueSwitch Wizard Verizon
"tv_enua" = Lernout & Hauspie TruVoice American English TTS Engine
"UnityWebPlayer" = Unity Web Player
"UnixUtils for Yahoo! Widgets" = Unix Utilities for Yahoo! Widgets
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VideoLAN VLC media player 0.8.6i
"VN_VUIns_Rhine_VIA" = VIA Rhine-Family Fast Ethernet Adapter
"VTDisplay" = S3 S3Display
"VTGamma2" = S3 S3Gamma2
"VTInfo2" = S3 S3Info2
"VTOverlay" = S3 S3Overlay
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"xilisoft video converter standard" = Xilisoft Video Converter Standard
"xirkgmmack" = Performance Solution Blueskyadagency
"XMLplayer" = XMLplayer
"Xvid_is1" = Xvid 1.1.3 final uninstall
"Yahoo! Toolbar" = Yahoo! Toolbar
"Yahoo! Widget Engine" = Yahoo! Widgets
"YInstHelper" = Yahoo! Install Manager
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Abacast Client" = Abacast Client
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
"Sun Download Manager 2.0 (web)" = Sun Download Manager 2.0 (web)

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/16/2009 9:25:00 PM | Computer Name = DELUCA | Source = Application Hang | ID = 1002
Description = Hanging application MSE7.EXE, version 12.0.4518.1014, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/16/2009 9:36:54 PM | Computer Name = DELUCA | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download....uthrootseq.txt>
with error: The server name or address could not be resolved

Error - 4/16/2009 9:36:55 PM | Computer Name = DELUCA | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download....uthrootseq.txt>
with error: This network connection does not exist.

Error - 4/16/2009 9:38:30 PM | Computer Name = DELUCA | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download....uthrootseq.txt>
with error: The server name or address could not be resolved

Error - 4/16/2009 9:38:30 PM | Computer Name = DELUCA | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download....uthrootseq.txt>
with error: This network connection does not exist.

Error - 4/17/2009 6:03:33 PM | Computer Name = DELUCA | Source = Application Hang | ID = 1002
Description = Hanging application wmplayer.exe, version 11.0.5721.5145, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/17/2009 6:05:07 PM | Computer Name = DELUCA | Source = Application Error | ID = 1000
Description = Faulting application realplay.exe, version 11.0.0.372, faulting module
rjbviz.dll, version 1.0.2.4662, fault address 0x0000ae94.

Error - 4/17/2009 8:37:24 PM | Computer Name = DELUCA | Source = McLogEvent | ID = 5051
Description = A thread in process C:\Program Files\McAfee\VirusScan\McShield.exe
took longer than 90000 ms to complete a request. The process will be terminated.
Thread
id : 2264 (0x8d8) Thread address : 0x7C90E514 Thread message : Build VSCORE.14.0.0.349
/ 5301.4018 Object being scanned = \Device\HarddiskVolume2\Documents and Settings\Owner\Desktop\office.exe

by C:\WINDOWS\Explorer.EXE 4(0)(0) 4(0)(0) 7200(0)(0) 7595(0)(0) 7005(0)(0) 7004(0)(0)

5006(0)(0) 5004(0)(0)

Error - 4/20/2009 4:49:24 PM | Computer Name = DELUCA | Source = Application Error | ID = 1000
Description = Faulting application MyCamera.exe, version 6.4.0.5, faulting module
MyCamera.exe, version 6.4.0.5, fault address 0x00004a76.

Error - 4/20/2009 6:14:44 PM | Computer Name = DELUCA | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ OSession Events ]
Error - 3/17/2009 5:55:55 PM | Computer Name = DELUCA | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session
lasted 410 seconds with 360 seconds of active time. This session ended with a crash.

Error - 3/17/2009 6:49:40 PM | Computer Name = DELUCA | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session
lasted 3221 seconds with 1740 seconds of active time. This session ended with a
crash.

Error - 3/17/2009 11:05:02 PM | Computer Name = DELUCA | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session
lasted 15045 seconds with 7560 seconds of active time. This session ended with
a crash.

Error - 3/18/2009 3:40:10 PM | Computer Name = DELUCA | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session
lasted 1337 seconds with 780 seconds of active time. This session ended with a
crash.

Error - 3/18/2009 8:05:57 PM | Computer Name = DELUCA | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session
lasted 3843 seconds with 2220 seconds of active time. This session ended with a
crash.

Error - 3/26/2009 8:17:58 AM | Computer Name = DELUCA | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session
lasted 50080 seconds with 3480 seconds of active time. This session ended with
a crash.

Error - 4/6/2009 8:35:15 PM | Computer Name = DELUCA | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session
lasted 8 seconds with 0 seconds of active time. This session ended with a crash.

Error - 4/6/2009 8:37:08 PM | Computer Name = DELUCA | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session
lasted 111 seconds with 60 seconds of active time. This session ended with a crash.

Error - 4/7/2009 9:30:47 AM | Computer Name = DELUCA | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session
lasted 21 seconds with 0 seconds of active time. This session ended with a crash.

Error - 4/7/2009 9:38:11 AM | Computer Name = DELUCA | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session
lasted 433 seconds with 120 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 4/28/2009 7:46:19 PM | Computer Name = DELUCA | Source = Service Control Manager | ID = 7034
Description = The Application Layer Gateway Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 4/28/2009 11:01:08 PM | Computer Name = DELUCA | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000001'
while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring
the volume.

Error - 4/28/2009 11:02:23 PM | Computer Name = DELUCA | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Ad-Aware 2007 Service
service to connect.

Error - 4/28/2009 11:02:23 PM | Computer Name = DELUCA | Source = Service Control Manager | ID = 7000
Description = The Automatic Updates service failed to start due to the following
error: %%2

Error - 4/28/2009 11:03:35 PM | Computer Name = DELUCA | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
agp440 fasttx2k nv_agp SISAGP

Error - 4/28/2009 11:04:08 PM | Computer Name = DELUCA | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
Service service to connect.

Error - 4/28/2009 11:04:08 PM | Computer Name = DELUCA | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053

Error - 4/28/2009 11:19:25 PM | Computer Name = DELUCA | Source = Service Control Manager | ID = 7034
Description = The Application Layer Gateway Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 4/29/2009 7:35:54 AM | Computer Name = DELUCA | Source = PlugPlayManager | ID = 12
Description = The device 'ASUS CD-S480/AH' (IDE\CdRomASUS_CD-S480/AH_________________________0.87____\5&22ac9df0&0&0.1.0)
disappeared from the system without first being prepared for removal.

Error - 4/29/2009 2:40:06 PM | Computer Name = DELUCA | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk2\D.

< End of report >

Microsoft Windows XP Home Edition (5.1.2600) Service Pack 3

A:\ [Removable] (Total:0 Mo/Free:0 Mo)
C:\ [Fixed] - NTFS - (Total:72063 Mo/Free:3481 Mo)
D:\ [Fixed] - FAT32 - (Total:4236 Mo/Free:581 Mo)
E:\ [Removable] (Total:0 Mo/Free:0 Mo)
F:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)
H:\ [Removable] (Total:0 Mo/Free:0 Mo)
I:\ [Removable] (Total:0 Mo/Free:0 Mo)
N:\ [Removable] (Total:0 Mo/Free:0 Mo)
O:\ [Removable] (Total:0 Mo/Free:0 Mo)

Wed 04/29/2009|17:02

----------------------\\ Processes..

--Locked-- [System Process]
---------- System
---------- \SystemRoot\System32\smss.exe
---------- \??\C:\WINDOWS\system32\csrss.exe
---------- \??\C:\WINDOWS\system32\winlogon.exe
---------- C:\WINDOWS\system32\services.exe
---------- C:\WINDOWS\system32\lsass.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\spoolsv.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
---------- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
---------- C:\Program Files\Bonjour\mDNSResponder.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
---------- C:\Program Files\Java\jre6\bin\jqs.exe
---------- C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
---------- c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
---------- c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
---------- C:\Program Files\McAfee\VirusScan\McShield.exe
---------- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
---------- C:\WINDOWS\Explorer.EXE
---------- c:\PROGRA~1\mcafee.com\agent\mcagent.exe
---------- C:\Program Files\McAfee\MPF\MPFSrv.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\Program Files\Viewpoint\Common\ViewpointService.exe
---------- c:\WINDOWS\system32\ZuneBusEnum.exe
---------- c:\Program Files\Zune\ZuneNss.exe
---------- C:\Program Files\Canon\CAL\CALMAIN.exe
---------- C:\Program Files\Common Files\AOL\1194992387\ee\AOLSoftware.exe
---------- C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
---------- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
---------- C:\WINDOWS\SOUNDMAN.EXE
---------- C:\Program Files\QuickTime\qttask.exe
---------- C:\Program Files\Multimedia Card Reader\shwicon2k.exe
---------- C:\WINDOWS\system32\ctfmon.exe
---------- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
---------- C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
---------- C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
---------- C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\Program Files\AOL 9.1\waol.exe
---------- C:\Program Files\AOL 9.1\shellmon.exe
---------- C:\Program Files\Mozilla Firefox\firefox.exe
---------- C:\WINDOWS\system32\cmd.exe
---------- C:\Rooter$\RK.exe

----------------------\\ Search..

----------------------\\ ROOTKIT !!

----------------------\\ Rogues..

C:\DOCUME~1\Owner\APPLIC~1\Privacy center
C:\PROGRA~1\Privacy center

1 - "C:\Rooter$\Rooter_1.txt" - Wed 04/29/2009|17:03

----------------------\\ Scan completed at 17:03

Edited by patfan4lif, 29 April 2009 - 03:23 PM.

#2
CatByte

Posted 29 April 2009 - 05:12 PM

GeekU Teacher

GeekU Moderator
2,705 posts

Hi,

Please do the following:

FIRST

We need to upload a few suspicious files to Malwarebytes Anti-Malware

Please go to Malwarebytes' UploadNET
Under File 1: browse for

C:\WINDOWS\onxk08114.exe

*Note: please repeat the process in the subsequent file boxes for each of the Files listed below

C:\WINDOWS\System32\ovfsthxkktqnaho.dat
C:\WINDOWS\System32\ovfsthxfhcvxkfu.dat
C:\WINDOWS\System32\ovfsthxrdxnhiec.dll

Once you have selected all the files to be uploaded, click on the Upload Button.

NEXT

Run OTList2.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTLI2

:OTLI
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\McAfee\VirusScan\McShield.exe (McAfee, Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - Reg Error: Key error. File not found
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - Reg Error: Key error. File not found
[2009/04/14 23:34:20 | 00,386,048 | ---- | C] () -- C:\WINDOWS\twxdo01672.exe
[2009/04/14 23:34:17 | 00,905,670 | ---- | C] () -- C:\WINDOWS\ddquc05038.exe
[2009/04/14 23:21:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\Crack Installer
[2009/04/14 23:33:50 | 00,048,285 | ---- | M] () -- C:\WINDOWS\System32\xirkgmmack.exe
[2009/04/14 23:33:48 | 00,201,870 | ---- | M] () -- C:\WINDOWS\onxk08114.exe
[2009/04/14 23:21:53 | 00,000,043 | ---- | C] () -- C:\WINDOWS\System32\ovfsthxkktqnaho.dat
[2009/04/14 23:20:52 | 00,013,262 | ---- | C] () -- C:\WINDOWS\System32\ovfsthxfhcvxkfu.dat
[2009/04/14 23:20:51 | 00,061,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ovfsthxrdxnhiec.dll
[2009/04/15 14:28:28 | 00,000,155 | ---- | M] () -- C:\WINDOWS\System32\SelfDel.bat
[2009/04/14 23:20:35 | 00,716,925 | ---- | M] () -- C:\WINDOWS\hjqvg20588.exe
[2009/04/14 23:20:20 | 00,888,867 | ---- | M] () -- C:\WINDOWS\mvtgq2134.exe
[2009/04/13 12:16:18 | 00,694,272 | ---- | M] () -- C:\WINDOWS\System32\nsk897.dll
[2009/04/06 06:41:32 | 00,396,288 | ---- | M] () -- C:\WINDOWS\System32\azolalrbamcx.dll
[2009/03/31 21:56:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Privacy center
[2009/03/31 21:56:13 | 00,000,000 | ---D | C] -- C:\Program Files\Privacy center

:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL2 log ( don't check the boxes beside LOP Check or Purity this time )

#3
patfan4lif

Posted 29 April 2009 - 06:14 PM

Member

Topic Starter
Member
78 posts

I went to Malwarebytes' UploadNET and browsed on the C: drive in the Windows folder for all of the files you requested. They were not there. I tried using search to find them and still no luck. What should I do?

#4
CatByte

Posted 29 April 2009 - 06:16 PM

GeekU Teacher

GeekU Moderator
2,705 posts

sorry, my mistake - I should have mentioned those files will be hidden - please show hidden files and folders first:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

If you still cannot locate them, please move on the the next step.

Thanks

Edited by CatByte, 29 April 2009 - 06:17 PM.

#5
patfan4lif

Posted 29 April 2009 - 07:33 PM

Member

Topic Starter
Member
78 posts

nd three of the files and uploaded them.
I ran the OTL2 and copied the text in the box and ran fix
I rebooted and following is the log file after running OTL2 again

OTListIt logfile created on: 4/29/2009 9:27:18 PM - Run 4
OTListIt2 by OldTimer - Version 2.0.14.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

959.48 Mb Total Physical Memory | 414.49 Mb Available Physical Memory | 43.20% Memory free
1.51 Gb Paging File | 1.07 Gb Available in Paging File | 70.67% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.37 Gb Total Space | 27.36 Gb Free Space | 38.87% Space Free | Partition Type: NTFS
Drive D: | 4.14 Gb Total Space | 0.57 Gb Free Space | 13.72% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 702.31 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DELUCA
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe (CA, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\McShield.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (Microsoft Corporation)
PRC - C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - c:\WINDOWS\system32\ZuneBusEnum.exe (Microsoft Corporation)
PRC - c:\Program Files\Zune\ZuneNss.exe (Microsoft Corporation)
PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\AOL\1194992387\ee\AOLSoftware.exe (AOL LLC)
PRC - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\Program Files\AOL 9.1\waol.exe (AOL, LLC.)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\Program Files\iConcepts Music Express\MEAutoDetect.exe ()
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\AOL 9.1\shellmon.exe (AOL, LLC.)
PRC - C:\Documents and Settings\Owner\Desktop\OTListIt2.exe (OldTimer Tools)
PRC - C:\WINDOWS\notepad.exe (Microsoft Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Documents and Settings\Owner\Desktop\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (aawservice [Auto | Stopped]) -- C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (Lavasoft AB)
SRV - (AOL ACS [Auto | Running]) -- C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (Apple Mobile Device [Auto | Running]) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (Bonjour Service [Auto | Running]) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (CCALib8 [Auto | Running]) -- C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (gusvc [Auto | Stopped]) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (hpqcxs08 [On_Demand | Running]) -- C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll (Hewlett-Packard Co.)
SRV - (hpqddsvc [Auto | Running]) -- C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll (Hewlett-Packard Co.)
SRV - (IDriverT [On_Demand | Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (iPod Service [On_Demand | Stopped]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (ITMRTSVC [Auto | Running]) -- C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe (CA, Inc.)
SRV - (JavaQuickStarterService [Auto | Running]) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (mcmscsvc [Auto | Running]) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McNASvc [Auto | Running]) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (McODS [On_Demand | Stopped]) -- C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McProxy [Auto | Running]) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McShield [Unknown | Running]) -- C:\Program Files\McAfee\VirusScan\McShield.exe (McAfee, Inc.)
SRV - (McSysmon [On_Demand | Running]) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (MDM [Auto | Running]) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (Microsoft Corporation)
SRV - (Microsoft Office Groove Audit Service [On_Demand | Stopped]) -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (MpfService [Auto | Running]) -- C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (Net Driver HPZ12 [Auto | Running]) -- C:\WINDOWS\system32\HPZinw12.dll (Hewlett-Packard)
SRV - (odserv [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Pml Driver HPZ12 [Auto | Running]) -- C:\WINDOWS\system32\HPZipm12.dll (Hewlett-Packard)
SRV - (Viewpoint Manager Service [Auto | Running]) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (ZuneBusEnum [Auto | Running]) -- c:\WINDOWS\system32\ZuneBusEnum.exe (Microsoft Corporation)
SRV - (ZuneNetworkSvc [Auto | Running]) -- c:\Program Files\Zune\ZuneNss.exe (Microsoft Corporation)
SRV - (ZuneWlanCfgSvc [On_Demand | Stopped]) -- c:\WINDOWS\system32\ZuneWlanCfgSvc.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AFS2K [System | Running]) -- C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (ALCXSENS [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd)
DRV - (ALCXWDM [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (AR5523 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\WG11TND5.sys (NETGEAR, Inc.)
DRV - (fasttx2k [Boot | Running]) -- C:\WINDOWS\System32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.)
DRV - (FETND5BV [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys (VIA Technologies, Inc. )
DRV - (FETNDISB [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\fetnd5b.sys (VIA Technologies, Inc. )
DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (HPZid412 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HPZid412.sys (HP)
DRV - (HPZipr12 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HPZipr12.sys (HP)
DRV - (HPZius12 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HPZius12.sys (HP)
DRV - (ialm [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (ICAM3NT5 [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\Icam3.sys (Microsoft Corporation)
DRV - (ltmodem5 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys (Agere Systems)
DRV - (mfeavfk [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfebopk [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mfehidk [System | Running]) -- C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mferkdk [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (mfesmfk [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (MPFP [System | Running]) -- C:\WINDOWS\System32\Drivers\Mpfp.sys (McAfee, Inc.)
DRV - (MREMPR5 [On_Demand | Stopped]) -- C:\Program Files\Common Files\Motive\MREMPR5.sys (Motive, Inc.)
DRV - (MRENDIS5 [On_Demand | Stopped]) -- C:\Program Files\Common Files\Motive\MRENDIS5.sys (Motive, Inc.)
DRV - (nv [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (nv_agp [Boot | Running]) -- C:\WINDOWS\System32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (pcouffin [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\pcouffin.sys (VSO Software)
DRV - (Ps2 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company)
DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\DRIVERS\PxHelp20.sys (Sonic Solutions)
DRV - (ROOTMODEM [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\RootMdm.sys (Microsoft Corporation)
DRV - (rtl8139 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\R8139n51.SYS (Realtek Semiconductor Corporation )
DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SiS315 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SISAGP [Boot | Running]) -- C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp [System | Running]) -- C:\WINDOWS\System32\DRIVERS\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SunkFilt [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\sunkfilt.sys (Alcor Micro Corp.)
DRV - (USBAAPL [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\usbaapl.sys (Apple, Inc.)
DRV - (usbsermpt [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usbsermpt.sys (Microsoft Corporation)
DRV - (usb_rndisx [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usb8023x.sys (Microsoft Corporation)
DRV - (viaagp1 [Boot | Running]) -- C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (viagfx [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\vtmini.sys (Copyright © VIA/S3 Graphics Co, Ltd.)
DRV - (wanatw [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys (America Online, Inc.)
DRV - (zumbus [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\zumbus.sys (Microsoft Corporation)
DRV - ({6080A529-897E-4629-A488-ABA0C29B635E} [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ialmsbw.sys (Intel Corporation)
DRV - ({D31A0762-0CEB-444e-ACFF-B049A1F6FE91} [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ialmkchw.sys (Intel Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft...p...ER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft...amp;ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Local Page = http://www.google.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Local Page Restore =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...m...tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig?hl=en
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com/ig?hl=en
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost;*.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.co...en&source=iglk"
FF - prefs.js..extensions.enabledItems: [email protected]:1.0.12514
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12
FF - prefs.js..extensions.enabledItems: {CC929838-C203-4D1C-8611-4C9535AD2AE2}:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10

FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MOZILLA\FIREFOX EXTENSIONS\{3112CA9C-DE6D-4884-A869-9855DE68056C} [2007/12/21 00:02:00 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD [2007/12/21 00:03:12 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2008/12/27 16:01:52 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\PROGRAM FILES\HP\DIGITAL IMAGING\SMART WEB PRINTING\MOZILLAADDON2 [2009/04/17 17:07:01 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/28 19:27:30 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/04/28 19:27:29 | 00,000,000 | ---D | M]

[2009/04/22 15:39:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\mozilla\Extensions
[2009/04/22 15:39:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/04/22 15:39:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\3lxmc16f.default\extensions
[2009/04/29 20:54:44 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009/04/28 19:27:29 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/03/11 09:01:41 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
[2009/04/14 23:20:52 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CC929838-C203-4D1C-8611-4C9535AD2AE2}
[2009/04/29 21:25:38 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\[email protected]
[2009/04/28 19:27:22 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/04/28 19:27:22 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/04/09 01:51:14 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/04/09 01:51:14 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/04/09 01:51:14 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/04/09 01:51:14 | 00,002,343 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/04/09 01:51:14 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/04/09 01:51:14 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/04/09 01:51:14 | 00,000,792 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (736 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - Reg Error: Key error. File not found
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - Reg Error: Key error. File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (&Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AlcxMonitor] ALCXMNTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1194992387\ee\AOLSoftware.exe (AOL LLC)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot (RealNetworks, Inc.)
O4 - HKCU..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.1\AOL.EXE" -b (AOL, LLC.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Auto Detect.lnk = C:\Program Files\iConcepts Music Express\MEAutoDetect.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\runit_32.lnk = C:\Program Files\runit\runit_32.exe (BB Inc)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O8 - Extra context menu item: &search - Reg Error: Value error. File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - Reg Error: Value error. File not found
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - Reg Error: Value error. File not found
O9 - Extra Button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [NWLink IPX/SPX/NetBIOS Compatible Transport Protocol] - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Sites: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Sites: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Sites: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: 23 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} https://activatemyfi...IOS/tgctlcm.cab (Support.com Configuration Class)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://a1540.g.akama...ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} http://support.f-sec...m/ols/fscax.cab (F-Secure Online Scanner 3.1)
O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} https://h20364.www2....DataManager.CAB (Hewlett-Packard Online Support Services)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.micr...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} http://fpdownload2.m...ash/swflash.cab (MetaStreamCtlSecondary Class)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} http://catalog.updat...b?1206149902140 (MUCatalogWebControl Class)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebo...otoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1137349355015 (WUWebControl Class)
O16 - DPF: {6BAB93B7-1917-4214-A7D2-874FA6DB4740} http://pictures.aolc...ns.10.1.0.0.cab (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.micros...b?1174605601604 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} http://floridakeysme...sCamControl.ocx (CamImage Class)
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} http://h20264.www2.h...nosticsxp2k.cab (DDRevision Class)
O16 - DPF: {B3E32D88-8E7F-468F-B0E2-3A300FD4A82C} http://myitlab.pears...ces/ax/stub.cab (Enlite 2.x Simulation Engine Installer)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.ma...ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} http://aolsvc.aol.co...sh.1.0.0.72.cab (CPlayFirstDinerDashControl Object)
O16 - DPF: {EBF85371-A38F-485B-B28F-0B4C82D25937} http://update.hpphot.../HPSWUpdate.ocx (CUpdateCtl Object)
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} http://cvs.pnimedia....tupv2.0.0.9.cab? (Photo Upload Plugin Class)
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} http://cvs.pnimedia....upv2.0.0.10.cab? (Photo Upload Plugin Class)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\system32\igfxsrvc.dll (Intel Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O32 - Autorun File - D:\AUTOEXEC.BAT () - [ FAT32 ]
O33 - MountPoints2\{81bd707e-dc13-11dc-9e31-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{81bd707e-dc13-11dc-9e31-00038a000015}\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[5 C:\WINDOWS\*.tmp files]
[1 C:\Documents and Settings\Owner\My Documents\*.tmp files]
[2009/04/29 21:02:58 | 00,000,000 | ---D | C] -- C:\_OTListIt
[2009/04/29 20:52:36 | 00,501,248 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
[2009/04/29 17:04:31 | 00,000,162 | -H-- | C] () -- C:\Documents and Settings\Owner\My Documents\~$ListIt logfile created on.docx
[2009/04/29 17:02:25 | 00,000,000 | ---D | C] -- C:\Rooter$
[2009/04/29 17:02:15 | 00,267,612 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Rooter.exe
[2009/04/29 16:38:06 | 00,045,988 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\OTListIt logfile created on.docx
[2009/04/29 10:52:00 | 00,866,904 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\SetupGamevance.exe
[2009/04/28 22:36:55 | 00,000,775 | ---- | C] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/04/28 22:36:52 | 00,000,619 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\NTREGOPT.lnk
[2009/04/28 22:36:52 | 00,000,600 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\ERUNT.lnk
[2009/04/28 22:36:51 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/04/28 22:36:20 | 00,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\Owner\Desktop\erunt_setup.exe
[2009/04/28 22:34:48 | 00,000,954 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\AVS4YOU Software Navigator.lnk
[2009/04/28 22:34:34 | 00,000,910 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\AVS Registry Cleaner.lnk
[2009/04/28 22:33:03 | 19,735,128 | ---- | C] (Online Media Technologies Ltd. ) -- C:\Documents and Settings\Owner\Desktop\AVSRegistryCleaner.exe
[2009/04/26 13:55:05 | 00,157,349 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\brian on ladder.jpg
[2009/04/25 10:45:11 | 00,001,737 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2009/04/22 16:25:31 | 00,000,000 | ---D | C] -- C:\Program Files\internet explorer
[2009/04/22 16:23:05 | 10,061,61920 | -HS- | C] () -- C:\hiberfil.sys
[2009/04/22 15:38:16 | 00,001,610 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2009/04/21 15:21:33 | 00,018,830 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\Norton reg key.docx
[2009/04/18 15:59:57 | 01,003,416 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\100_3200.JPG
[2009/04/18 10:37:15 | 00,000,868 | ---- | C] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2009/04/17 16:42:20 | 00,078,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ieencode.dll
[2009/04/17 16:42:20 | 00,078,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieencode.dll
[2009/04/16 19:45:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\McAfee
[2009/04/15 19:54:12 | 00,000,000 | ---D | C] -- C:\HP LJ P4010 Series Printer
[2009/04/15 19:51:06 | 00,000,512 | ---- | C] () -- C:\WINDOWS\System32\VA720.ICM
[2009/04/15 19:45:16 | 00,026,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\CTL3D.DLL
[2009/04/15 19:41:12 | 00,000,275 | ---- | C] () -- C:\WINDOWS\UChromeP.uns
[2009/04/15 19:33:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\PC_Drivers_Headquarters
[2009/04/15 19:29:03 | 00,002,194 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Driver Detective.lnk
[2009/04/15 19:29:00 | 00,000,000 | ---D | C] -- C:\Program Files\PC Drivers HeadQuarters
[2009/04/15 18:37:00 | 00,000,000 | ---D | C] -- C:\VundoFix Backups
[2009/04/15 14:43:48 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Xilisoft Corporation
[2009/04/15 14:43:48 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Xilisoft Corporation
[2009/04/15 14:43:21 | 00,001,786 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Xilisoft Video Converter Standard.lnk
[2009/04/15 14:43:00 | 00,000,000 | ---D | C] -- C:\Program Files\Xilisoft
[2009/04/15 14:36:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\dBpoweramp
[2009/04/15 14:28:28 | 00,000,155 | ---- | C] () -- C:\WINDOWS\System32\SelfDel.bat
[2009/04/15 14:18:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\AccurateRip
[2009/04/15 14:18:07 | 05,433,520 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall.exe
[2009/04/15 14:18:07 | 00,033,846 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp Music Converter.bmp
[2009/04/15 14:18:07 | 00,014,373 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp Music Converter.dat
[2009/04/15 14:18:05 | 00,000,000 | ---D | C] -- C:\Program Files\Illustrate
[2009/04/15 14:02:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
[2009/04/15 13:34:48 | 00,827,392 | ---- | C] (Macromedia, Inc.) -- C:\WINDOWS\System32\FLASH.OCX
[2009/04/15 10:01:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\COWON
[2009/04/15 08:01:08 | 00,000,206 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2009/04/15 04:56:33 | 00,074,240 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll
[2009/04/15 03:36:33 | 00,044,544 | ---- | C] () -- C:\WINDOWS\System32\Winset20.exe
[2009/04/14 23:34:51 | 00,000,000 | ---D | C] -- C:\Program Files\setups
[2009/04/14 23:34:43 | 00,000,000 | ---D | C] -- C:\Program Files\f3setupinstall2
[2009/04/14 23:34:22 | 00,868,352 | ---- | C] (iehlsvc) -- C:\WINDOWS\System32\hlidelnk.exe
[2009/04/14 23:34:20 | 00,386,048 | ---- | C] () -- C:\WINDOWS\twxdo01672.exe
[2009/04/14 23:34:17 | 00,905,670 | ---- | C] () -- C:\WINDOWS\ddquc05038.exe
[2009/04/14 23:34:16 | 00,000,000 | ---D | C] -- C:\Program Files\p2pmax
[2009/04/14 23:34:15 | 00,000,677 | ---- | C] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\runit_32.lnk
[2009/04/14 23:34:14 | 00,000,000 | ---D | C] -- C:\Program Files\runit
[2009/04/14 23:34:10 | 00,069,697 | ---- | C] () -- C:\WINDOWS\lhfls4237.exe
[2009/04/14 23:34:05 | 00,032,768 | ---- | C] (BB Inc) -- C:\WINDOWS\lntak31610.exe
[2009/04/14 23:34:01 | 00,085,654 | ---- | C] () -- C:\WINDOWS\System32\3466247d-1dff-1e0a-cfd5-338c87a98fad.exe
[2009/04/14 23:33:50 | 00,048,285 | ---- | C] () -- C:\WINDOWS\System32\xirkgmmack.exe
[2009/04/14 23:33:47 | 00,201,870 | ---- | C] () -- C:\WINDOWS\onxk08114.exe
[2009/04/14 23:21:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\Crack Installer
[2009/04/14 23:21:53 | 00,000,043 | ---- | C] () -- C:\WINDOWS\System32\ovfsthxkktqnaho.dat
[2009/04/14 23:20:52 | 00,013,262 | ---- | C] () -- C:\WINDOWS\System32\ovfsthxfhcvxkfu.dat
[2009/04/14 23:20:51 | 00,061,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ovfsthxrdxnhiec.dll
[2009/04/14 23:20:34 | 00,716,925 | ---- | C] () -- C:\WINDOWS\hjqvg20588.exe
[2009/04/14 23:20:19 | 00,888,867 | ---- | C] () -- C:\WINDOWS\mvtgq2134.exe
[2009/04/14 23:16:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\BitDownload
[2009/04/14 23:07:38 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2009/04/14 23:07:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\NCH Swift Sound
[2009/04/14 22:58:30 | 00,000,000 | ---D | C] -- C:\Program Files\FixTunes
[2009/04/14 16:52:34 | 00,002,560 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpsp4res.dll
[2009/04/13 12:16:18 | 00,694,272 | ---- | C] () -- C:\WINDOWS\System32\nsk897.dll
[2009/04/07 18:17:59 | 00,107,163 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Larry Bird Magic Johnson 4-09.JPG
[2009/04/06 06:41:32 | 00,396,288 | ---- | C] () -- C:\WINDOWS\System32\azolalrbamcx.dll
[2009/04/05 16:58:58 | 00,031,877 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\palm cross.docx
[2009/03/31 21:56:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Privacy center
[2009/03/31 21:56:13 | 00,000,000 | ---D | C] -- C:\Program Files\Privacy center
[2009/03/31 09:19:50 | 00,293,889 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\E-mail pic.JPG
[2008/12/13 17:25:13 | 00,147,456 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2008/11/04 13:39:19 | 00,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008/11/04 13:39:18 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008/11/04 10:06:15 | 00,003,350 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2008/11/04 10:06:15 | 00,000,088 | RHS- | C] () -- C:\WINDOWS\System32\A0AECBFCA9.sys
[2008/10/27 16:38:46 | 00,000,121 | ---- | C] () -- C:\WINDOWS\disney.ini
[2008/10/27 16:38:01 | 00,000,199 | ---- | C] () -- C:\WINDOWS\disneysy.ini
[2008/10/05 18:56:15 | 00,003,603 | ---- | C] () -- C:\WINDOWS\Solitaire.ini
[2007/12/07 11:07:40 | 00,099,712 | ---- | C] () -- C:\WINDOWS\HPBroker.dll
[2007/09/12 23:54:48 | 00,141,180 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2007/04/08 10:22:08 | 00,000,010 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2006/11/22 00:30:16 | 00,000,137 | ---- | C] () -- C:\WINDOWS\qti.ini
[2006/08/16 12:29:51 | 00,009,279 | ---- | C] () -- C:\WINDOWS\AmvTransform.ini
[2006/08/16 12:29:51 | 00,008,157 | ---- | C] () -- C:\WINDOWS\AmvPlayer.ini
[2006/08/16 12:29:51 | 00,003,677 | ---- | C] () -- C:\WINDOWS\SoundCon.INI
[2006/08/16 12:29:51 | 00,000,170 | ---- | C] () -- C:\WINDOWS\settings.ini
[2006/07/31 21:50:04 | 00,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2006/07/31 21:50:04 | 00,000,001 | ---- | C] () -- C:\WINDOWS\yedlat.dll
[2006/03/15 21:20:03 | 00,050,784 | ---- | C] () -- C:\WINDOWS\System32\drivers\atntwink.sys
[2005/12/30 23:08:42 | 00,000,000 | ---- | C] () -- C:\WINDOWS\slingox.INI
[2005/12/21 06:45:00 | 00,000,000 | ---- | C] () -- C:\WINDOWS\winfg32.dll
[2005/12/18 10:33:57 | 00,000,000 | ---- | C] () -- C:\WINDOWS\ipom.dll
[2005/08/31 11:43:32 | 00,098,304 | ---- | C] () -- C:\WINDOWS\System32\resourceGeneric.dll
[2005/08/12 17:57:09 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005/07/14 12:31:20 | 00,027,648 | RHS- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2005/07/12 10:20:30 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2005/07/07 23:57:48 | 00,000,131 | ---- | C] () -- C:\WINDOWS\EurekaLog.ini
[2005/06/21 22:37:42 | 00,045,568 | RHS- | C] () -- C:\WINDOWS\System32\cygz.dll
[2005/05/11 18:53:46 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Slingo2x.INI
[2005/03/27 12:20:42 | 00,002,120 | ---- | C] () -- C:\WINDOWS\1Way.ini
[2005/03/27 12:20:42 | 00,000,028 | ---- | C] () -- C:\WINDOWS\Progs_.ini
[2005/02/22 16:30:24 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Setup32.INI
[2005/02/11 19:29:10 | 00,000,177 | ---- | C] () -- C:\WINDOWS\upst.ini
[2005/02/03 20:53:57 | 00,000,000 | ---- | C] () -- C:\WINDOWS\BARBIE.INI
[2005/02/03 20:46:03 | 00,000,028 | ---- | C] () -- C:\WINDOWS\PSetup.ini
[2005/01/10 21:31:14 | 00,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI
[2005/01/07 19:48:44 | 00,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2004/12/24 16:59:13 | 00,003,879 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2004/12/19 16:40:51 | 00,000,021 | ---- | C] () -- C:\WINDOWS\atid.ini
[2004/12/19 16:24:04 | 00,000,018 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2004/12/18 20:43:34 | 00,000,000 | ---- | C] () -- C:\WINDOWS\slingo.INI
[2004/12/18 15:03:25 | 00,000,021 | ---- | C] () -- C:\WINDOWS\PI_setup.ini
[2004/12/18 14:57:06 | 00,000,195 | ---- | C] () -- C:\WINDOWS\EPSONCX6400.ini
[2004/09/17 21:37:42 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\vuins32.dll
[2004/09/16 13:26:40 | 00,012,634 | ---- | C] () -- C:\WINDOWS\System32\drivers\ADFUUD.SYS
[2004/09/16 13:26:40 | 00,012,634 | ---- | C] () -- C:\WINDOWS\ADFUUD.SYS
[2004/02/04 14:30:47 | 01,614,848 | ---- | C] () -- C:\WINDOWS\System32\sfcfiles.dll
[2004/01/28 22:21:05 | 00,000,451 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini
[2004/01/28 22:21:05 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2004/01/27 06:47:39 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/01/27 06:26:18 | 00,002,158 | ---- | C] () -- C:\WINDOWS\System32\mshrml.ini
[2004/01/26 09:23:22 | 00,167,936 | ---- | C] () -- C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2004/01/26 09:17:11 | 00,029,216 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS
[2004/01/26 09:16:36 | 00,024,576 | ---- | C] () -- C:\WINDOWS\System32\syscontr.dll
[2004/01/26 09:16:00 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll
[2004/01/26 09:00:28 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/01/26 08:46:03 | 00,000,889 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
[2004/01/26 06:56:30 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/01/26 06:14:16 | 00,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/01/26 06:02:59 | 00,299,073 | ---- | C] () -- C:\WINDOWS\System32\PythonCOM22.dll
[2004/01/26 06:02:59 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\PyWinTypes22.dll
[2004/01/26 06:02:33 | 00,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll
[2004/01/26 05:33:52 | 00,000,802 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/01/26 04:11:44 | 00,000,553 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/01/26 04:11:01 | 00,000,807 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/01/26 04:10:51 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini
[2003/09/23 04:19:42 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini

========== Files - Modified Within 30 Days ==========

[1 C:\WINDOWS\System32\drivers\*.tmp files]
[1 C:\WINDOWS\System32\*.tmp files]
[5 C:\WINDOWS\*.tmp files]
[1 C:\Documents and Settings\Owner\My Documents\*.tmp files]
[2009/04/29 21:10:38 | 00,000,807 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/04/29 21:09:20 | 00,044,528 | ---- | M] () -- C:\WINDOWS\System32\Config.MPF
[2009/04/29 21:09:13 | 00,000,438 | ---- | M] () -- C:\WINDOWS\tasks\RegCure Program Check.job
[2009/04/29 21:06:43 | 00,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2009/04/29 21:06:23 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/04/29 21:06:20 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/04/29 21:06:19 | 10,061,61920 | -HS- | M] () -- C:\hiberfil.sys
[2009/04/29 20:52:36 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
[2009/04/29 17:49:05 | 00,116,936 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/04/29 17:47:44 | 00,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/04/29 17:07:40 | 00,045,988 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\OTListIt logfile created on.docx
[2009/04/29 17:04:31 | 00,000,162 | -H-- | M] () -- C:\Documents and Settings\Owner\My Documents\~$ListIt logfile created on.docx
[2009/04/29 17:02:15 | 00,267,612 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Rooter.exe
[2009/04/29 10:54:20 | 00,957,440 | -HS- | M] () -- C:\Documents and Settings\Owner\My Documents\Thumbs.db
[2009/04/29 10:52:00 | 00,866,904 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\SetupGamevance.exe
[2009/04/28 23:00:50 | 00,380,040 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/04/28 22:36:55 | 00,000,775 | ---- | M] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/04/28 22:36:52 | 00,000,619 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\NTREGOPT.lnk
[2009/04/28 22:36:52 | 00,000,600 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\ERUNT.lnk
[2009/04/28 22:36:20 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\Owner\Desktop\erunt_setup.exe
[2009/04/28 22:34:48 | 00,000,954 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\AVS4YOU Software Navigator.lnk
[2009/04/28 22:34:34 | 00,000,910 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\AVS Registry Cleaner.lnk
[2009/04/28 22:33:36 | 19,735,128 | ---- | M] (Online Media Technologies Ltd. ) -- C:\Documents and Settings\Owner\Desktop\AVSRegistryCleaner.exe
[2009/04/26 17:10:14 | 00,228,352 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/26 13:54:19 | 00,157,349 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\brian on ladder.jpg
[2009/04/25 14:17:07 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/04/25 10:45:11 | 00,001,737 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2009/04/23 03:27:07 | 00,000,372 | ---- | M] () -- C:\WINDOWS\tasks\RegCure.job
[2009/04/22 17:33:46 | 00,410,574 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/04/22 17:33:46 | 00,065,044 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/04/22 17:33:45 | 00,483,752 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/04/22 16:20:24 | 00,001,917 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/04/22 15:38:16 | 00,001,610 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2009/04/22 11:57:23 | 00,002,194 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Driver Detective.lnk
[2009/04/21 15:21:34 | 00,018,830 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\Norton reg key.docx
[2009/04/19 09:19:05 | 00,000,736 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/04/17 16:51:34 | 00,000,076 | -HS- | M] () -- C:\Documents and Settings\Owner\My Documents\desktop.ini
[2009/04/16 16:34:15 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/04/15 19:41:13 | 00,000,275 | ---- | M] () -- C:\WINDOWS\UChromeP.uns
[2009/04/15 18:28:43 | 00,013,262 | ---- | M] () -- C:\WINDOWS\System32\ovfsthxfhcvxkfu.dat
[2009/04/15 18:28:43 | 00,000,043 | ---- | M] () -- C:\WINDOWS\System32\ovfsthxkktqnaho.dat
[2009/04/15 14:43:21 | 00,001,786 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Xilisoft Video Converter Standard.lnk
[2009/04/15 14:28:28 | 00,000,155 | ---- | M] () -- C:\WINDOWS\System32\SelfDel.bat
[2009/04/15 14:18:07 | 00,014,373 | ---- | M] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp Music Converter.dat
[2009/04/15 14:17:46 | 00,033,846 | ---- | M] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp Music Converter.bmp
[2009/04/15 14:17:44 | 05,433,520 | ---- | M] () -- C:\WINDOWS\System32\SpoonUninstall.exe
[2009/04/15 13:34:48 | 00,827,392 | ---- | M] (Macromedia, Inc.) -- C:\WINDOWS\System32\FLASH.OCX
[2009/04/15 08:01:08 | 00,000,206 | ---- | M] () -- C:\WINDOWS\System32\MRT.INI
[2009/04/15 07:54:35 | 00,000,340 | ---- | M] () -- C:\WINDOWS\tasks\McDefragTask.job
[2009/04/15 04:56:33 | 00,074,240 | ---- | M] () -- C:\WINDOWS\System32\zlib.dll
[2009/04/15 03:36:41 | 00,044,544 | ---- | M] () -- C:\WINDOWS\System32\Winset20.exe
[2009/04/14 23:34:22 | 00,868,352 | ---- | M] (iehlsvc) -- C:\WINDOWS\System32\hlidelnk.exe
[2009/04/14 23:34:21 | 00,386,048 | ---- | M] () -- C:\WINDOWS\twxdo01672.exe
[2009/04/14 23:34:19 | 00,905,670 | ---- | M] () -- C:\WINDOWS\ddquc05038.exe
[2009/04/14 23:34:15 | 00,000,677 | ---- | M] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\runit_32.lnk
[2009/04/14 23:34:10 | 00,069,697 | ---- | M] () -- C:\WINDOWS\lhfls4237.exe
[2009/04/14 23:34:05 | 00,032,768 | ---- | M] (BB Inc) -- C:\WINDOWS\lntak31610.exe
[2009/04/14 23:34:01 | 00,085,654 | ---- | M] () -- C:\WINDOWS\System32\3466247d-1dff-1e0a-cfd5-338c87a98fad.exe
[2009/04/14 23:33:50 | 00,048,285 | ---- | M] () -- C:\WINDOWS\System32\xirkgmmack.exe
[2009/04/14 23:33:48 | 00,201,870 | ---- | M] () -- C:\WINDOWS\onxk08114.exe
[2009/04/14 23:20:51 | 00,061,952 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ovfsthxrdxnhiec.dll
[2009/04/14 23:20:35 | 00,716,925 | ---- | M] () -- C:\WINDOWS\hjqvg20588.exe
[2009/04/14 23:20:20 | 00,888,867 | ---- | M] () -- C:\WINDOWS\mvtgq2134.exe
[2009/04/13 12:16:18 | 00,694,272 | ---- | M] () -- C:\WINDOWS\System32\nsk897.dll
[2009/04/07 18:17:59 | 00,107,163 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Larry Bird Magic Johnson 4-09.JPG
[2009/04/06 18:21:16 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/04/06 10:57:24 | 24,921,544 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
[2009/04/06 06:41:32 | 00,396,288 | ---- | M] () -- C:\WINDOWS\System32\azolalrbamcx.dll
[2009/04/05 16:58:59 | 00,031,877 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\palm cross.docx
[2009/04/01 01:00:37 | 00,000,332 | ---- | M] () -- C:\WINDOWS\tasks\McQcTask.job
[2009/03/31 09:19:50 | 00,293,889 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\E-mail pic.JPG

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Owner\My Documents\PHONEwork2.bak:SummaryInformation
@Alternate Data Stream - 3567 bytes -> C:\WINDOWS\svcpack.log:hgtnce
@Alternate Data Stream - 197761 bytes -> C:\WINDOWS\spuninst.log:ofbhic
< End of report >

#6
CatByte

Posted 29 April 2009 - 07:39 PM

GeekU Teacher

GeekU Moderator
2,705 posts

Hi,

Please do the following:

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

Double-click GooredFix.exe to run it.
Select 1. Find Goored (no fix) by typing 1 and pressing Enter.
A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

Note: Do not run Option #2 yet.

NEXT

Please download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click gmer.exe. The program will begin to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a number of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

NEXT

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

In your next reply I need

GooredFix Log
GMER Log
ComboFix Log

#7
patfan4lif

Posted 29 April 2009 - 08:24 PM

Member

Topic Starter
Member
78 posts

Here are the Logs:

ComboFix 09-04-29.01 - Owner 04/29/2009 21:57.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.490 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
FW: McAfee Personal Firewall *enabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\Local Settings\Temporary Internet Files\esb-windows.zip
c:\documents and settings\Owner\Start Menu\Programs\Startup\runit_32.lnk
c:\program files\p2pmax
c:\program files\p2pmax\p2pmaxu.exe
c:\program files\runit
c:\program files\runit\config.txt
c:\program files\runit\runit_32.exe
c:\program files\runit\runitu_32.exe
c:\program files\SelectRebates
c:\program files\SelectRebates\SelectRebatesDownload.exe
c:\windows\ddquc05038.exe
c:\windows\lhfls4237.exe
c:\windows\mvtgq2134.exe
c:\windows\onxk08114.exe
c:\windows\system32\3466247d-1dff-1e0a-cfd5-338c87a98fad.exe
c:\windows\system32\AutoRun.inf
c:\windows\system32\azolalrbamcx.dll
c:\windows\system32\ovfsthxfhcvxkfu.dat
c:\windows\system32\ovfsthxkktqnaho.dat
c:\windows\system32\ovfsthxrdxnhiec.dll
c:\windows\system32\Winset20.exe
c:\windows\system32\xirkgmmack.exe

Infected copy of c:\windows\system32\sfcfiles.dll was found and disinfected
Restored copy from - c:\windows\system32\dllcache\sfcfiles.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MYWEBSEARCHSERVICE
-------\Legacy_sfc
-------\Service_sfc

((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-4-30 )))))))))))))))))))))))))))))))
.

2009-04-30 01:02 . 2009-04-30 01:02 -------- d-----w C:\_OTListIt
2009-04-29 21:02 . 2009-04-29 21:03 -------- d-----w C:\Rooter$
2009-04-29 02:36 . 2009-04-29 02:36 -------- d-----w c:\program files\ERUNT
2009-04-22 20:18 . 2009-04-22 20:18 -------- d-----w c:\documents and settings\Administrator.DELUCA\Local Settings\Application Data\Google
2009-04-17 23:44 . 2009-04-17 23:44 -------- d-sh--w c:\windows\system32\config\systemprofile\IETldCache
2009-04-17 21:21 . 2009-04-17 21:21 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-04-17 20:57 . 2009-04-17 20:57 -------- d-sh--w c:\documents and settings\Owner\IECompatCache
2009-04-17 20:56 . 2009-04-17 20:56 -------- d-sh--w c:\documents and settings\Owner\PrivacIE
2009-04-17 20:54 . 2009-04-17 20:54 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-04-17 20:51 . 2009-04-17 20:51 -------- d-sh--w c:\documents and settings\Owner\IETldCache
2009-04-17 20:42 . 2009-02-20 18:09 78336 ----a-w c:\windows\system32\ieencode.dll
2009-04-17 20:42 . 2009-02-20 18:09 78336 ----a-w c:\windows\system32\dllcache\ieencode.dll
2009-04-16 23:45 . 2009-04-16 23:45 -------- d-----w c:\documents and settings\Owner\Application Data\McAfee
2009-04-15 23:54 . 2009-04-27 12:07 -------- d-----w C:\HP LJ P4010 Series Printer
2009-04-15 23:45 . 1998-01-23 16:04 362772 ----a-w c:\windows\ISUN16.EXE
2009-04-15 23:45 . 1995-07-13 21:43 26768 ----a-w c:\windows\system\CTL3D.DLL
2009-04-15 23:33 . 2009-04-15 23:33 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\PC_Drivers_Headquarters
2009-04-15 23:29 . 2009-04-15 23:29 -------- d-----w c:\program files\PC Drivers HeadQuarters
2009-04-15 23:03 . 2009-04-15 23:08 -------- d-----w c:\documents and settings\Owner\DoctorWeb
2009-04-15 22:37 . 2009-04-15 22:37 -------- d-----w C:\VundoFix Backups
2009-04-15 18:43 . 2009-04-15 18:43 -------- d-----w c:\documents and settings\Owner\Application Data\Xilisoft Corporation
2009-04-15 18:43 . 2009-04-15 18:43 -------- d-----w c:\program files\Xilisoft
2009-04-15 18:36 . 2009-04-15 18:36 -------- d-----w c:\documents and settings\Owner\Application Data\dBpoweramp
2009-04-15 18:28 . 2009-04-15 18:28 155 ----a-w c:\windows\system32\SelfDel.bat
2009-04-15 18:18 . 2009-04-15 18:18 -------- d-----w c:\documents and settings\Owner\Application Data\AccurateRip
2009-04-15 18:18 . 2009-04-15 18:18 14373 ----a-w c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2009-04-15 18:18 . 2009-04-15 18:17 5433520 ----a-w c:\windows\system32\SpoonUninstall.exe
2009-04-15 18:18 . 2009-04-15 18:18 -------- d-----w c:\program files\Illustrate
2009-04-15 18:02 . 2009-04-15 18:02 -------- dc----w c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
2009-04-15 14:01 . 2009-04-15 14:07 -------- d-----w c:\documents and settings\Owner\Application Data\COWON
2009-04-15 08:56 . 2009-04-15 08:56 74240 ----a-w c:\windows\system32\zlib.dll
2009-04-15 03:34 . 2009-04-15 03:35 -------- d-----w c:\program files\setups
2009-04-15 03:34 . 2009-04-15 03:34 -------- d-----w c:\program files\f3setupinstall2
2009-04-15 03:34 . 2009-04-15 03:34 868352 ----a-w c:\windows\system32\hlidelnk.exe
2009-04-15 03:34 . 2009-04-15 03:34 386048 ----a-w c:\windows\twxdo01672.exe
2009-04-15 03:34 . 2009-04-15 03:34 32768 ----a-w c:\windows\lntak31610.exe
2009-04-15 03:21 . 2009-04-15 03:21 -------- d-----w c:\windows\Crack Installer
2009-04-15 03:20 . 2009-04-15 03:20 716925 ----a-w c:\windows\hjqvg20588.exe
2009-04-15 03:16 . 2009-04-16 02:11 -------- d-----w c:\documents and settings\Owner\Application Data\BitDownload
2009-04-15 03:07 . 2009-04-15 03:07 -------- d-----w c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-04-15 03:07 . 2009-04-15 03:07 -------- d-----w c:\documents and settings\Owner\Application Data\NCH Swift Sound
2009-04-15 02:58 . 2009-04-15 03:02 -------- d-----w c:\program files\FixTunes
2009-04-14 20:52 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-04-13 16:16 . 2009-04-13 16:16 694272 ----a-w c:\windows\system32\nsk897.dll
2009-04-01 01:56 . 2009-04-01 01:56 -------- d-----w c:\documents and settings\Owner\Application Data\Privacy center
2009-04-01 01:56 . 2009-04-01 15:31 -------- d-----w c:\program files\Privacy center

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-29 21:49 . 2004-12-18 19:38 116936 -c--a-w c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-29 02:34 . 2008-10-05 01:59 -------- d-----w c:\program files\AVS4YOU
2009-04-29 02:34 . 2008-10-05 01:59 -------- d-----w c:\program files\Common Files\AVSMedia
2009-04-25 14:44 . 2004-01-26 12:22 -------- d-----w c:\program files\Common Files\Adobe
2009-04-22 20:18 . 2005-01-08 15:30 -------- d-----w c:\program files\Google
2009-04-18 00:23 . 2005-01-09 19:40 -------- d-----w c:\program files\exPressit S.E. 2.1
2009-04-17 21:07 . 2008-01-18 01:03 -------- d-----w c:\program files\HP
2009-04-16 23:38 . 2007-10-07 22:39 -------- d-----w c:\program files\McAfee
2009-04-15 23:50 . 2004-01-26 12:22 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-25 20:42 . 2009-03-25 20:39 -------- d-----w c:\program files\Canon
2009-03-25 20:38 . 2009-03-25 20:38 -------- d-----w c:\program files\Common Files\Canon
2009-03-22 03:40 . 2007-11-13 22:19 -------- d-----w c:\program files\AOL 9.1
2009-03-22 01:00 . 2007-05-15 20:42 -------- d-----w c:\program files\Verizon
2009-03-11 13:00 . 2008-12-27 20:02 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-11 04:25 . 2009-03-11 04:25 56 ---ha-w c:\windows\system32\ezsidmv.dat
2009-03-09 22:08 . 2008-12-04 00:20 -------- d-----w c:\program files\Namo
2009-03-07 13:44 . 2009-02-28 18:15 -------- d-----w c:\program files\Rugrats Activity Challenge
2009-03-06 14:22 . 2004-02-04 18:37 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2005-10-21 20:51 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-09 12:10 . 2004-02-04 19:12 729088 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2005-07-26 04:31 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2004-02-04 19:09 617472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-01-26 08:10 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 11:13 . 2004-01-26 08:11 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-07 23:02 . 2002-08-29 08:04 2066048 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 21:38 . 2009-01-14 23:15 139671 ----a-w c:\windows\hpoins15.dat
2009-02-06 11:11 . 2004-02-04 18:37 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 2004-01-26 08:10 2189056 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2004-02-04 18:37 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:59 . 2004-02-04 18:37 56832 ----a-w c:\windows\system32\secur32.dll
2006-09-20 20:00 . 2006-09-20 20:00 774144 -c--a-w c:\program files\RngInterstitial.dll
2005-05-13 21:12 . 2005-05-13 21:12 217073 -csha-r c:\windows\meta4.exe
2005-10-24 15:13 . 2005-10-24 15:13 66560 -csha-r c:\windows\MOTA113.exe
2005-10-14 01:27 . 2005-10-14 01:27 422400 -csha-r c:\windows\x2.64.exe
2005-01-08 00:16 . 2005-01-07 22:16 0 -csha-w c:\windows\SMINST\HPCD.sys
2008-11-04 14:50 . 2008-11-04 14:06 88 --sh--r c:\windows\system32\A0AECBFCA9.sys
2005-10-07 23:14 . 2005-10-07 23:14 308224 -csha-r c:\windows\system32\avisynth.dll
2005-07-14 16:31 . 2005-07-14 16:31 27648 -csha-r c:\windows\system32\AVSredirect.dll
2005-06-26 19:32 . 2005-06-26 19:32 616448 -csha-r c:\windows\system32\cygwin1.dll
2005-06-22 02:37 . 2005-06-22 02:37 45568 -csha-r c:\windows\system32\cygz.dll
2004-01-25 04:00 . 2004-01-25 04:00 70656 -csha-r c:\windows\system32\i420vfw.dll
2008-11-09 00:49 . 2008-11-04 14:06 3350 --sha-w c:\windows\system32\KGyGaAvL.sys
2006-04-27 14:24 . 2006-04-27 14:24 2945024 -csha-r c:\windows\system32\Smab.dll
2005-02-28 17:16 . 2005-02-28 17:16 240128 -csha-r c:\windows\system32\x.264.exe
2004-01-25 04:00 . 2004-01-25 04:00 70656 --sha-r c:\windows\system32\yv12vfw.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 1460560]
"AOL Fast Start"="c:\program files\AOL 9.1\AOL.EXE" [2007-10-27 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HostManager"="c:\program files\Common Files\AOL\1194992387\ee\AOLSoftware.exe" [2008-06-24 41824]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-12-21 185896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-11 148888]
"Sunkist2k"="c:\program files\Multimedia Card Reader\shwicon2k.exe" [2003-10-29 135168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2003-04-04 50176]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2007-04-16 577536]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Auto Detect.lnk - c:\program files\iConcepts Music Express\MEAutoDetect.exe [2007-12-26 270336]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^.protected]
backup=c:\windows\pss\.protectedCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]
backup=c:\windows\pss\Compaq Connections.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Link2PC.lnk]
backup=c:\windows\pss\Link2PC.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MyRCI.lnk]
backup=c:\windows\pss\MyRCI.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^.protected]
backup=c:\windows\pss\.protectedStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^LaunchU3.exe.lnk]
backup=c:\windows\pss\LaunchU3.exe.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^TrueAssistant.lnk]
backup=c:\windows\pss\TrueAssistant.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"McShield"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1194992387\\ee\\aolsoftware.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqdstcp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\ABBYY FineReader 5.0 Sprint\\Sprint.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\AOL 9.1\\waol.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Namo\\WebEditor 2006\\bin\\WebEditor.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 e583e861;e583e861; [x]
R3 s3chipid;s3chipid; [x]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 ICAM3NT5;Intel USB Video Camera III;c:\windows\system32\Drivers\Icam3.sys [2001-08-17 141056]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-04-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-04-30 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-13 21:04]

2009-04-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-10-07 17:32]

2009-04-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-10-07 17:32]

2009-04-30 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2007-08-02 16:20]

2009-04-23 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2007-08-02 16:20]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/ig?hl=en
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost;*.local
IE: &search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6BAB93B7-1917-4214-A7D2-874FA6DB4740} - hxxp://pictures.aolcdn.com/ap/Resources/1.2.0.38b/cab/aolpPlugins.10.1.0.0.cab
DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} - hxxp://aolsvc.aol.com/onlinegames/dinerdash/DinerDash.1.0.0.72.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\3lxmc16f.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - component: c:\program files\Mozilla Firefox\extensions\[email protected]\components\Shim.dll
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\plugins\NPAbacheck.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-29 22:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3856)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\hnetcfg.dll
c:\program files\ArcSoft\Software Suite\PhotoImpression 5\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\AOL\acs\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\CA\PPRT\bin\ITMRTSVC.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\McAfee\MPF\MpfSrv.exe
c:\program files\AOL 9.1\waol.exe
c:\windows\system32\ZuneBusEnum.exe
c:\progra~1\McAfee.com\Agent\mcagent.exe
c:\program files\Zune\ZuneNss.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\progra~1\McAfee\MSC\mcuimgr.exe
c:\program files\AOL 9.1\shellmon.exe
c:\program files\McAfee\VirusScan\Mcshield.exe
.
**************************************************************************
.
Completion time: 2009-04-30 22:18 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-30 02:17

Pre-Run: 29,268,217,856 bytes free
Post-Run: 30,378,090,496 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=,1,2,3,4
296

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-04-29 21:50:05
Windows 5.1.2600 Service Pack 3

---- System - GMER 1.0.15 ----

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xF54BA9AA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateKey [0xF54BAA41]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xF54BA958]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xF54BA96C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xF54BAA55]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xF54BAA81]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xF54BAAEF]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xF54BAAD9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xF54BA9EA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xF54BAB1B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xF54BAA2D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xF54BA930]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xF54BA944]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xF54BA9BE]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xF54BAB57]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xF54BAAC3]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xF54BAAAD]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xF54BAA6B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xF54BAB43]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xF54BAB2F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xF54BA996]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xF54BA982]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetValueKey [0xF54BAA97]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xF54BAA19]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xF54BAB05]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xF54BAA00]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xF54BA9D4]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

---- EOF - GMER 1.0.15 ----

GooredFix v1.92 by jpshortstuff
Log created at 21:40 on 29/04/2009 running Option #1 (Owner)
Firefox version 3.0.10 (en-US)

=====Suspect Goored Entries=====

C:\Program Files\Mozilla Firefox\extensions\{CC929838-C203-4D1C-8611-4C9535AD2AE2}

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[email protected]"="C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[email protected]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{ABDE892B-13A8-4d1b-88E6-365A6E755758}"="C:\Program Files\Real\RealPlayer\browserrecord"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{3112ca9c-de6d-4884-a869-9855de68056c}"="C:\Documents and Settings\All Users\Application Data\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c}"

#8
CatByte

Posted 30 April 2009 - 03:24 AM

GeekU Teacher

GeekU Moderator
2,705 posts

Hi,

Please do the following:

Please double-click GooredFix.exe on your Desktop to run it.

Select "2. Fix Goored" by typing 2 and pressing Enter.
Make sure all instances of Firefox are closed at this point.
Type y at the prompt and press Enter again.
A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

Note: If you receive a message saying that GooredFix needs your system to be restarted, please close all applications and reboot your system.
Please also allow any registry changes that may be prompted by any of your security programs.

NEXT

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

KillAll::

File::
c:\windows\system32\SelfDel.bat
c:\windows\twxdo01672.exe
c:\windows\lntak31610.exe
c:\windows\hjqvg20588.exe

Folder::
c:\documents and settings\Owner\Application Data\Privacy center
c:\program files\Privacy center
c:\windows\Crack Installer

Driver::
e583e861

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...

Posted Image

* Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
* ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
* When finished, it shall produce a log for you.
* Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NOTE: CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

#9
patfan4lif

Posted 30 April 2009 - 09:51 AM

Member

Topic Starter
Member
78 posts

I believe these are what you want:

GooredFix v1.92 by jpshortstuff
Log created at 11:29 on 30/04/2009 running Option #2 (Owner)
Firefox version 3.0.10 (en-US)

=====Goored Deletions=====
C:\Program Files\Mozilla Firefox\extensions\{CC929838-C203-4D1C-8611-4C9535AD2AE2}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[email protected]"="C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[email protected]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{ABDE892B-13A8-4d1b-88E6-365A6E755758}"="C:\Program Files\Real\RealPlayer\browserrecord"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{3112ca9c-de6d-4884-a869-9855de68056c}"="C:\Documents and Settings\All Users\Application Data\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c}"

ComboFix 09-04-29.01 - Owner 04/30/2009 11:37.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.462 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
FW: McAfee Personal Firewall *enabled*
.

((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-4-30 )))))))))))))))))))))))))))))))
.

2009-04-30 01:02 . 2009-04-30 01:02 -------- d-----w C:\_OTListIt
2009-04-29 21:02 . 2009-04-29 21:03 -------- d-----w C:\Rooter$
2009-04-29 02:36 . 2009-04-29 02:36 -------- d-----w c:\program files\ERUNT
2009-04-22 20:18 . 2009-04-22 20:18 -------- d-----w c:\documents and settings\Administrator.DELUCA\Local Settings\Application Data\Google
2009-04-17 23:44 . 2009-04-17 23:44 -------- d-sh--w c:\windows\system32\config\systemprofile\IETldCache
2009-04-17 21:21 . 2009-04-17 21:21 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-04-17 20:57 . 2009-04-17 20:57 -------- d-sh--w c:\documents and settings\Owner\IECompatCache
2009-04-17 20:56 . 2009-04-17 20:56 -------- d-sh--w c:\documents and settings\Owner\PrivacIE
2009-04-17 20:54 . 2009-04-17 20:54 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-04-17 20:51 . 2009-04-17 20:51 -------- d-sh--w c:\documents and settings\Owner\IETldCache
2009-04-17 20:42 . 2009-02-20 18:09 78336 ----a-w c:\windows\system32\ieencode.dll
2009-04-17 20:42 . 2009-02-20 18:09 78336 ----a-w c:\windows\system32\dllcache\ieencode.dll
2009-04-16 23:45 . 2009-04-16 23:45 -------- d-----w c:\documents and settings\Owner\Application Data\McAfee
2009-04-15 23:54 . 2009-04-27 12:07 -------- d-----w C:\HP LJ P4010 Series Printer
2009-04-15 23:45 . 1998-01-23 16:04 362772 ----a-w c:\windows\ISUN16.EXE
2009-04-15 23:45 . 1995-07-13 21:43 26768 ----a-w c:\windows\system\CTL3D.DLL
2009-04-15 23:33 . 2009-04-15 23:33 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\PC_Drivers_Headquarters
2009-04-15 23:29 . 2009-04-15 23:29 -------- d-----w c:\program files\PC Drivers HeadQuarters
2009-04-15 23:03 . 2009-04-15 23:08 -------- d-----w c:\documents and settings\Owner\DoctorWeb
2009-04-15 22:37 . 2009-04-15 22:37 -------- d-----w C:\VundoFix Backups
2009-04-15 18:43 . 2009-04-15 18:43 -------- d-----w c:\documents and settings\Owner\Application Data\Xilisoft Corporation
2009-04-15 18:43 . 2009-04-15 18:43 -------- d-----w c:\program files\Xilisoft
2009-04-15 18:36 . 2009-04-15 18:36 -------- d-----w c:\documents and settings\Owner\Application Data\dBpoweramp
2009-04-15 18:28 . 2009-04-15 18:28 155 ----a-w c:\windows\system32\SelfDel.bat
2009-04-15 18:18 . 2009-04-15 18:18 -------- d-----w c:\documents and settings\Owner\Application Data\AccurateRip
2009-04-15 18:18 . 2009-04-15 18:18 14373 ----a-w c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2009-04-15 18:18 . 2009-04-15 18:17 5433520 ----a-w c:\windows\system32\SpoonUninstall.exe
2009-04-15 18:18 . 2009-04-15 18:18 -------- d-----w c:\program files\Illustrate
2009-04-15 18:02 . 2009-04-15 18:02 -------- dc----w c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
2009-04-15 14:01 . 2009-04-15 14:07 -------- d-----w c:\documents and settings\Owner\Application Data\COWON
2009-04-15 08:56 . 2009-04-15 08:56 74240 ----a-w c:\windows\system32\zlib.dll
2009-04-15 03:34 . 2009-04-15 03:35 -------- d-----w c:\program files\setups
2009-04-15 03:34 . 2009-04-15 03:34 -------- d-----w c:\program files\f3setupinstall2
2009-04-15 03:34 . 2009-04-15 03:34 868352 ----a-w c:\windows\system32\hlidelnk.exe
2009-04-15 03:34 . 2009-04-15 03:34 386048 ----a-w c:\windows\twxdo01672.exe
2009-04-15 03:34 . 2009-04-15 03:34 32768 ----a-w c:\windows\lntak31610.exe
2009-04-15 03:21 . 2009-04-15 03:21 -------- d-----w c:\windows\Crack Installer
2009-04-15 03:20 . 2009-04-15 03:20 716925 ----a-w c:\windows\hjqvg20588.exe
2009-04-15 03:16 . 2009-04-16 02:11 -------- d-----w c:\documents and settings\Owner\Application Data\BitDownload
2009-04-15 03:07 . 2009-04-15 03:07 -------- d-----w c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-04-15 03:07 . 2009-04-15 03:07 -------- d-----w c:\documents and settings\Owner\Application Data\NCH Swift Sound
2009-04-15 02:58 . 2009-04-15 03:02 -------- d-----w c:\program files\FixTunes
2009-04-14 20:52 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-04-13 16:16 . 2009-04-13 16:16 694272 ----a-w c:\windows\system32\nsk897.dll
2009-04-01 01:56 . 2009-04-01 01:56 -------- d-----w c:\documents and settings\Owner\Application Data\Privacy center
2009-04-01 01:56 . 2009-04-01 15:31 -------- d-----w c:\program files\Privacy center

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-29 21:49 . 2004-12-18 19:38 116936 -c--a-w c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-29 02:34 . 2008-10-05 01:59 -------- d-----w c:\program files\AVS4YOU
2009-04-29 02:34 . 2008-10-05 01:59 -------- d-----w c:\program files\Common Files\AVSMedia
2009-04-25 14:44 . 2004-01-26 12:22 -------- d-----w c:\program files\Common Files\Adobe
2009-04-22 20:18 . 2005-01-08 15:30 -------- d-----w c:\program files\Google
2009-04-18 00:23 . 2005-01-09 19:40 -------- d-----w c:\program files\exPressit S.E. 2.1
2009-04-17 21:07 . 2008-01-18 01:03 -------- d-----w c:\program files\HP
2009-04-16 23:38 . 2007-10-07 22:39 -------- d-----w c:\program files\McAfee
2009-04-15 23:50 . 2004-01-26 12:22 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-25 20:42 . 2009-03-25 20:39 -------- d-----w c:\program files\Canon
2009-03-25 20:38 . 2009-03-25 20:38 -------- d-----w c:\program files\Common Files\Canon
2009-03-22 03:40 . 2007-11-13 22:19 -------- d-----w c:\program files\AOL 9.1
2009-03-22 01:00 . 2007-05-15 20:42 -------- d-----w c:\program files\Verizon
2009-03-11 13:00 . 2008-12-27 20:02 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-11 04:25 . 2009-03-11 04:25 56 ---ha-w c:\windows\system32\ezsidmv.dat
2009-03-09 22:08 . 2008-12-04 00:20 -------- d-----w c:\program files\Namo
2009-03-07 13:44 . 2009-02-28 18:15 -------- d-----w c:\program files\Rugrats Activity Challenge
2009-03-06 14:22 . 2004-02-04 18:37 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2005-10-21 20:51 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-09 12:10 . 2004-02-04 19:12 729088 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2005-07-26 04:31 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2004-02-04 19:09 617472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-01-26 08:10 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 11:13 . 2004-01-26 08:11 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-07 23:02 . 2002-08-29 08:04 2066048 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 21:38 . 2009-01-14 23:15 139671 ----a-w c:\windows\hpoins15.dat
2009-02-06 11:11 . 2004-02-04 18:37 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 2004-01-26 08:10 2189056 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2004-02-04 18:37 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:59 . 2004-02-04 18:37 56832 ----a-w c:\windows\system32\secur32.dll
2006-09-20 20:00 . 2006-09-20 20:00 774144 -c--a-w c:\program files\RngInterstitial.dll
2005-05-13 21:12 . 2005-05-13 21:12 217073 -csha-r c:\windows\meta4.exe
2005-10-24 15:13 . 2005-10-24 15:13 66560 -csha-r c:\windows\MOTA113.exe
2005-10-14 01:27 . 2005-10-14 01:27 422400 -csha-r c:\windows\x2.64.exe
2005-01-08 00:16 . 2005-01-07 22:16 0 -csha-w c:\windows\SMINST\HPCD.sys
2008-11-04 14:50 . 2008-11-04 14:06 88 --sh--r c:\windows\system32\A0AECBFCA9.sys
2005-10-07 23:14 . 2005-10-07 23:14 308224 -csha-r c:\windows\system32\avisynth.dll
2005-07-14 16:31 . 2005-07-14 16:31 27648 -csha-r c:\windows\system32\AVSredirect.dll
2005-06-26 19:32 . 2005-06-26 19:32 616448 -csha-r c:\windows\system32\cygwin1.dll
2005-06-22 02:37 . 2005-06-22 02:37 45568 -csha-r c:\windows\system32\cygz.dll
2004-01-25 04:00 . 2004-01-25 04:00 70656 -csha-r c:\windows\system32\i420vfw.dll
2008-11-09 00:49 . 2008-11-04 14:06 3350 --sha-w c:\windows\system32\KGyGaAvL.sys
2006-04-27 14:24 . 2006-04-27 14:24 2945024 -csha-r c:\windows\system32\Smab.dll
2005-02-28 17:16 . 2005-02-28 17:16 240128 -csha-r c:\windows\system32\x.264.exe
2004-01-25 04:00 . 2004-01-25 04:00 70656 --sha-r c:\windows\system32\yv12vfw.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 1460560]
"AOL Fast Start"="c:\program files\AOL 9.1\AOL.EXE" [2007-10-27 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HostManager"="c:\program files\Common Files\AOL\1194992387\ee\AOLSoftware.exe" [2008-06-24 41824]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-12-21 185896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-11 148888]
"Sunkist2k"="c:\program files\Multimedia Card Reader\shwicon2k.exe" [2003-10-29 135168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2003-04-04 50176]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2007-04-16 577536]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Auto Detect.lnk - c:\program files\iConcepts Music Express\MEAutoDetect.exe [2007-12-26 270336]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^.protected]
backup=c:\windows\pss\.protectedCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]
backup=c:\windows\pss\Compaq Connections.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Link2PC.lnk]
backup=c:\windows\pss\Link2PC.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MyRCI.lnk]
backup=c:\windows\pss\MyRCI.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^.protected]
backup=c:\windows\pss\.protectedStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^LaunchU3.exe.lnk]
backup=c:\windows\pss\LaunchU3.exe.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^TrueAssistant.lnk]
backup=c:\windows\pss\TrueAssistant.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"McShield"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1194992387\\ee\\aolsoftware.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqdstcp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\ABBYY FineReader 5.0 Sprint\\Sprint.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\AOL 9.1\\waol.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Namo\\WebEditor 2006\\bin\\WebEditor.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 e583e861;e583e861; [x]
R3 s3chipid;s3chipid; [x]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 ICAM3NT5;Intel USB Video Camera III;c:\windows\system32\Drivers\Icam3.sys [2001-08-17 141056]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-04-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-04-30 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-13 21:04]

2009-04-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-10-07 17:32]

2009-04-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-10-07 17:32]

2009-04-30 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2007-08-02 16:20]

2009-04-30 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2007-08-02 16:20]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/ig?hl=en
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost;*.local
IE: &search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6BAB93B7-1917-4214-A7D2-874FA6DB4740} - hxxp://pictures.aolcdn.com/ap/Resources/1.2.0.38b/cab/aolpPlugins.10.1.0.0.cab
DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} - hxxp://aolsvc.aol.com/onlinegames/dinerdash/DinerDash.1.0.0.72.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\3lxmc16f.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - component: c:\program files\Mozilla Firefox\extensions\[email protected]\components\Shim.dll
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\plugins\NPAbacheck.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-30 11:42
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3392)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\hnetcfg.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-04-30 11:45
ComboFix-quarantined-files.txt 2009-04-30 15:44
ComboFix2.txt 2009-04-30 02:18

Pre-Run: 30,326,448,128 bytes free
Post-Run: 30,246,789,120 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=,1,2,3,4
240 --- E O F --- 2009-04-30 07:05

#10
CatByte

Posted 30 April 2009 - 10:45 AM

GeekU Teacher

GeekU Moderator
2,705 posts

Hi,

The goored fix worked, but the combofix run did not.

Can you please try that script again,

make sure you only copy the text inside the code box and name it as instructed and drag the text into the combo fix program as shown.

if you have any difficulty or there are any error messages received, please advise.

Thanks

CB

#11
patfan4lif

Posted 30 April 2009 - 01:52 PM

Member

Topic Starter
Member
78 posts

How is this one?

ComboFix 09-04-29.01 - Owner 04/30/2009 15:27.8 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.430 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
FW: McAfee Personal Firewall *enabled*
* Created a new restore point

FILE ::
c:\windows\hjqvg20588.exe
c:\windows\lntak31610.exe
c:\windows\system32\SelfDel.bat
c:\windows\twxdo01672.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\Application Data\Privacy center
c:\documents and settings\Owner\Application Data\Privacy center\dbases\cg.dat
c:\documents and settings\Owner\Application Data\Privacy center\dbases\mw.dat
c:\documents and settings\Owner\Application Data\Privacy center\dbases\rd.dat
c:\documents and settings\Owner\Application Data\Privacy center\dbases\sc.dat
c:\documents and settings\Owner\Application Data\Privacy center\dbases\sm.dat
c:\documents and settings\Owner\Application Data\Privacy center\dbases\sp.dat
c:\documents and settings\Owner\Application Data\Privacy center\keys\cg.key
c:\documents and settings\Owner\Application Data\Privacy center\keys\rd.key
c:\documents and settings\Owner\Application Data\Privacy center\keys\sc.key
c:\documents and settings\Owner\Application Data\Privacy center\keys\sp.key
c:\documents and settings\Owner\Application Data\Privacy center\temp\settings.ini
c:\documents and settings\Owner\Application Data\Privacy center\temp\spfilter
c:\program files\Privacy center
c:\program files\Privacy center\tools\sp\spbho.dll
c:\windows\Crack Installer
c:\windows\Crack Installer\uninstall.exe
c:\windows\hjqvg20588.exe
c:\windows\lntak31610.exe
c:\windows\system32\SelfDel.bat
c:\windows\twxdo01672.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_e583e861

((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-4-30 )))))))))))))))))))))))))))))))
.

2009-04-30 01:02 . 2009-04-30 01:02 -------- d-----w C:\_OTListIt
2009-04-29 21:02 . 2009-04-30 19:23 -------- d-----w C:\Rooter$
2009-04-29 02:36 . 2009-04-29 02:36 -------- d-----w c:\program files\ERUNT
2009-04-22 20:18 . 2009-04-22 20:18 -------- d-----w c:\documents and settings\Administrator.DELUCA\Local Settings\Application Data\Google
2009-04-17 23:44 . 2009-04-17 23:44 -------- d-sh--w c:\windows\system32\config\systemprofile\IETldCache
2009-04-17 21:21 . 2009-04-17 21:21 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-04-17 20:57 . 2009-04-17 20:57 -------- d-sh--w c:\documents and settings\Owner\IECompatCache
2009-04-17 20:56 . 2009-04-17 20:56 -------- d-sh--w c:\documents and settings\Owner\PrivacIE
2009-04-17 20:54 . 2009-04-17 20:54 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-04-17 20:51 . 2009-04-17 20:51 -------- d-sh--w c:\documents and settings\Owner\IETldCache
2009-04-17 20:42 . 2009-02-20 18:09 78336 ----a-w c:\windows\system32\ieencode.dll
2009-04-17 20:42 . 2009-02-20 18:09 78336 ----a-w c:\windows\system32\dllcache\ieencode.dll
2009-04-16 23:45 . 2009-04-16 23:45 -------- d-----w c:\documents and settings\Owner\Application Data\McAfee
2009-04-15 23:54 . 2009-04-27 12:07 -------- d-----w C:\HP LJ P4010 Series Printer
2009-04-15 23:45 . 1998-01-23 16:04 362772 ----a-w c:\windows\ISUN16.EXE
2009-04-15 23:45 . 1995-07-13 21:43 26768 ----a-w c:\windows\system\CTL3D.DLL
2009-04-15 23:33 . 2009-04-15 23:33 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\PC_Drivers_Headquarters
2009-04-15 23:29 . 2009-04-15 23:29 -------- d-----w c:\program files\PC Drivers HeadQuarters
2009-04-15 23:03 . 2009-04-15 23:08 -------- d-----w c:\documents and settings\Owner\DoctorWeb
2009-04-15 22:37 . 2009-04-15 22:37 -------- d-----w C:\VundoFix Backups
2009-04-15 18:43 . 2009-04-15 18:43 -------- d-----w c:\documents and settings\Owner\Application Data\Xilisoft Corporation
2009-04-15 18:43 . 2009-04-15 18:43 -------- d-----w c:\program files\Xilisoft
2009-04-15 18:36 . 2009-04-15 18:36 -------- d-----w c:\documents and settings\Owner\Application Data\dBpoweramp
2009-04-15 18:18 . 2009-04-15 18:18 -------- d-----w c:\documents and settings\Owner\Application Data\AccurateRip
2009-04-15 18:18 . 2009-04-15 18:18 14373 ----a-w c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2009-04-15 18:18 . 2009-04-15 18:17 5433520 ----a-w c:\windows\system32\SpoonUninstall.exe
2009-04-15 18:18 . 2009-04-15 18:18 -------- d-----w c:\program files\Illustrate
2009-04-15 18:02 . 2009-04-15 18:02 -------- dc----w c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
2009-04-15 14:01 . 2009-04-15 14:07 -------- d-----w c:\documents and settings\Owner\Application Data\COWON
2009-04-15 08:56 . 2009-04-15 08:56 74240 ----a-w c:\windows\system32\zlib.dll
2009-04-15 03:34 . 2009-04-15 03:35 -------- d-----w c:\program files\setups
2009-04-15 03:34 . 2009-04-15 03:34 -------- d-----w c:\program files\f3setupinstall2
2009-04-15 03:34 . 2009-04-15 03:34 868352 ----a-w c:\windows\system32\hlidelnk.exe
2009-04-15 03:16 . 2009-04-16 02:11 -------- d-----w c:\documents and settings\Owner\Application Data\BitDownload
2009-04-15 03:07 . 2009-04-15 03:07 -------- d-----w c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-04-15 03:07 . 2009-04-15 03:07 -------- d-----w c:\documents and settings\Owner\Application Data\NCH Swift Sound
2009-04-15 02:58 . 2009-04-15 03:02 -------- d-----w c:\program files\FixTunes
2009-04-14 20:52 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-04-13 16:16 . 2009-04-13 16:16 694272 ----a-w c:\windows\system32\nsk897.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-29 21:49 . 2004-12-18 19:38 116936 -c--a-w c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-29 02:34 . 2008-10-05 01:59 -------- d-----w c:\program files\AVS4YOU
2009-04-29 02:34 . 2008-10-05 01:59 -------- d-----w c:\program files\Common Files\AVSMedia
2009-04-25 14:44 . 2004-01-26 12:22 -------- d-----w c:\program files\Common Files\Adobe
2009-04-22 20:18 . 2005-01-08 15:30 -------- d-----w c:\program files\Google
2009-04-18 00:23 . 2005-01-09 19:40 -------- d-----w c:\program files\exPressit S.E. 2.1
2009-04-17 21:07 . 2008-01-18 01:03 -------- d-----w c:\program files\HP
2009-04-16 23:38 . 2007-10-07 22:39 -------- d-----w c:\program files\McAfee
2009-04-15 23:50 . 2004-01-26 12:22 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-25 20:42 . 2009-03-25 20:39 -------- d-----w c:\program files\Canon
2009-03-25 20:38 . 2009-03-25 20:38 -------- d-----w c:\program files\Common Files\Canon
2009-03-22 03:40 . 2007-11-13 22:19 -------- d-----w c:\program files\AOL 9.1
2009-03-22 01:00 . 2007-05-15 20:42 -------- d-----w c:\program files\Verizon
2009-03-11 13:00 . 2008-12-27 20:02 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-11 04:25 . 2009-03-11 04:25 56 ---ha-w c:\windows\system32\ezsidmv.dat
2009-03-09 22:08 . 2008-12-04 00:20 -------- d-----w c:\program files\Namo
2009-03-07 13:44 . 2009-02-28 18:15 -------- d-----w c:\program files\Rugrats Activity Challenge
2009-03-06 14:22 . 2004-02-04 18:37 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2005-10-21 20:51 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-09 12:10 . 2004-02-04 19:12 729088 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2005-07-26 04:31 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2004-02-04 19:09 617472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-01-26 08:10 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 11:13 . 2004-01-26 08:11 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-07 23:02 . 2002-08-29 08:04 2066048 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 21:38 . 2009-01-14 23:15 139671 ----a-w c:\windows\hpoins15.dat
2009-02-06 11:11 . 2004-02-04 18:37 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 2004-01-26 08:10 2189056 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2004-02-04 18:37 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:59 . 2004-02-04 18:37 56832 ----a-w c:\windows\system32\secur32.dll
2006-09-20 20:00 . 2006-09-20 20:00 774144 -c--a-w c:\program files\RngInterstitial.dll
2005-05-13 21:12 . 2005-05-13 21:12 217073 -csha-r c:\windows\meta4.exe
2005-10-24 15:13 . 2005-10-24 15:13 66560 -csha-r c:\windows\MOTA113.exe
2005-10-14 01:27 . 2005-10-14 01:27 422400 -csha-r c:\windows\x2.64.exe
2005-01-08 00:16 . 2005-01-07 22:16 0 -csha-w c:\windows\SMINST\HPCD.sys
2008-11-04 14:50 . 2008-11-04 14:06 88 --sh--r c:\windows\system32\A0AECBFCA9.sys
2005-10-07 23:14 . 2005-10-07 23:14 308224 -csha-r c:\windows\system32\avisynth.dll
2005-07-14 16:31 . 2005-07-14 16:31 27648 -csha-r c:\windows\system32\AVSredirect.dll
2005-06-26 19:32 . 2005-06-26 19:32 616448 -csha-r c:\windows\system32\cygwin1.dll
2005-06-22 02:37 . 2005-06-22 02:37 45568 -csha-r c:\windows\system32\cygz.dll
2004-01-25 04:00 . 2004-01-25 04:00 70656 -csha-r c:\windows\system32\i420vfw.dll
2008-11-09 00:49 . 2008-11-04 14:06 3350 --sha-w c:\windows\system32\KGyGaAvL.sys
2006-04-27 14:24 . 2006-04-27 14:24 2945024 -csha-r c:\windows\system32\Smab.dll
2005-02-28 17:16 . 2005-02-28 17:16 240128 -csha-r c:\windows\system32\x.264.exe
2004-01-25 04:00 . 2004-01-25 04:00 70656 --sha-r c:\windows\system32\yv12vfw.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-04-30_15.42.09 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-21 02:44 . 2009-04-30 19:33 32768 c:\windows\Temp\Temporary Internet Files\Content.IE5\index.dat
- 2007-12-21 02:44 . 2009-04-30 02:03 32768 c:\windows\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2009-04-30 19:33 . 2009-04-30 19:33 16384 c:\windows\Temp\Perflib_Perfdata_1d8.dat
- 2007-12-21 02:44 . 2009-04-30 02:03 16384 c:\windows\Temp\History\History.IE5\index.dat
+ 2007-12-21 02:44 . 2009-04-30 19:33 16384 c:\windows\Temp\History\History.IE5\index.dat
- 2007-12-21 02:44 . 2009-04-30 02:03 16384 c:\windows\Temp\Cookies\index.dat
+ 2007-12-21 02:44 . 2009-04-30 19:33 16384 c:\windows\Temp\Cookies\index.dat
+ 2004-01-26 09:31 . 2009-04-30 18:55 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2004-01-26 09:31 . 2009-04-30 14:35 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2004-01-26 09:31 . 2009-04-30 14:35 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2004-01-26 09:31 . 2009-04-30 18:55 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 1460560]
"AOL Fast Start"="c:\program files\AOL 9.1\AOL.EXE" [2007-10-27 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HostManager"="c:\program files\Common Files\AOL\1194992387\ee\AOLSoftware.exe" [2008-06-24 41824]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-12-21 185896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-11 148888]
"Sunkist2k"="c:\program files\Multimedia Card Reader\shwicon2k.exe" [2003-10-29 135168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2003-04-04 50176]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2007-04-16 577536]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Auto Detect.lnk - c:\program files\iConcepts Music Express\MEAutoDetect.exe [2007-12-26 270336]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^.protected]
backup=c:\windows\pss\.protectedCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]
backup=c:\windows\pss\Compaq Connections.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Link2PC.lnk]
backup=c:\windows\pss\Link2PC.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MyRCI.lnk]
backup=c:\windows\pss\MyRCI.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^.protected]
backup=c:\windows\pss\.protectedStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^LaunchU3.exe.lnk]
backup=c:\windows\pss\LaunchU3.exe.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^TrueAssistant.lnk]
backup=c:\windows\pss\TrueAssistant.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"McShield"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1194992387\\ee\\aolsoftware.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqdstcp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\ABBYY FineReader 5.0 Sprint\\Sprint.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\AOL 9.1\\waol.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Namo\\WebEditor 2006\\bin\\WebEditor.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 s3chipid;s3chipid; [x]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 ICAM3NT5;Intel USB Video Camera III;c:\windows\system32\Drivers\Icam3.sys [2001-08-17 141056]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-04-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-04-30 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-13 21:04]

2009-04-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-10-07 17:32]

2009-04-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-10-07 17:32]

2009-04-30 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2007-08-02 16:20]

2009-04-30 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2007-08-02 16:20]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/ig?hl=en
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost;*.local
IE: &search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6BAB93B7-1917-4214-A7D2-874FA6DB4740} - hxxp://pictures.aolcdn.com/ap/Resources/1.2.0.38b/cab/aolpPlugins.10.1.0.0.cab
DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} - hxxp://aolsvc.aol.com/onlinegames/dinerdash/DinerDash.1.0.0.72.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\3lxmc16f.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - component: c:\program files\Mozilla Firefox\extensions\[email protected]\components\Shim.dll
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\plugins\NPAbacheck.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-30 15:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1796)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\hnetcfg.dll
c:\program files\ArcSoft\Software Suite\PhotoImpression 5\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\AOL\acs\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\CA\PPRT\bin\ITMRTSVC.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\McAfee\MPF\MpfSrv.exe
c:\windows\system32\ZuneBusEnum.exe
c:\program files\Zune\ZuneNss.exe
c:\progra~1\McAfee.com\Agent\mcagent.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\AOL 9.1\waol.exe
c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\AOL 9.1\shellmon.exe
c:\program files\McAfee\VirusScan\Mcshield.exe
.
**************************************************************************
.
Completion time: 2009-04-30 15:46 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-30 19:45
ComboFix2.txt 2009-04-30 15:45
ComboFix3.txt 2009-04-30 02:18

Pre-Run: 30,204,735,488 bytes free
Post-Run: 30,207,041,536 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=,1,2,3,4
306 --- E O F --- 2009-04-30 07:05

#12
CatByte

Posted 30 April 2009 - 02:37 PM

GeekU Teacher

GeekU Moderator
2,705 posts

Hi,

That was much better,

please do the following:

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <-- very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

In your next reply please include

MBAM Log
Kaspersky report

#13
patfan4lif

Posted 30 April 2009 - 08:19 PM

Member

Topic Starter
Member
78 posts

My problem with the browser seems to be corrected. Kaspersky scan took 4hrs. with no crash of Firefox.

Here are the logs:

Malwarebytes' Anti-Malware 1.36
Database version: 2062
Windows 5.1.2600 Service Pack 3

4/30/2009 5:00:41 PM
mbam-log-2009-04-30 (17-00-41).txt

Scan type: Quick Scan
Objects scanned: 111531
Time elapsed: 9 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{255c13ae-4bb0-45c3-bae1-ba6c088c43b3} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8fbb0d9a-1f7b-465b-8292-1593b880e92a} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d97fc677-694d-4a75-ac89-a5b85c2bcfed} (Adware.BullseyeToolbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\runit (Adware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Thursday, April 30, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Thursday, April 30, 2009 23:33:41
Records in database: 2115319
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
N:\
O:\

Scan statistics:
Files scanned: 128977
Threat name: 6
Infected objects: 9
Suspicious objects: 0
Duration of the scan: 04:54:25

File name / Threat name / Threats count
C:\Documents and Settings\Owner\.housecall\Quarantine\jar.jar-521c4f7f-18a3fb97.zip.bac_a02420 Infected: Trojan.Java.Femad 4
C:\Documents and Settings\Owner\.housecall\Quarantine\jar.jar-521c4f7f-18a3fb97.zip.bac_a02420 Infected: Trojan.Win32.Small.ev 1
C:\Documents and Settings\Owner\.housecall\Quarantine\SearchRelevancy1.dll.bac_a02420 Infected: not-a-virus:AdWare.Win32.Relevance.b 1
C:\Documents and Settings\Owner\My Documents\BitDownload\Cowon Jet Audio 7.1.1.3101 Plus VX\fo-j711.rar Infected: Trojan.Win32.Buzus.ryd 1
C:\Program Files\f3setupinstall2\F3EZSETP.DLL Infected: not-a-virus:AdWare.Win32.FunWeb.q 1
C:\WINDOWS\system32\hlidelnk.exe Infected: Trojan-Downloader.Win32.VB.lre 1

The selected area was scanned.

#14
CatByte

Posted 30 April 2009 - 08:30 PM

GeekU Teacher

GeekU Moderator
2,705 posts

Hi,

Please do the following

Please download OTMoveIt3 by OldTimer.

Save it to your desktop.
Please click OTMoveIt3 and then click >> run.
Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Files
C:\Documents and Settings\Owner\My Documents\BitDownload\Cowon Jet Audio 7.1.1.3101 Plus VX\fo-j711.rar 
C:\WINDOWS\system32\hlidelnk.exe 

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTMoveIt3, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

NEXT

Please post a fresh OTListIt2 Log with the OTMoveIt3 log

#15
patfan4lif

Posted 30 April 2009 - 08:51 PM

Member

Topic Starter
Member
78 posts

Here it is:

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\Documents and Settings\Owner\My Documents\BitDownload\Cowon Jet Audio 7.1.1.3101 Plus VX\fo-j711.rar moved successfully.
C:\WINDOWS\system32\hlidelnk.exe moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\hsperfdata_Owner\1820 scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\etilqs_hmYEENFOBID0FhweFdZH scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Network Service Temp folder emptied.
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Cookies\index.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_EVYffc1hXwHBmXe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_pwTZJiyDhLRS1Uu scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_UOe4j7tt8xqZndh scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_1d8.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\WFV5F0.tmp scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3lxmc16f.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3lxmc16f.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3lxmc16f.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3lxmc16f.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3lxmc16f.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04302009_223242

Files moved on Reboot...
File C:\DOCUME~1\Owner\LOCALS~1\Temp\hsperfdata_Owner\1820 not found!
File C:\DOCUME~1\Owner\LOCALS~1\Temp\etilqs_hmYEENFOBID0FhweFdZH not found!
C:\WINDOWS\temp\mcmsc_EVYffc1hXwHBmXe moved successfully.
File C:\WINDOWS\temp\mcmsc_pwTZJiyDhLRS1Uu not found!
File C:\WINDOWS\temp\mcmsc_UOe4j7tt8xqZndh not found!
File C:\WINDOWS\temp\Perflib_Perfdata_1d8.dat not found!
File C:\WINDOWS\temp\WFV5F0.tmp not found!
C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3lxmc16f.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3lxmc16f.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3lxmc16f.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3lxmc16f.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3lxmc16f.default\urlclassifier3.sqlite moved successfully.