So anyway, I was just watching some .avi files using Realplay, but one of them had the audio timing off, so I tried getting VirtualDUB to fix it, and ended up uninstalling it anyway. After that, I tried playing one of the .avi files (different from the one with the weird audio timing) and it gave me a "Class not registered" error. I also gave my hopes watching that .avi file.
In any case, after the watching, I've noticed that explorer.exe was taking too much time to load than normal (to the point of going in 'Not Responding' mode), and I don't know what caused it.
Microsoft Windows XP Professional (5.1.2600) Service Pack 2
A:\ [Removable] (Total:0 Mo/Free:0 Mo)
C:\ [Fixed] - NTFS - (Total:76308 Mo/Free:1042 Mo)
D:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)
E:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)
F:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)
G:\ [Removable] (Total:0 Mo/Free:0 Mo)
Mon 04/13/2009| 9:11
----------------------\\ Processes..
--Locked-- [System Process]
---------- System
---------- \SystemRoot\System32\smss.exe
---------- \??\C:\WINDOWS\system32\csrss.exe
---------- \??\C:\WINDOWS\system32\winlogon.exe
---------- C:\WINDOWS\system32\services.exe
---------- C:\WINDOWS\system32\lsass.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\spoolsv.exe
---------- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
---------- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
---------- C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
---------- C:\Program Files\iTunes\iTunesHelper.exe
---------- C:\Program Files\PowerISO\PWRISOVM.EXE
---------- C:\WINDOWS\system32\ctfmon.exe
---------- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
---------- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
---------- C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
---------- C:\Program Files\Bonjour\mDNSResponder.exe
---------- C:\WINDOWS\system32\HPZipm12.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\wdfmgr.exe
---------- C:\WINDOWS\system32\wuauclt.exe
---------- C:\PROGRA~1\AVG\AVG8\avgemc.exe
---------- C:\Program Files\iPod\bin\iPodService.exe
---------- C:\WINDOWS\System32\alg.exe
---------- C:\Program Files\Mozilla Firefox\firefox.exe
---------- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
---------- C:\WINDOWS\system32\rundll32.exe
---------- C:\WINDOWS\explorer.exe
---------- C:\Documents and Settings\Billy\Desktop\OTListIt2.exe
---------- C:\WINDOWS\system32\cmd.exe
---------- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avwsc.exe
----------
---------- C:\Rooter$\RK.exe
----------------------\\ Search..
Trojan ! .. c:\docume~1\billy\applic~1\intram~1\SectDoesEach.exe
----------------------\\ Tasks
C:\WINDOWS\tasks\A4D0D4079073516F.job
----------------------\\ ROOTKIT !!
----------------------\\ Cracks & Keygens..
C:\DOCUME~1\Billy\My Documents\Nikulet\important stuff\yahoo games\Dairy Dash\Dairy Dash-PreCracked- HIVBABY.exe
C:\DOCUME~1\Billy\Recent\How To Use The Crack.txt.lnk
1 - "C:\Rooter$\Rooter_1.txt" - Mon 04/13/2009| 9:19
----------------------\\ Scan completed at 9:19
OTListIt logfile created on: 4/13/2009 9:21:28 AM - Run 1
OTListIt2 by OldTimer - Version 2.0.14.0 Folder = C:\Documents and Settings\Billy\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
367.48 Mb Total Physical Memory | 96.00 Mb Available Physical Memory | 26.12% Memory free
889.20 Mb Paging File | 450.55 Mb Available in Paging File | 50.67% Paging File free
Paging file location(s): C:\pagefile.sys 368 368;
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 25.02 Gb Free Space | 33.57% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: RAGNAROK
Current User Name: Billy
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On
========== Processes (SafeList) ==========
PRC - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
PRC - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)
PRC - C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation)
PRC - C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Documents and Settings\Billy\Desktop\OTListIt2.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\Billy\Desktop\OTListIt2.exe (OldTimer Tools)
========== Win32 Services (SafeList) ==========
SRV - (aawservice [Disabled | Stopped]) -- C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (Lavasoft)
SRV - (ANIWZCSdService [Disabled | Stopped]) -- C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe (Alpha Networks Inc.)
SRV - (AntiVirScheduler [Auto | Running]) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
SRV - (AntiVirService [Auto | Running]) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
SRV - (Apple Mobile Device [Disabled | Running]) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (avg8emc [Disabled | Running]) -- C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg8wd [Disabled | Running]) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (Bonjour Service [Disabled | Running]) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (IDriverT [Disabled | Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (iPod Service [Disabled | Running]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (JavaQuickStarterService [Disabled | Stopped]) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (MDM [Disabled | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
SRV - (ose [Disabled | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (PCCare Premium [Disabled | Stopped]) -- File not found
SRV - (Pml Driver HPZ12 [Unknown | Running]) -- C:\WINDOWS\system32\HPZipm12.exe (HP)
SRV - (ServiceLayer [On_Demand | Stopped]) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (UMWdf [Auto | Running]) -- C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation)
SRV - (usnjsvc [Disabled | Stopped]) -- C:\Program Files\MSN Messenger\usnsvc.exe (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (Afc [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\Afc.sys (Arcsoft, Inc.)
DRV - (ANIO [Auto | Running]) -- C:\WINDOWS\System32\ANIO.SYS (Alpha Networks Inc.)
DRV - (avgio [System | Running]) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys (Avira GmbH)
DRV - (AvgLdx86 [System | Running]) -- C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86 [System | Running]) -- C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (avgntflt [On_Demand | Running]) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys (Avira GmbH)
DRV - (AvgTdiX [System | Running]) -- C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (avipbb [System | Running]) -- C:\WINDOWS\system32\DRIVERS\avipbb.sys (Avira GmbH)
DRV - (FsVga [System | Running]) -- C:\WINDOWS\system32\DRIVERS\fsvga.sys (Microsoft Corporation)
DRV - (gameenum [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\gameenum.sys (Microsoft Corporation)
DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (genmcmnUSB [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\gflmouhid.sys ()
DRV - (ltmodem5 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys (LT)
DRV - (ndiscm [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\NetMotCM.sys (Motorola Inc.)
DRV - (nm [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\NMnt.sys (Microsoft Corporation)
DRV - (nmwcd [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdc [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (pccsmcfd [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys (Nokia)
DRV - (phil2vid [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\philcam2.sys (Microsoft Corporation)
DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (RT73 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\Dr71WU.sys (Ralink Technology, Corp.)
DRV - (rtl8139 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\RTL8139.SYS (Realtek Semiconductor Corporation)
DRV - (S3SavageNB [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (SCDEmu [System | Running]) -- C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (ssmdrv [System | Running]) -- C:\WINDOWS\system32\DRIVERS\ssmdrv.sys (Avira GmbH)
DRV - (upperdev [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys (Windows ® Codename Longhorn DDK provider)
DRV - (usbaudio [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (usbser [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\usbser.sys (Microsoft Corporation)
DRV - (UsbserFilt [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys (Windows ® Codename Longhorn DDK provider)
DRV - (USB_RNDIS [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\usb8023.sys (Microsoft Corporation)
DRV - (VIAudio [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\ac97via.sys (VIA Technologies, Inc.)
DRV - (MBAMSwissArmy [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ph.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://aa.rd.yahoo.c...://ph.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://aa.rd.yahoo.c...://ph.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ph.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.c...rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://aa.rd.yahoo.c...://ph.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ph.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "AIM Search"
FF - prefs.js..browser.search.defaulturl: "http://slirsredirect...fftrie7&query="
FF - prefs.js..browser.search.selectedEngine: "AIM Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.0
FF - prefs.js..extensions.enabledItems: {dd3d7613-0246-469d-bc65-2a3cc1668adc}:0.7.1
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:1.0.0.685
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.8
FF - prefs.js..keyword.URL: "http://slirsredirect...0fftrab&query="
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\PROGRAM FILES\AVG\AVG8\FIREFOX [2009/02/01 06:25:23 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\DOCUMENTS AND SETTINGS\BILLY\MY DOCUMENTS\NIKULET\NOKIA\NOKIA PC SUITE 7\BKMRKSYNC\ [2009/01/23 18:53:11 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/01/27 10:18:10 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/12 19:07:54 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/04/13 07:58:57 | 00,000,000 | ---D | M]
[2008/08/27 03:26:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Billy\Application Data\mozilla\Extensions
[2008/08/27 03:26:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Billy\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/04/12 17:00:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Billy\Application Data\mozilla\Firefox\Profiles\anckyz74.default\extensions
[2008/06/27 19:15:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Billy\Application Data\mozilla\Firefox\Profiles\anckyz74.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}
[2009/03/28 19:16:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Billy\Application Data\mozilla\Firefox\Profiles\anckyz74.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2009/01/10 14:28:23 | 00,001,739 | ---- | M] () -- C:\Documents and Settings\Billy\Application Data\Mozilla\FireFox\Profiles\anckyz74.default\searchplugins\aim-search.xml
[2008/11/13 00:36:44 | 00,001,121 | ---- | M] () -- C:\Documents and Settings\Billy\Application Data\Mozilla\FireFox\Profiles\anckyz74.default\searchplugins\maple-story-auction-search.xml
[2009/04/12 17:00:39 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009/03/29 05:54:12 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/01/27 10:18:40 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2009/03/29 05:53:55 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/03/29 05:53:55 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/03/08 17:11:35 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/03/08 17:11:35 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/03/08 17:11:35 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/03/08 17:11:35 | 00,002,343 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/03/08 17:11:35 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/03/08 17:11:35 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/03/08 17:11:35 | 00,000,792 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml
O1 HOSTS File: (292053 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 10057 more lines...
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - Reg Error: Key error. File not found
O2 - BHO: (no name) - {03CF09F4-ED11-ECCC-4DC7-91BC1D7BB3CE} - Reg Error: Key error. File not found
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (IeCatch5 Class) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\Jccatch.dll (FlashGet)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {53777DFF-CA6D-91B0-6EEC-BC4EA7F39C99} - Reg Error: Key error. File not found
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - Reg Error: Key error. File not found
O2 - BHO: (no name) - {8DBC2F0D-C4B8-9E39-EF0F-BDBE3D7E659D} - Reg Error: Key error. File not found
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O2 - BHO: (no name) - {B41D6A0F-D8E8-8E6B-B36F-FE7A91B50D95} - Reg Error: Key error. File not found
O2 - BHO: (MSN Search Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {FA4EBDCB-002F-08AB-7B27-7AC2CA5246C1} - Reg Error: Key error. File not found
O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (FlashGet Bar) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll (Amaze Soft)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [SpybotDeletingA3395] command.com /c del "C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL" ()
O4 - HKLM..\RunOnce: [SpybotDeletingA3734] command.com /c del "C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.MANIFEST" ()
O4 - HKLM..\RunOnce: [SpybotDeletingA4111] command.com /c del "C:\Program Files\AskSBar\bar\1.bin\NPASKSBR.DLL" ()
O4 - HKLM..\RunOnce: [SpybotDeletingA5109] command.com /c del "C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.JAR" ()
O4 - HKLM..\RunOnce: [SpybotDeletingA8052] command.com /c del "C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL_old" ()
O4 - HKLM..\RunOnce: [SpybotDeletingA8167] command.com /c del "C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.JAR" ()
O4 - HKLM..\RunOnce: [SpybotDeletingA8243] command.com /c del "C:\Program Files\Mozilla Firefox\chrome\a2ffxtbr.jar" ()
O4 - HKLM..\RunOnce: [SpybotDeletingA8991] command.com /c del "C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.MANIFEST" ()
O4 - HKLM..\RunOnce: [SpybotDeletingA9642] command.com /c del "C:\Program Files\AskSBar\bar\1.bin\A2HIGHIN.EXE" ()
O4 - HKLM..\RunOnce: [SpybotDeletingC1591] cmd.exe /c del "C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.JAR" (Microsoft Corporation)
O4 - HKLM..\RunOnce: [SpybotDeletingC2236] cmd.exe /c del "C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.JAR" (Microsoft Corporation)
O4 - HKLM..\RunOnce: [SpybotDeletingC281] cmd.exe /c del "C:\Program Files\AskSBar\bar\1.bin\NPASKSBR.DLL" (Microsoft Corporation)
O4 - HKLM..\RunOnce: [SpybotDeletingC613] cmd.exe /c del "C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL" (Microsoft Corporation)
O4 - HKLM..\RunOnce: [SpybotDeletingC6636] cmd.exe /c del "C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL_old" (Microsoft Corporation)
O4 - HKLM..\RunOnce: [SpybotDeletingC7648] cmd.exe /c del "C:\Program Files\AskSBar\bar\1.bin\A2HIGHIN.EXE" (Microsoft Corporation)
O4 - HKLM..\RunOnce: [SpybotDeletingC7721] cmd.exe /c del "C:\Program Files\Mozilla Firefox\chrome\a2ffxtbr.jar" (Microsoft Corporation)
O4 - HKLM..\RunOnce: [SpybotDeletingC8669] cmd.exe /c del "C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.MANIFEST" (Microsoft Corporation)
O4 - HKLM..\RunOnce: [SpybotDeletingC9970] cmd.exe /c del "C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.MANIFEST" (Microsoft Corporation)
O4 - HKLM..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck (Safer Networking Limited)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html File not found
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm (Microsoft Corporation)
O8 - Extra context menu item: &Search - http://bar.mywebsear...?p=ZNxdm973YYUS File not found
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html File not found
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html File not found
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm ()
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm ()
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation)
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?45e02566a60146bc9db630a15de75488 (Microsoft Corporation)
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?45e02566a60146bc9db630a15de75488 (Microsoft Corporation)
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html File not found
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html File not found
O9 - Extra Button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)
O9 - Extra 'Tools' menuitem : &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [NWLink IPX/SPX/NetBIOS Compatible Transport Protocol] - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Sites: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] https in Trusted sites)
O15 - HKCU\..Trusted Domains: 51 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft....k/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {5334504D-9980-0010-8000-00AA00389B71} http://download.micr...44/mpg4sdmo.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\System32\msdxm.ocx ()
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (wucrtupd.dll) - File not found
O20 - AppInit_DLLs: (C:\WINDOWS\System32\wucrtupd.dll) - C:\WINDOWS\System32\wucrtupd.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\system32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O32 - Autorun File - C:\autorun.inf () - [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
========== Files/Folders - Created Within 30 Days ==========
[8 C:\WINDOWS\*.tmp files]
[2009/04/13 09:10:33 | 00,000,000 | ---D | C] -- C:\Rooter$
[2009/04/13 08:56:02 | 00,501,248 | ---- | C] (OldTimer Tools) -- C:\DOCUME~1\Billy\Desktop\OTListIt2.exe
[2009/04/13 08:55:31 | 00,267,612 | ---- | C] () -- C:\DOCUME~1\Billy\Desktop\Rooter.exe
[2009/04/13 08:05:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Billy\Application Data\Malwarebytes
[2009/04/13 08:04:57 | 00,000,696 | ---- | C] () -- C:\DOCUME~1\ALLUSE~1\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/04/13 08:04:52 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/04/13 08:04:45 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/13 08:04:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/04/13 08:04:29 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/04/13 08:01:01 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/04/08 18:58:47 | 00,000,000 | ---D | C] -- C:\DOCUME~1\Billy\Desktop\yahoo games
[2009/04/07 16:20:04 | 00,000,000 | ---D | C] -- C:\WINDOWS\Governor of Poker
[2009/04/07 16:12:32 | 00,000,000 | ---D | C] -- C:\WINDOWS\Yard Sale Junkie
[2009/04/07 16:10:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\DivoGames
[2009/04/07 16:06:37 | 00,000,000 | ---D | C] -- C:\WINDOWS\Super Granny 4
[2009/04/07 16:05:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Billy\Application Data\Gaijin Ent
[2009/04/07 16:04:45 | 00,000,000 | ---D | C] -- C:\WINDOWS\Stand O Food 2
[2009/04/07 16:03:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\FreshGames
[2009/04/07 16:02:52 | 00,000,000 | ---D | C] -- C:\WINDOWS\Ranch Rush
[2009/04/07 16:01:03 | 00,000,000 | ---D | C] -- C:\WINDOWS\Polly Pride - Pet Detective
[2009/04/07 15:59:33 | 00,000,000 | ---D | C] -- C:\DOCUME~1\ALLUSE~1\Documents\BigFish
[2009/04/07 15:59:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\Picto Words
[2009/04/07 15:55:06 | 00,000,000 | ---D | C] -- C:\Program Files\BFG
[2009/04/07 15:53:29 | 00,000,000 | ---D | C] -- C:\WINDOWS\Mystery In London
[2009/04/07 15:52:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Friends Games
[2009/04/07 15:50:55 | 00,000,000 | ---D | C] -- C:\WINDOWS\Magic Match Adventures[h33t][oi812heet]
[2009/04/07 15:46:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Billy\Application Data\ITTNord
[2009/04/07 15:46:39 | 00,000,000 | ---D | C] -- C:\WINDOWS\Kiss Me
[2009/04/07 15:46:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Billy\Application Data\Alawar
[2009/04/07 15:45:36 | 00,000,000 | ---D | C] -- C:\WINDOWS\Jenny's Fish Shop
[2009/04/07 15:38:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Billy\Application Data\Jane s Hotel Family Hero
[2009/04/07 15:37:17 | 00,000,000 | ---D | C] -- C:\WINDOWS\Jane's Hotel. Family Hero
[2009/04/07 15:28:58 | 00,000,000 | ---D | C] -- C:\WINDOWS\Hide & Secret 2 - Cliffhanger Castle
[2009/04/07 15:23:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Fitn17
[2009/04/07 15:22:33 | 00,000,000 | ---D | C] -- C:\WINDOWS\Fitness Frenzy
[2009/04/07 15:16:34 | 00,000,000 | ---D | C] -- C:\WINDOWS\Fashion Dash
[2009/04/07 15:13:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Billy\Application Data\FarmerJane
[2009/04/07 15:11:04 | 00,000,000 | ---D | C] -- C:\WINDOWS\Farmer Jane
[2009/04/07 14:58:06 | 00,000,000 | ---D | C] -- C:\WINDOWS\Etch-a-Sketch - Knobbys Quest
[2009/04/07 14:55:17 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PiddlePup Games
[2009/04/07 14:51:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Billy\Application Data\GamesCafe
[2009/04/07 14:48:17 | 00,000,000 | ---D | C] -- C:\WINDOWS\CLUE Classic
[2009/04/07 14:38:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\HipSoft
[2009/04/07 14:37:50 | 00,000,000 | ---D | C] -- C:\WINDOWS\Build-a-lot 2 - Town of the Year
[2009/04/07 14:35:37 | 00,000,000 | ---D | C] -- C:\WINDOWS\Build in Time
[2009/04/07 14:33:24 | 00,000,000 | ---D | C] -- C:\WINDOWS\Apple Pie
[2009/04/07 14:29:12 | 00,000,000 | ---D | C] -- C:\WINDOWS\Brain Challenge
[2009/04/07 14:22:27 | 00,000,000 | ---D | C] -- C:\WINDOWS\10 Days Under The Sea
[2009/04/07 14:19:17 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Billy\Application Data\EnchantedCavern
[2009/04/07 14:18:08 | 00,000,000 | ---D | C] -- C:\WINDOWS\Enchanted Cavern
[2009/04/07 13:45:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Billy\Application Data\My Games
[2009/04/07 13:45:09 | 00,000,000 | ---D | C] -- C:\WINDOWS\Posh Boutique
[2009/04/07 13:38:46 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Billy\Local Settings\Application Data\7Wonders2
[2009/04/06 15:45:41 | 00,004,096 | ---- | C] () -- C:\WINDOWS\d3dx.dat
[2009/04/06 15:42:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Billy\Application Data\MysteryStudio
[2009/04/05 15:33:57 | 00,000,717 | ---- | C] () -- C:\DOCUME~1\Billy\Desktop\Age of Empires II.lnk
[2009/04/05 15:29:37 | 00,000,000 | ---D | C] -- C:\Program Files\Age of Empires
[2009/04/04 15:17:17 | 00,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab
[2009/04/04 15:17:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Billy\Application Data\SystemRequirementsLab
[2009/04/04 07:43:59 | 00,000,000 | ---D | C] -- C:\Program Files\PowerISO
[2009/04/02 14:58:27 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Games
[2009/04/01 15:02:27 | 00,000,000 | ---D | C] -- C:\WINDOWS\Alex Gordon
[2009/03/30 20:49:39 | 00,044,427 | ---- | C] () -- C:\DOCUME~1\Billy\Desktop\MAP.PNG
[2009/03/30 07:25:38 | 00,000,000 | ---D | C] -- C:\Program Files\bfgclient
[2009/03/30 07:01:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AlawarWrapper
[2009/03/30 07:01:04 | 00,000,000 | ---D | C] -- C:\DOCUME~1\ALLUSE~1\Documents\AlawarWrapper
[2009/03/30 06:23:16 | 00,000,000 | ---D | C] -- C:\Program Files\AskSBar
[2009/03/28 07:50:37 | 00,238,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine3_0.dll
[2009/03/28 07:50:35 | 00,025,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\X3DAudio1_3.dll
[2009/03/28 07:50:34 | 01,420,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_37.dll
[2009/03/28 07:50:34 | 00,462,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_37.dll
[2009/03/28 07:50:33 | 03,786,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DX9_37.dll
[2009/03/28 07:50:32 | 00,267,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_10.dll
[2009/03/28 07:50:30 | 01,374,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_36.dll
[2009/03/28 07:50:30 | 00,444,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_36.dll
[2009/03/28 07:50:29 | 03,734,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_36.dll
[2009/03/28 07:50:27 | 00,267,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_9.dll
[2009/03/28 07:50:25 | 01,358,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_35.dll
[2009/03/28 07:50:25 | 00,444,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_35.dll
[2009/03/28 07:50:24 | 03,727,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_35.dll
[2009/03/28 07:50:22 | 00,266,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_8.dll
[2009/03/28 07:50:21 | 00,017,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\X3DAudio1_2.dll
[2009/03/28 07:50:19 | 01,124,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_34.dll
[2009/03/28 07:50:19 | 00,443,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_34.dll
[2009/03/28 07:50:17 | 03,497,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_34.dll
[2009/03/28 07:50:13 | 00,081,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xinput1_3.dll
[2009/03/28 07:50:09 | 00,261,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_7.dll
[2009/03/28 07:50:06 | 01,123,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_33.dll
[2009/03/28 07:50:06 | 00,443,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_33.dll
[2009/03/28 07:50:01 | 03,495,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_33.dll
[2009/03/28 07:49:56 | 00,255,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_6.dll
[2009/03/28 07:49:54 | 00,251,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_5.dll
[2009/03/28 07:49:53 | 03,426,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_32.dll
[2009/03/28 07:49:52 | 00,237,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_4.dll
[2009/03/28 07:49:52 | 00,015,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\x3daudio1_1.dll
[2009/03/28 07:49:50 | 02,414,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_31.dll
[2009/03/28 07:49:49 | 00,236,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_3.dll
[2009/03/28 07:49:47 | 00,062,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xinput1_2.dll
[2009/03/28 07:49:46 | 00,230,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_2.dll
[2009/03/28 07:49:45 | 00,062,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xinput1_1.dll
[2009/03/28 07:49:44 | 00,229,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_1.dll
[2009/03/28 07:49:36 | 02,388,176 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_30.dll
[2009/03/28 07:49:34 | 00,230,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_0.dll
[2009/03/28 07:49:34 | 00,014,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\x3daudio1_0.dll
[2009/03/28 07:49:32 | 02,332,368 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_29.dll
[2009/03/28 07:49:30 | 02,323,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_28.dll
[2009/03/28 07:49:29 | 00,061,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xinput9_1_0.dll
[2009/03/28 07:49:28 | 02,319,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_27.dll
[2009/03/28 07:49:26 | 02,337,488 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_25.dll
[2009/03/28 07:49:17 | 02,222,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_24.dll
[2009/03/28 07:37:29 | 00,000,000 | -H-D | C] -- C:\WINDOWS\msdownld.tmp
[2009/03/28 07:37:11 | 00,000,000 | ---D | C] -- C:\WINDOWS\Logs
[2009/03/15 18:25:46 | 00,056,268 | ---- | C] (PowerISO Computing, Inc.) -- C:\WINDOWS\System32\drivers\scdemu.sys
[2009/03/15 13:15:40 | 00,000,000 | ---D | C] -- C:\Program Files\iTunes
[2009/03/15 13:15:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/03/15 13:14:12 | 00,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2009/03/15 13:09:54 | 00,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/03/15 13:09:48 | 00,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2009/03/15 00:20:47 | 00,262,144 | ---- | C] () -- C:\ntuser.dat
[2009/02/15 13:28:15 | 00,004,420 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009/01/08 18:27:08 | 00,000,616 | ---- | C] () -- C:\WINDOWS\RegGenie.ini
[2008/11/29 13:06:52 | 00,000,318 | ---- | C] () -- C:\WINDOWS\WPE PRO.INI
[2008/10/19 18:22:09 | 00,000,042 | ---- | C] () -- C:\WINDOWS\AlchemyMindworksUpdateList.INI
[2008/10/08 21:26:30 | 00,000,082 | ---- | C] () -- C:\WINDOWS\mafosav.INI
[2008/01/03 00:02:38 | 00,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2007/12/19 22:53:30 | 00,000,272 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2007/08/06 21:30:54 | 00,077,312 | ---- | C] () -- C:\WINDOWS\ua2.dll
[2007/07/01 14:57:23 | 00,081,332 | ---- | C] () -- C:\WINDOWS\System32\bass.dll
[2007/06/30 01:25:45 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2007/05/28 19:10:48 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007/05/17 22:29:18 | 00,049,152 | ---- | C] () -- C:\WINDOWS\System32\JJAKEn.dll
[2007/05/17 20:55:52 | 00,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2007/03/29 22:00:40 | 00,203,264 | ---- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
[2005/12/08 15:19:22 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\EGamesPlugin.dll
[2005/12/08 15:19:22 | 00,036,864 | ---- | C] () -- C:\WINDOWS\System32\EGameEncrypt.dll
[2005/03/15 10:18:02 | 00,012,288 | ---- | C] () -- C:\WINDOWS\impborl.dll
[2005/03/07 09:06:17 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Setup32.INI
[2004/11/30 06:42:37 | 00,002,114 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2004/11/20 08:51:24 | 00,000,155 | ---- | C] () -- C:\WINDOWS\disney.ini
[2004/11/15 05:26:16 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/08/04 08:56:46 | 00,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2003/08/07 16:42:30 | 00,006,528 | ---- | C] () -- C:\WINDOWS\System32\drivers\gflmouhid.sys
[2003/01/07 15:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/08/23 20:00:00 | 00,001,410 | ---- | C] () -- C:\WINDOWS\win.ini
[2001/08/23 20:00:00 | 00,000,396 | ---- | C] () -- C:\WINDOWS\system.ini
========== Files - Modified Within 30 Days ==========
[168 C:\WINDOWS\System32\*.tmp files]
[8 C:\WINDOWS\*.tmp files]
[2009/04/13 09:00:06 | 00,000,260 | -H-- | M] () -- C:\WINDOWS\tasks\A4D0D4079073516F.job
[2009/04/13 08:56:10 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\DOCUME~1\Billy\Desktop\OTListIt2.exe
[2009/04/13 08:55:43 | 00,267,612 | ---- | M] () -- C:\DOCUME~1\Billy\Desktop\Rooter.exe
[2009/04/13 08:48:28 | 00,004,420 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2009/04/13 08:20:17 | 00,001,410 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/04/13 08:20:17 | 00,000,211 | -HS- | M] () -- C:\boot.ini
[2009/04/13 08:20:16 | 00,000,396 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/04/13 08:15:40 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/04/13 08:04:57 | 00,000,696 | ---- | M] () -- C:\DOCUME~1\ALLUSE~1\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/04/13 07:23:49 | 00,002,228 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/04/13 07:20:54 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/04/12 23:11:48 | 05,846,526 | -H-- | M] () -- C:\Documents and Settings\Billy\Local Settings\Application Data\IconCache.db
[2009/04/12 22:44:51 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009/04/12 22:28:29 | 00,091,136 | ---- | M] () -- C:\Documents and Settings\Billy\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/12 19:08:49 | 00,084,504 | ---- | M] () -- C:\Documents and Settings\Billy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/04/11 14:58:24 | 00,116,224 | ---- | M] () -- C:\DOCUME~1\Billy\My Documents\Karen's doc.doc
[2009/04/10 17:15:00 | 00,000,390 | ---- | M] () -- C:\WINDOWS\tasks\1-Click Maintenance.job
[2009/04/10 14:48:13 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/04/10 08:02:33 | 00,002,114 | ---- | M] () -- C:\WINDOWS\cdplayer.ini
[2009/04/08 06:22:00 | 00,282,128 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/04/07 14:31:58 | 00,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009/04/06 15:45:41 | 00,004,096 | ---- | M] () -- C:\WINDOWS\d3dx.dat
[2009/04/06 15:32:54 | 00,038,496 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/06 15:32:46 | 00,015,504 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/04/05 15:33:57 | 00,000,717 | ---- | M] () -- C:\DOCUME~1\Billy\Desktop\Age of Empires II.lnk
[2009/04/04 13:04:12 | 38,543,7696 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2009/03/30 20:49:40 | 00,044,427 | ---- | M] () -- C:\DOCUME~1\Billy\Desktop\MAP.PNG
[2009/03/30 07:39:08 | 00,000,491 | ---- | M] () -- C:\DOCUME~1\Billy\Desktop\Nikulet.lnk
[2009/03/21 10:03:24 | 00,078,892 | ---- | M] () -- C:\WINDOWS\War3Unin.dat
[2009/03/15 18:25:46 | 00,056,268 | ---- | M] (PowerISO Computing, Inc.) -- C:\WINDOWS\System32\drivers\scdemu.sys
[2009/03/15 00:20:48 | 00,262,144 | ---- | M] () -- C:\ntuser.dat
========== Alternate Data Streams ==========
@Alternate Data Stream - 520 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:05EE1EEF
@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:062AF572
< End of report >
OTListIt Extras logfile created on: 4/13/2009 9:21:28 AM - Run 1
OTListIt2 by OldTimer - Version 2.0.14.0 Folder = C:\Documents and Settings\Billy\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
367.48 Mb Total Physical Memory | 96.00 Mb Available Physical Memory | 26.12% Memory free
889.20 Mb Paging File | 450.55 Mb Available in Paging File | 50.67% Paging File free
Paging file location(s): C:\pagefile.sys 368 368;
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 25.02 Gb Free Space | 33.57% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: RAGNAROK
Current User Name: Billy
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.hta [@ = htafile] -- Reg Error: Key error. File not found
.url [@ = InternetShortcut] -- Reg Error: Key error. File not found
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"FirstRunDisabled" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
"DisableNotifications" = 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"3389:TCP" = 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 (Microsoft Corporation)
C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger (Yahoo! Inc.)
C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox (Mozilla Corporation)
C:\Nexon\MapleStory\MapleStory.exe:*:Enabled:MapleStory File not found
C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 (Microsoft Corporation)
C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) (Microsoft Corporation)
C:\Nexon\MapleStory\NewPatcher.exe:*:Enabled:Patcher MFC ?? ???? File not found
C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger (Microsoft Corporation)
C:\Documents and Settings\Billy\My Documents\Joshua\VNC\winvnc.exe:*:Enabled:VNC server for Win32 File not found
C:\Documents and Settings\Billy\My Documents\Joshua\VNC\UltraVNC\winvnc.exe:*:Enabled:VNC server for Win32 File not found
C:\Program Files\NetBattle\PokeBattle.exe:*:Enabled:NetBattle File not found
C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC (mIRC Co. Ltd.)
C:\Program Files\Warcraft III\War3.exe:*:Enabled:Warcraft III (Blizzard Entertainment)
C:\Program Files\Ocean Technology\GG E-Sports Platform\GGclient.exe:*:Enabled:GG E-Sports Platform Client File not found
C:\Program Files\Angels Online\START.EXE:*:Enabled:START File not found
C:\Program Files\AMPED\GetAmped Philippines\amped.exe:*:Enabled:amped File not found
C:\Program Files\Wonderland Online\Main.exe:*:Enabled:Main ()
C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Disabled:Internet Explorer (Microsoft Corporation)
C:\Nexon\MapleStory\Patcher.exe:*:Disabled:Patcher MFC ?? ???? File not found
C:\Program Files\NCONY\PIStory\Bin\Patcher.exe:*:Disabled:PIStory File not found
C:\WINDOWS\system32\winctl.exe:*:Disabled:winctl File not found
C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe (AVG Technologies CZ, s.r.o.)
C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe (AVG Technologies CZ, s.r.o.)
C:\Program Files\StepMania CVS\Program\StepMania.exe:*:Enabled:StepMania File not found
C:\Program Files\DNA\btdna.exe:*:Enabled:DNA (BitTorrent, Inc.)
C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader (AOL LLC)
C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM File not found
C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent (BitTorrent, Inc.)
C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour (Apple Inc.)
C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes (Apple Inc.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0E2B767B-EA6A-489B-BF83-8083FE1DB661}" = Pcsx2 0.9.6
"{15AC0C5D-A6FB-4CE2-8CD0-28179EEB5625}" = Nokia Connectivity Cable Driver
"{162B71B8-8464-4680-A086-601D555B331D}" = Apple Mobile Device Support
"{20749F76-4228-43AD-8AB5-E7B20D8040C4}" = hph_readme
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 11
"{2B7E4354-0492-460A-BDB1-1F59EE141025}" = AirPlus G
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3580211E-3BB7-42C0-ADC3-9A8C1EFFF2CB}" = ArcSoft Media Card Companion
"{36DC3E2F-CD8C-4953-9E8F-9A1916D10AA1}" = hph_software
"{43DCF766-6838-4F9A-8C91-D92DA586DFA7}" = Microsoft Windows Journal Viewer
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm
"{49672EC2-171B-47B4-8CE7-50D7806360D7}" = Windows Live Sign-in Assistant
"{4C590030-7469-453E-8589-D15DA9D03F52}" = ANIWZCS2 Service
"{4EA684E9-5C81-4033-A696-3019EC57AC3A}" = HPProductAssistant
"{54266945-8A11-424D-B20F-4F747A714FBA}" = DV TS
"{571700F0-DB9D-4B3A-B03D-35A14BB5939F}" = Windows Live Messenger
"{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}" = Nokia PC Suite
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6909F917-5499-482e-9AA1-FAD06A99F231}" = Toolbox
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6994491D-D491-48F1-AE1F-E179C1FFFC2F}" = HP Photosmart Essential
"{6CCD2499-B85E-E090-0B68-00B474AF92FD}" = Diner Dash 2
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{7148F0A8-6813-11D6-A77B-00B0D0142060}" = Java 2 Runtime Environment, SE v1.4.2_06
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B5CE976-C7A9-4E38-A7F3-6C8EF025DD8E}" = ANIO Service
"{7D1DCBBA-F6F5-42B4-B90B-F04ACE4DFD6C}" = MSN Search Toolbar
"{8331C3EA-0C91-43AA-A4D4-27221C631139}" = Status
"{868F24EB-5CA7-4285-B39B-3617CF37462A}" = D2300_Help
"{8A62A068-3FD6-495A-9F66-26FE94F32EC9}" = Rhapsody Player Engine
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{93F599DF-519B-4706-A3F1-9530DF2590B4}" = ArcSoft PhotoImpression 5
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{ACCCEE83-B49B-4964-8A4F-378B8FBC9F75}" = hph_ProductContext
"{AD4E589A-C44A-4498-A8AF-6AFF09E07901}" = Creative ZEN Neeon 2
"{B19F9155-9337-4807-B5EF-ED471DDB2CCE}" = hph_software_req
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C26B06A9-27BB-45B0-9873-9C623EC2BA38}" = iTunes
"{C7F54CF8-D6FB-4E0A-93A3-E68AE0D6C476}" = SolutionCenter
"{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D297A783-A680-4FDB-8882-913EBA36ABC5}" = D2300
"{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}" = HP Photosmart and Deskjet 7.0 Software
"{D848D140-41C3-4A53-86D8-E866A100B4CD}" = PC Connectivity Solution
"{DBC20735-34E6-4E97-A9E5-2066B66B243D}" = TrayApp
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware 2007
"{E1B80DEE-A795-4258-8445-074C06AE3AB8}" = MarketResearch
"{E5BD1F9C-8BBA-410E-837D-94D523269F8F}" = ArcSoft MediaConverter
"{E6CF5B58-E775-46C0-BFF2-F39A0014FE4A}" = muvee autoProducer 4.1
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
"10 Days Under The Sea1.0" = 10 Days Under The Sea
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"5986551A16FD8E9B1B4C89E7AAD17C1BB3196D28" = Windows Driver Package - Nokia Modem (10/27/2008 7.01.0.1)
"6D296974BAB6CA8429D5E687B292A6DA3E9FBD4A" = Windows Driver Package - Nokia Modem (10/27/2008 3.9)
"9CD348AE9C64C4B939B624E8E24F3903EFDFC82B" = Windows Driver Package - Nokia Modem (05/22/2008 7.00.0.1)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 6.0" = Adobe Photoshop 6.0
"Adobe Shockwave Player" = Adobe Shockwave Player
"Adobe SVG Viewer" = Adobe SVG Viewer
"aeRO" = aeRO
"AIM Toolbar" = AIM Toolbar
"Alex Gordon1.0" = Alex Gordon
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal - Free Antivirus
"Apple Pie1.0" = Apple Pie
"AVG8Uninstall" = AVG Free 8.0
"BFG-Alex Gordon" = Alex Gordon
"BFGC" = Big Fish Games Client
"Brain Challenge1.0" = Brain Challenge
"Build in Time1.0" = Build in Time
"Build-a-lot 2 - Town of the Year1.0" = Build-a-lot 2 - Town of the Year
"C5A76DC11BABDA0A881E7BE8DDEB641365A77FFD" = Windows Driver Package - Nokia Modem (05/22/2008 3.8)
"CLUE Classic1.0" = CLUE Classic
"Cygnus Hex Editor" = Cygnus Hex Editor 2.50
"deXter's Sakray Updater" = deXter's Sakray Updater
"Diner Dash 2" = Diner Dash 2 (remove only)
"Enchanted Cavern1.0" = Enchanted Cavern
"Etch-a-Sketch - Knobbys Quest1.0" = Etch-a-Sketch - Knobbys Quest
"Farmer Jane1.0" = Farmer Jane
"Fashion Dash1.0" = Fashion Dash
"Fitness Frenzy1.0" = Fitness Frenzy
"FlashGet(JetCar)" = FlashGet(JetCar)
"GHPD Offline Pokedex 4.0" = GHPD Offline Pokedex 4.0
"GIF Construction Set Professional 3" = GIF Construction Set Professional 3
"Governor of Poker1.0" = Governor of Poker
"GTK 2.0" = GTK+ Runtime 2.14.6 rev a (remove only)
"Hide & Secret 2 - Cliffhanger Castle1.0" = Hide & Secret 2 - Cliffhanger Castle
"HP Imaging Device Functions" = HP Imaging Device Functions 7.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 7.0
"HPExtendedCapabilities" = HP Customer Participation Program 7.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Inno Setup 5_is1" = Inno Setup version 5.2.2
"IrfanView" = IrfanView (remove only)
"JAIELangPack" = Japanese Language Support
"Jane's Hotel. Family Hero1.0" = Jane's Hotel. Family Hero
"Jenny's Fish Shop1.0" = Jenny's Fish Shop
"Kiss Me1.0" = Kiss Me
"Magic Match Adventures[h33t][oi812heet]" = Magic Match Adventures[h33t][oi812heet]
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live & Sponsor (CiD)
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"mIRC" = mIRC
"Mozilla Firefox (3.0.8)" = Mozilla Firefox (3.0.8)
"MSTTS" = Microsoft Text-to-Speech Engine 4.0 (English)
"Mystery In London" = Mystery In London
"Neffy" = Neffy 1,2,0,6
"Nero PhotoShow Express 4" = Nero PhotoShow Express 4
"NetBattle_is1" = NetBattle
"Network Play System (Patching)" = Network Play System (Patching)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Nokia PC Suite" = Nokia PC Suite
"Peggle" = Peggle (remove only)
"Picto Words1.0" = Picto Words
"Pidgin" = Pidgin
"Plaxo" = Plaxo Toolbar for Outlook and Outlook Express
"Popup Free" = Popup Free (remove only)
"Posh Boutique1.0" = Posh Boutique
"PowerISO" = PowerISO
"Ragnarok Online" = Ragnarok Online
"Ragnarok Sakray" = Ragnarok Sakray
"Ranch Rush1.0" = Ranch Rush
"RealPlayer 6.0" = RealPlayer
"RPG Maker 2003_is1" = RPG Maker 2003 v1.08
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"Stand O Food 21.0" = Stand O Food 2
"Super Granny 41.0" = Super Granny 4
"SysInfo" = Creative System Information
"SystemRequirementsLab" = System Requirements Lab
"Total Video Converter 3.14_is1" = Total Video Converter 3.14 08113
"Treasures of the Ancient Cavern" = Treasures of the Ancient Cavern
"VistaMizer" = VistaMizer 2.5.2.0
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Webshots Desktop" = Webshots Desktop
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"Wonderland Online_is1" = Wonderland Online 3.0.1
"Yahoo! Extras" = Yahoo! Browser Services
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Search Defender" = Yahoo! Search Protection
"Yard Sale Junkie1.0" = Yard Sale Junkie
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent DNA" = DNA
"uTorrent" = µTorrent
"Warcraft III" = Warcraft III: All Products
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 2/9/2009 9:48:49 AM | Computer Name = RAGNAROK | Source = Application Error | ID = 1000
Description = Faulting application visualboyadvance.exe, version 1.7.2.560, faulting
module visualboyadvance.exe, version 1.7.2.560, fault address 0x0014bc88.
Error - 2/9/2009 9:49:04 AM | Computer Name = RAGNAROK | Source = Application Error | ID = 1000
Description = Faulting application visualboyadvance.exe, version 1.7.2.560, faulting
module visualboyadvance.exe, version 1.7.2.560, fault address 0x0014bc88.
Error - 2/9/2009 9:50:02 AM | Computer Name = RAGNAROK | Source = Application Error | ID = 1000
Description = Faulting application visualboyadvance.exe, version 1.7.2.560, faulting
module visualboyadvance.exe, version 1.7.2.560, fault address 0x0014bc88.
Error - 2/9/2009 9:50:16 AM | Computer Name = RAGNAROK | Source = Application Error | ID = 1000
Description = Faulting application visualboyadvance.exe, version 1.7.2.560, faulting
module visualboyadvance.exe, version 1.7.2.560, fault address 0x0014bc88.
Error - 2/9/2009 9:50:34 AM | Computer Name = RAGNAROK | Source = Application Error | ID = 1000
Description = Faulting application visualboyadvance.exe, version 1.7.2.560, faulting
module visualboyadvance.exe, version 1.7.2.560, fault address 0x0014bc88.
Error - 2/9/2009 9:53:06 AM | Computer Name = RAGNAROK | Source = Application Error | ID = 1000
Description = Faulting application avgui.exe, version 8.0.0.174, faulting module
avgabout.dll, version 8.0.0.223, fault address 0x00076b29.
Error - 2/9/2009 9:54:20 AM | Computer Name = RAGNAROK | Source = Application Error | ID = 1000
Description = Faulting application visualboyadvance.exe, version 1.7.2.560, faulting
module visualboyadvance.exe, version 1.7.2.560, fault address 0x0014bc88.
Error - 2/9/2009 9:54:28 AM | Computer Name = RAGNAROK | Source = Application Error | ID = 1000
Description = Faulting application visualboyadvance.exe, version 1.7.2.560, faulting
module visualboyadvance.exe, version 1.7.2.560, fault address 0x0014bc88.
Error - 2/9/2009 9:55:33 AM | Computer Name = RAGNAROK | Source = Application Error | ID = 1000
Description = Faulting application visualboyadvance.exe, version 1.7.2.560, faulting
module visualboyadvance.exe, version 1.7.2.560, fault address 0x0014bc88.
Error - 2/9/2009 9:56:20 AM | Computer Name = RAGNAROK | Source = Application Error | ID = 1000
Description = Faulting application visualboyadvance.exe, version 1.7.2.560, faulting
module visualboyadvance.exe, version 1.7.2.560, fault address 0x0014bc88.
[ System Events ]
Error - 4/11/2009 6:53:14 AM | Computer Name = RAGNAROK | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Dnscache service.
Error - 4/11/2009 12:15:41 PM | Computer Name = RAGNAROK | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk1\D.
Error - 4/11/2009 5:45:46 PM | Computer Name = RAGNAROK | Source = Service Control Manager | ID = 7000
Description = The npkcrypt service failed to start due to the following error: %%3
Error - 4/12/2009 5:46:02 AM | Computer Name = RAGNAROK | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Dnscache service.
Error - 4/12/2009 5:46:29 AM | Computer Name = RAGNAROK | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Dnscache service.
Error - 4/12/2009 10:15:51 AM | Computer Name = RAGNAROK | Source = Service Control Manager | ID = 7000
Description = The npkcrypt service failed to start due to the following error: %%3
Error - 4/12/2009 10:50:22 AM | Computer Name = RAGNAROK | Source = DCOM | ID = 10010
Description = The server {72278E83-B0EF-4E49-9E10-6947602C1030} did not register
with DCOM within the required timeout.
Error - 4/12/2009 11:07:39 AM | Computer Name = RAGNAROK | Source = Service Control Manager | ID = 7000
Description = The npkcrypt service failed to start due to the following error: %%3
Error - 4/12/2009 7:21:52 PM | Computer Name = RAGNAROK | Source = Service Control Manager | ID = 7000
Description = The npkcrypt service failed to start due to the following error: %%3
Error - 4/12/2009 7:23:46 PM | Computer Name = RAGNAROK | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).
< End of report >
Edited by shadwblitz, 12 April 2009 - 07:32 PM.
Sign In
Create Account
